Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce upload size limit on putResourceFromUrl api #8562

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

Enforce upload size limit on putResourceFromUrl api #8562

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d4bcff3
Check content-length of resource at url
tylerjmchugh Dec 13, 2024
a0e2fdc
Remove unnecessary throw
tylerjmchugh Dec 13, 2024
b5b6dbf
Fallback to InputStream.available() if content length is not found or…
tylerjmchugh Dec 17, 2024
2b54b4d
Fallback maxUploadSize for unit tests
tylerjmchugh Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 38 additions & 3 deletions core/src/main/java/org/fao/geonet/api/records/attachments/AbstractStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import jeeves.server.context.ServiceContext;
import org.apache.commons.io.FilenameUtils;
import org.fao.geonet.ApplicationContextHolder;
import org.fao.geonet.api.exception.GeonetMaxUploadSizeExceededException;
import org.fao.geonet.api.exception.NotAllowedException;
import org.fao.geonet.api.exception.ResourceNotFoundException;
import org.fao.geonet.domain.AbstractMetadata;
Expand All @@ -35,13 +36,14 @@
import org.fao.geonet.kernel.AccessManager;
import org.fao.geonet.kernel.datamanager.IMetadataUtils;
import org.fao.geonet.repository.MetadataRepository;
import org.fao.geonet.util.FileUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.ApplicationContext;
import org.springframework.web.multipart.MultipartFile;

import java.io.BufferedInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.HttpURLConnection;
import java.net.URL;
Expand All @@ -59,6 +61,9 @@ public abstract class AbstractStore implements Store {
protected static final String RESOURCE_MANAGEMENT_EXTERNAL_PROPERTIES_ESCAPED_SEPARATOR = "\\:";
private static final Logger log = LoggerFactory.getLogger(AbstractStore.class);

@Value("${api.params.maxUploadSize:100000000}")
private long maxUploadSize;

@Override
public final List<MetadataResource> getResources(final ServiceContext context, final String metadataUuid, final Sort sort,
final String filter) throws Exception {
Expand Down Expand Up @@ -157,7 +162,7 @@ protected int canDownload(ServiceContext context, String metadataUuid, MetadataR
return metadataId;
}

protected String getFilenameFromHeader(final URL fileUrl) throws IOException {
protected String getFilenameFromHeader(final URL fileUrl) {
HttpURLConnection connection = null;
try {
connection = (HttpURLConnection) fileUrl.openConnection();
Expand All @@ -180,6 +185,23 @@ protected String getFilenameFromHeader(final URL fileUrl) throws IOException {
}
}

protected long getContentLengthFromHeader(final URL fileUrl) {
HttpURLConnection connection = null;
try {
connection = (HttpURLConnection) fileUrl.openConnection();
connection.setRequestMethod("HEAD");
connection.connect();
return connection.getContentLengthLong();
} catch (Exception e) {
log.error("Error retrieving resource content length from header", e);
return -1;
} finally {
if (connection != null) {
connection.disconnect();
}
}
}

protected String getFilenameFromUrl(final URL fileUrl) {
String fileName = FilenameUtils.getName(fileUrl.getPath());
if (fileName.contains("?")) {
Expand Down Expand Up @@ -230,7 +252,20 @@ public final MetadataResource putResource(ServiceContext context, String metadat
if (filename == null) {
filename = getFilenameFromUrl(fileUrl);
}
return putResource(context, metadataUuid, filename, fileUrl.openStream(), null, visibility, approved);
try (InputStream is = fileUrl.openStream()) {
long contentLength = getContentLengthFromHeader(fileUrl);
long availableBytes = is.available();
long fileSize = availableBytes > contentLength ? availableBytes : contentLength;
if (fileSize > maxUploadSize) {
throw new GeonetMaxUploadSizeExceededException("uploadedResourceSizeExceededException")
.withMessageKey("exception.maxUploadSizeExceeded",
new String[]{FileUtil.humanizeFileSize(maxUploadSize)})
.withDescriptionKey("exception.maxUploadSizeExceeded.description",
new String[]{FileUtil.humanizeFileSize(fileSize),
FileUtil.humanizeFileSize(maxUploadSize)});
}
return putResource(context, metadataUuid, filename, is, null, visibility, approved);
}
}

@Override
Expand Down
Loading