Andrew Shvayka
2 years ago
committed by
GitHub
GitHub
12 changed files with 209 additions and 124 deletions
@ -1,78 +0,0 @@ |
|||||
/** |
|
||||
* Copyright © 2016-2024 The Thingsboard Authors |
|
||||
* |
|
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|
||||
* you may not use this file except in compliance with the License. |
|
||||
* You may obtain a copy of the License at |
|
||||
* |
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||
* |
|
||||
* Unless required by applicable law or agreed to in writing, software |
|
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|
||||
* See the License for the specific language governing permissions and |
|
||||
* limitations under the License. |
|
||||
*/ |
|
||||
package org.thingsboard.server.config; |
|
||||
|
|
||||
import jakarta.servlet.FilterChain; |
|
||||
import jakarta.servlet.ServletException; |
|
||||
import jakarta.servlet.http.HttpServletRequest; |
|
||||
import jakarta.servlet.http.HttpServletResponse; |
|
||||
import lombok.RequiredArgsConstructor; |
|
||||
import lombok.extern.slf4j.Slf4j; |
|
||||
import org.springframework.beans.factory.annotation.Value; |
|
||||
import org.springframework.stereotype.Component; |
|
||||
import org.springframework.util.AntPathMatcher; |
|
||||
import org.springframework.web.filter.OncePerRequestFilter; |
|
||||
import org.thingsboard.server.common.msg.tools.MaxPayloadSizeExceededException; |
|
||||
import org.thingsboard.server.exception.ThingsboardErrorResponseHandler; |
|
||||
|
|
||||
import java.io.IOException; |
|
||||
import java.util.List; |
|
||||
|
|
||||
@Slf4j |
|
||||
@Component |
|
||||
@RequiredArgsConstructor |
|
||||
public class RequestSizeFilter extends OncePerRequestFilter { |
|
||||
|
|
||||
private final List<String> urls = List.of("/api/plugins/rpc/**", "/api/rpc/**"); |
|
||||
private final AntPathMatcher pathMatcher = new AntPathMatcher(); |
|
||||
private final ThingsboardErrorResponseHandler errorResponseHandler; |
|
||||
|
|
||||
@Value("${transport.http.max_payload_size:65536}") |
|
||||
private int maxPayloadSize; |
|
||||
|
|
||||
@Override |
|
||||
public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException { |
|
||||
if (request.getContentLength() > maxPayloadSize) { |
|
||||
if (log.isDebugEnabled()) { |
|
||||
log.debug("Too large payload size. Url: {}, client ip: {}, content length: {}", request.getRequestURL(), |
|
||||
request.getRemoteAddr(), request.getContentLength()); |
|
||||
} |
|
||||
errorResponseHandler.handle(new MaxPayloadSizeExceededException(), response); |
|
||||
return; |
|
||||
} |
|
||||
chain.doFilter(request, response); |
|
||||
} |
|
||||
|
|
||||
@Override |
|
||||
protected boolean shouldNotFilter(HttpServletRequest request) { |
|
||||
for (String url : urls) { |
|
||||
if (pathMatcher.match(url, request.getRequestURI())) { |
|
||||
return false; |
|
||||
} |
|
||||
} |
|
||||
return true; |
|
||||
} |
|
||||
|
|
||||
@Override |
|
||||
protected boolean shouldNotFilterAsyncDispatch() { |
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
@Override |
|
||||
protected boolean shouldNotFilterErrorDispatch() { |
|
||||
return false; |
|
||||
} |
|
||||
} |
|
||||
File diff suppressed because one or more lines are too long
@ -0,0 +1,90 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2024 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.http.config; |
||||
|
|
||||
|
import jakarta.servlet.FilterChain; |
||||
|
import jakarta.servlet.ServletException; |
||||
|
import jakarta.servlet.http.HttpServletRequest; |
||||
|
import jakarta.servlet.http.HttpServletResponse; |
||||
|
import lombok.RequiredArgsConstructor; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.springframework.http.HttpStatus; |
||||
|
import org.springframework.util.AntPathMatcher; |
||||
|
import org.springframework.web.filter.OncePerRequestFilter; |
||||
|
import org.thingsboard.common.util.JacksonUtil; |
||||
|
import org.thingsboard.server.common.msg.tools.MaxPayloadSizeExceededException; |
||||
|
|
||||
|
import java.io.IOException; |
||||
|
import java.util.LinkedHashMap; |
||||
|
import java.util.Map; |
||||
|
|
||||
|
@Slf4j |
||||
|
@RequiredArgsConstructor |
||||
|
public class PayloadSizeFilter extends OncePerRequestFilter { |
