Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SWC-6754 - Do not cache version check #5614

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

SWC-6754 - Do not cache version check #5614

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/main/java/org/sagebionetworks/web/server/StackEndpoints.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,15 @@ private static String getEndpointPrefix(String host) {
// None of these hosts match and no configuration was loaded from settings, fall back to prod
endpointPrefix = "https://repo-prod.prod.sagebase.org";
}

logger.warning(
"No configuration found for " +
REPO_ENDPOINT_KEY +
", so servlet request will defer to the host header. Host: " +
host +
", endpointPrefix: " +
endpointPrefix
);
Comment on lines +101 to +109
Copy link
Contributor Author

@nickgros nickgros Jan 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO the main problem is that our servlet may use the request header to pick a backend endpoint instead of a configuration parameter, if the configuration parameter is not present. The servlet may cache a response that depends on a header that could vary (or be spoofed!) by different users.

WDYT about opening a follow-up ticket to make the org.sagebionetworks.repositoryservice.endpoint (REPO_ENDPOINT_KEY) required?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Follow-up ticket to make this mandatory seems reasonable

}

return endpointPrefix;
Expand Down
30 changes: 7 additions & 23 deletions src/main/java/org/sagebionetworks/web/server/servlet/VersionsServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,7 @@
package org.sagebionetworks.web.server.servlet;

import com.google.gwt.thirdparty.guava.common.base.Supplier;
import com.google.gwt.thirdparty.guava.common.base.Suppliers;
import java.io.IOException;
import java.net.URLEncoder;
import java.util.concurrent.TimeUnit;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
Expand All @@ -16,7 +13,6 @@
import org.sagebionetworks.client.SynapseClient;
import org.sagebionetworks.client.exceptions.SynapseException;
import org.sagebionetworks.repo.model.versionInfo.SynapseVersionInfo;
import org.sagebionetworks.web.server.StackEndpoints;
import org.sagebionetworks.web.server.servlet.SynapseClientImpl.PortalVersionHolder;
import org.sagebionetworks.web.shared.WebConstants;
import org.sagebionetworks.web.shared.exceptions.RestServiceException;
Expand All @@ -35,11 +31,14 @@ public class VersionsServlet extends HttpServlet {
VersionsServlet.perThreadRequest.get()
);

private final Supplier<SynapseVersionInfo> synapseVersionCache =
Suppliers.memoizeWithExpiration(versionSupplier(), 5, TimeUnit.MINUTES);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this was added because John identified the web client as performing a DOS attack with version checks. Would expiring this cache every 10 seconds be sufficient?


public SynapseVersionInfo getSynapseVersionInfo() {
return synapseVersionCache.get();
try {
SynapseClient synapseClient = createNewClient();
return synapseClient.getVersionInfo();
} catch (SynapseException e) {
log.error(e);
return null;
}
}

private SynapseProvider synapseProvider = new SynapseProviderImpl();
Expand All @@ -50,21 +49,6 @@ private SynapseClient createNewClient() {
);
}

private Supplier<SynapseVersionInfo> versionSupplier() {
return new Supplier<SynapseVersionInfo>() {
public SynapseVersionInfo get() {
try {
org.sagebionetworks.client.SynapseClient synapseClient =
createNewClient();
return synapseClient.getVersionInfo();
} catch (SynapseException e) {
log.error(e);
return null;
}
}
};
}

public String getSynapseVersions() throws RestServiceException {
return (
PortalVersionHolder.getVersionInfo() +
Expand Down
Loading