Skip to content

Commit

Permalink
removes header type whitelisting
Browse files Browse the repository at this point in the history
  • Loading branch information
ivangsa committed Dec 30, 2024
1 parent 852af38 commit 7024971
Showing 1 changed file with 1 addition and 47 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -7,52 +7,31 @@
import com.fasterxml.jackson.databind.node.ObjectNode;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.messaging.Message;
import org.springframework.messaging.MessageHeaders;
import org.springframework.messaging.support.MessageBuilder;
import org.springframework.modulith.events.core.EventSerializer;

import java.io.IOException;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.regex.Pattern;
import java.util.stream.Stream;

public class MessageEventSerializer implements EventSerializer, InitializingBean {
public class MessageEventSerializer implements EventSerializer {

protected Logger log = LoggerFactory.getLogger(getClass());

private final ObjectMapper jacksonMapper;

private boolean processHeaderTypes = true;

private String[] headerTypesWhiteList = { "java..*" };

private List<Pattern> headerTypesWhiteListPatterns;

public MessageEventSerializer(ObjectMapper jacksonMapper) {
this.jacksonMapper = jacksonMapper;
afterPropertiesSet(); // Initialize if used outside of Spring
}

public void setProcessHeaderTypes(boolean processHeaderTypes) {
this.processHeaderTypes = processHeaderTypes;
}

public void setHeaderTypesWhiteList(String[] headerTypesWhiteList) {
this.headerTypesWhiteList = headerTypesWhiteList;
}

@Override
public void afterPropertiesSet() {
headerTypesWhiteListPatterns = Stream.of(headerTypesWhiteList)
.map(this::convertToRegex)
.map(Pattern::compile)
.toList();
}

protected Map<String, Object> serializeToMap(Object payload) {
ObjectNode objectNode = jacksonMapper.valueToTree(payload);
return jacksonMapper.convertValue(objectNode, Map.class);
Expand Down Expand Up @@ -151,9 +130,6 @@ protected void processHeaderTypes(Map<String, String> headerTypes, Map<String, O
headers.forEach((key, value) -> {
if (headerTypes.containsKey(key)) {
var headerType = headerTypes.get(key);
if (!isHeaderTypeAllowed(headerType)) {
return;
}
try {
if (value instanceof String) {
headers.put(key, jacksonMapper.convertValue(value, Class.forName(headerType)));
Expand All @@ -170,26 +146,4 @@ protected void processHeaderTypes(Map<String, String> headerTypes, Map<String, O
});
}

protected boolean isHeaderTypeAllowed(String headerType) {
if (headerTypesWhiteListPatterns.isEmpty()) {
return true;
}
return headerTypesWhiteListPatterns.stream().anyMatch(p -> p.matcher(headerType).matches());
}

/**
* Converts an AOP pointcut pattern to a Java regex pattern.
* @param aopPattern the AOP pointcut pattern (e.g., com.example..service.*)
* @return the regex equivalent of the AOP pattern
*/
protected String convertToRegex(String aopPattern) {
// Escape dots and replace ".." with ".*" (matches any number of sub-packages)
String regex = aopPattern //
.replace("..", "__") // Match zero or more sub-packages (save for later)
.replace(".", "\\.") // Escape dots for regex
.replace("*", "[^\\.]*") // Match any class or method name
.replace("__", ".*"); // Match zero or more sub-packages (restore)
return "^" + regex + "$"; // Ensure full string match
}

}

0 comments on commit 7024971

Please sign in to comment.