||||
|
|
||||
|
private final Map<String, Long> limits = new LinkedHashMap<>(); |
||||
|
private final AntPathMatcher pathMatcher = new AntPathMatcher(); |
||||
|
|
||||
|
public PayloadSizeFilter(String limitsConfiguration) { |
||||
|
for (String limit : limitsConfiguration.split(";")) { |
||||
|
try { |
||||
|
String urlPathPattern = limit.split("=")[0]; |
||||
|
long maxPayloadSize = Long.parseLong(limit.split("=")[1]); |
||||
|
limits.put(urlPathPattern, maxPayloadSize); |
||||
|
} catch (Exception e) { |
||||
|
throw new IllegalArgumentException("Failed to parse size limits configuration: " + limitsConfiguration); |
||||
|
} |
||||
|
} |
||||
|
log.info("Initialized payload size filter with configuration: {}" , limitsConfiguration); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException { |
||||
|
for (String url : limits.keySet()) { |
||||
|
if (pathMatcher.match(url, request.getRequestURI())) { |
||||
|
if (checkMaxPayloadSizeExceeded(request, response, limits.get(url))) { |
||||
|
return; |
||||
|
} |
||||
|
break; |
||||
|
} |
||||
|
} |
||||
|
chain.doFilter(request, response); |
||||
|
} |
||||
|
|
||||
|
private boolean checkMaxPayloadSizeExceeded(HttpServletRequest request, HttpServletResponse response, long maxPayloadSize) throws IOException { |
||||
|
if (request.getContentLength() > maxPayloadSize) { |
||||
|
log.info("[{}] [{}] Payload size {} exceeds the limit of {} bytes", request.getRemoteAddr(), request.getRequestURL(), request.getContentLength(), maxPayloadSize); |
||||
|
handleMaxPayloadSizeExceededException(response, new MaxPayloadSizeExceededException(maxPayloadSize)); |
||||
|
return true; |
||||
|
} |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
protected boolean shouldNotFilterAsyncDispatch() { |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
protected boolean shouldNotFilterErrorDispatch() { |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
private void handleMaxPayloadSizeExceededException(HttpServletResponse response, MaxPayloadSizeExceededException exception) throws IOException { |
||||
|
response.setStatus(HttpStatus.PAYLOAD_TOO_LARGE.value()); |
||||
|
JacksonUtil.writeValue(response.getWriter(), exception.getMessage()); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,57 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2024 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.http.config; |
||||
|
|
||||
|
import org.springframework.beans.factory.annotation.Value; |
||||
|
import org.springframework.context.annotation.Bean; |
||||
|
import org.springframework.context.annotation.Configuration; |
||||
|
import org.springframework.core.annotation.Order; |
||||
|
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; |
||||
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity; |
||||
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; |
||||
|
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; |
||||
|
import org.springframework.security.web.SecurityFilterChain; |
||||
|
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; |
||||
|
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; |
||||
|
|
||||
|
@Configuration |
||||
|
@EnableWebSecurity |
||||
|
@EnableMethodSecurity |
||||
|
public class TransportSecurityConfiguration { |
||||
|
public static final String DEVICE_API_ENTRY_POINT = "/api/v1/**"; |
||||
|
|
||||
|
@Value("${transport.http.max_payload_size:/api/v1/*/rpc/**=65536;/api/v1/**=52428800}") |
||||
|
private String maxPayloadSizeConfig; |
||||
|
|
||||
|
@Bean |
||||
|
protected PayloadSizeFilter transportPayloadSizeFilter() { |
||||
|
return new PayloadSizeFilter(maxPayloadSizeConfig); |
||||
|
} |
||||
|
|
||||
|
@Bean |
||||
|
@Order(1) |
||||
|
SecurityFilterChain httpTransportFilterChain(HttpSecurity http) throws Exception { |
||||
|
http |
||||
|
.securityMatcher(AntPathRequestMatcher.antMatcher(DEVICE_API_ENTRY_POINT)) |
||||
|
.cors(cors -> { |
||||
|
}) |
||||
|
.csrf(AbstractHttpConfigurer::disable) |
||||
|
.authorizeHttpRequests(config -> config |
||||
|
.requestMatchers(DEVICE_API_ENTRY_POINT).permitAll()) |
||||
|
.addFilterBefore(transportPayloadSizeFilter(), UsernamePasswordAuthenticationFilter.class); |
||||
|
return http.build(); |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue