From a561bd77c8913a8f061226400e056adae4437578 Mon Sep 17 00:00:00 2001
From: Francois Prunayre
Date: Wed, 9 Jun 2021 17:06:28 +0200
Subject: [PATCH] UUID with URL special character support.
eg. info:doi:10.24396/ORDAR-56 or http://dada.moo/ORDAR-56
In order to support UUID with character like / or ; in it, you need
to disable default Spring HTTP Firewall behaviour which consider those characters unsecure.
Error would look like "URL contained a potentially malicious String "%2F""
For this uncomment the firewall configuration in config-security-core.xml and adjust StrictHttpFirewall configuration.
Also uncomment the firewall property of filterChainProxy.
Client side already URL encode UUIDs and with this, spring will not
decode path before matching URL (which would cause issue with request mapping)
By default, this is not active.
---
.../attachments/FilesystemStoreResource.java | 2 +-
.../geonet/api/mapservers/MapServersApi.java | 6 ++---
.../org/fao/geonet/api/records/DoiApi.java | 6 ++---
.../api/records/InspireValidationApi.java | 4 ++--
.../fao/geonet/api/records/MetadataApi.java | 20 +++++++++-------
.../api/records/MetadataInsertDeleteApi.java | 2 +-
.../api/records/MetadataProcessApi.java | 6 ++---
.../api/records/MetadataSavedQueryApi.java | 2 +-
.../api/records/MetadataSharingApi.java | 12 +++++-----
.../geonet/api/records/MetadataSocialApi.java | 2 +-
.../geonet/api/records/MetadataTagApi.java | 6 ++---
.../api/records/MetadataValidateApi.java | 2 +-
.../api/records/MetadataVersionningApi.java | 2 +-
.../api/records/MetadataWorkflowApi.java | 20 ++++++++--------
.../attachments/AttachmentsActionsApi.java | 2 +-
.../records/attachments/AttachmentsApi.java | 2 +-
.../records/editing/MetadataEditingApi.java | 14 +++++------
.../api/records/extent/MetadataExtentApi.java | 6 ++---
.../api/records/formatters/FormatterApi.java | 2 +-
.../api/userfeedback/UserFeedbackAPI.java | 6 ++---
.../components/catalog/CatalogService.js | 4 ++--
.../edit/fieldupload/FieldUploadDirective.js | 2 +-
.../edit/onlinesrc/OnlineSrcDirective.js | 4 ++--
.../edit/onlinesrc/OnlineSrcService.js | 2 +-
.../ValidationReportService.js | 2 +-
.../filestore/FileStoreDirective.js | 2 +-
.../components/filestore/FileStoreService.js | 2 +-
.../metadataactions/MetadataActionService.js | 2 +-
.../MetadataActionsDirective.js | 2 +-
.../metadataactions/RelatedDirective.js | 2 +-
.../search/mdview/mdviewDirective.js | 16 +++++++------
.../search/searchmanager/LocationService.js | 2 +-
.../userfeedback/GnUserfeedbackDirective.js | 4 ++--
.../GnmdInspireValidationDirective.js | 2 +-
.../directives/partials/mdactionmenu.html | 2 +-
.../views/default/templates/recordView.html | 2 +-
.../config-security/config-security-core.xml | 24 +++++++++++++++++++
37 files changed, 114 insertions(+), 86 deletions(-)
diff --git a/core/src/main/java/org/fao/geonet/api/records/attachments/FilesystemStoreResource.java b/core/src/main/java/org/fao/geonet/api/records/attachments/FilesystemStoreResource.java
index 336cbf4e865..08f665b4c4e 100644
--- a/core/src/main/java/org/fao/geonet/api/records/attachments/FilesystemStoreResource.java
+++ b/core/src/main/java/org/fao/geonet/api/records/attachments/FilesystemStoreResource.java
@@ -84,7 +84,7 @@ public FilesystemStoreResource(String metadataUuid,
@Override
public String getId() {
- return UrlEscapers.urlFragmentEscaper().escape(metadataUuid) +
+ return UrlEscapers.urlPathSegmentEscaper().escape(metadataUuid) +
"/attachments/" +
UrlEscapers.urlFragmentEscaper().escape(filename);
}
diff --git a/services/src/main/java/org/fao/geonet/api/mapservers/MapServersApi.java b/services/src/main/java/org/fao/geonet/api/mapservers/MapServersApi.java
index f09a537da72..961c327b366 100644
--- a/services/src/main/java/org/fao/geonet/api/mapservers/MapServersApi.java
+++ b/services/src/main/java/org/fao/geonet/api/mapservers/MapServersApi.java
@@ -351,7 +351,7 @@ public void deleteMapserver(
// @Authorization(value = "basicAuth")
// }
)
- @RequestMapping(value = "/{mapserverId}/records/{metadataUuid}",
+ @RequestMapping(value = "/{mapserverId}/records/{metadataUuid:.+}",
method = RequestMethod.GET,
produces = {
MediaType.TEXT_PLAIN_VALUE
@@ -405,7 +405,7 @@ public String getMapserverResource(
// @Authorization(value = "basicAuth")
// }
)
- @RequestMapping(value = "/{mapserverId}/records/{metadataUuid}",
+ @RequestMapping(value = "/{mapserverId}/records/{metadataUuid:.+}",
method = RequestMethod.PUT,
produces = {
MediaType.TEXT_PLAIN_VALUE
@@ -460,7 +460,7 @@ public String publishMapserverResource(
// })
)
@RequestMapping(
- value = "/{mapserverId}/records/{metadataUuid}",
+ value = "/{mapserverId}/records/{metadataUuid:.+}",
method = RequestMethod.DELETE,
produces = {
MediaType.TEXT_PLAIN_VALUE
diff --git a/services/src/main/java/org/fao/geonet/api/records/DoiApi.java b/services/src/main/java/org/fao/geonet/api/records/DoiApi.java
index ed767e39022..47855baef57 100644
--- a/services/src/main/java/org/fao/geonet/api/records/DoiApi.java
+++ b/services/src/main/java/org/fao/geonet/api/records/DoiApi.java
@@ -69,7 +69,7 @@ public class DoiApi {
@io.swagger.v3.oas.annotations.Operation(
summary = "Check that a record can be submitted to DataCite for DOI creation. " +
"DataCite requires some fields to be populated.")
- @RequestMapping(value = "/{metadataUuid}/doi/checkPreConditions",
+ @RequestMapping(value = "/{metadataUuid:.+}/doi/checkPreConditions",
method = RequestMethod.GET,
produces = {
MediaType.APPLICATION_JSON_VALUE
@@ -104,7 +104,7 @@ ResponseEntity
diff --git a/web/src/main/webapp/WEB-INF/config-security/config-security-core.xml b/web/src/main/webapp/WEB-INF/config-security/config-security-core.xml
index 46831cffaad..1e616c3804e 100644
--- a/web/src/main/webapp/WEB-INF/config-security/config-security-core.xml
+++ b/web/src/main/webapp/WEB-INF/config-security/config-security-core.xml
@@ -63,8 +63,32 @@
+
+