Artem Dzhereleiko
3 years ago
124 changed files with 2080 additions and 547 deletions
@ -0,0 +1,23 @@ |
|||
-- |
|||
-- Copyright © 2016-2023 The Thingsboard Authors |
|||
-- |
|||
-- Licensed under the Apache License, Version 2.0 (the "License"); |
|||
-- you may not use this file except in compliance with the License. |
|||
-- You may obtain a copy of the License at |
|||
-- |
|||
-- http://www.apache.org/licenses/LICENSE-2.0 |
|||
-- |
|||
-- Unless required by applicable law or agreed to in writing, software |
|||
-- distributed under the License is distributed on an "AS IS" BASIS, |
|||
-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
-- See the License for the specific language governing permissions and |
|||
-- limitations under the License. |
|||
-- |
|||
|
|||
-- FIX DASHBOARD TEMPLATES AFTER ANGULAR MIGRATION TO VER.15 |
|||
|
|||
UPDATE dashboard SET configuration = REPLACE(configuration, 'mat-button mat-icon-button', 'mat-icon-button') |
|||
WHERE configuration like '%mat-button mat-icon-button%'; |
|||
|
|||
UPDATE widget_type SET descriptor = REPLACE(descriptor, 'mat-button mat-icon-button', 'mat-icon-button') |
|||
WHERE descriptor like '%mat-button mat-icon-button%'; |
|||
@ -0,0 +1,66 @@ |
|||
/** |
|||
* Copyright © 2016-2023 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.security.auth.oauth2; |
|||
|
|||
import org.junit.Before; |
|||
import org.junit.Test; |
|||
import org.mockito.Mockito; |
|||
|
|||
import javax.servlet.http.Cookie; |
|||
import javax.servlet.http.HttpServletRequest; |
|||
import java.io.IOException; |
|||
import java.io.ObjectInputStream; |
|||
import java.io.Serializable; |
|||
|
|||
import static org.junit.Assert.assertEquals; |
|||
import static org.thingsboard.server.service.security.auth.oauth2.HttpCookieOAuth2AuthorizationRequestRepository.OAUTH2_AUTHORIZATION_REQUEST_COOKIE_NAME; |
|||
|
|||
public class HttpCookieOAuth2AuthorizationRequestRepositoryTest { |
|||
|
|||
private static final String SERIALIZED_ATTACK_STRING = |
|||
"rO0ABXNyAHVvcmcudGhpbmdzYm9hcmQuc2VydmVyLnNlcnZpY2Uuc2VjdXJpdHkuYXV0aC5vYXV0aDIuSHR0cENvb2tpZU9BdXRoMkF1dGhvcml6YXRpb25SZXF1ZXN0UmVwb3NpdG9yeVRlc3QkTWFsaWNpb3VzQ2xhc3MAAAAAAAAAAAIAAHhw"; |
|||
|
|||
private static int maliciousMethodInvocationCounter; |
|||
|
|||
@Before |
|||
public void resetInvocationCounter() { |
|||
maliciousMethodInvocationCounter = 0; |
|||
} |
|||
|
|||
@Test |
|||
public void whenLoadAuthorizationRequest_thenMaliciousMethodNotInvoked() { |
|||
HttpCookieOAuth2AuthorizationRequestRepository cookieRequestRepo = new HttpCookieOAuth2AuthorizationRequestRepository(); |
|||
HttpServletRequest request = Mockito.mock(HttpServletRequest.class); |
|||
Cookie cookie = new Cookie(OAUTH2_AUTHORIZATION_REQUEST_COOKIE_NAME, SERIALIZED_ATTACK_STRING); |
|||
Mockito.when(request.getCookies()).thenReturn(new Cookie[]{cookie}); |
|||
|
|||
cookieRequestRepo.loadAuthorizationRequest(request); |
|||
|
|||
assertEquals(0, maliciousMethodInvocationCounter); |
|||
} |
|||
|
|||
private static class MaliciousClass implements Serializable { |
|||
private static final long serialVersionUID = 0L; |
|||
|
|||
public void maliciousMethod() { |
|||
maliciousMethodInvocationCounter++; |
|||
} |
|||
|
|||
private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException { |
|||
maliciousMethod(); |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,272 @@ |
|||
/** |
|||
* Copyright © 2016-2023 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.common.data.util; |
|||
|
|||
import lombok.extern.slf4j.Slf4j; |
|||
import org.eclipse.leshan.core.LwM2m; |
|||
import org.eclipse.leshan.core.model.DDFFileValidator; |
|||
import org.eclipse.leshan.core.model.DefaultDDFFileValidator; |
|||
import org.eclipse.leshan.core.model.InvalidDDFFileException; |
|||
import org.eclipse.leshan.core.model.ObjectModel; |
|||
import org.eclipse.leshan.core.model.ResourceModel; |
|||
import org.eclipse.leshan.core.util.StringUtils; |
|||
import org.w3c.dom.DOMException; |
|||
import org.w3c.dom.Document; |
|||
import org.w3c.dom.Node; |
|||
import org.w3c.dom.NodeList; |
|||
import org.xml.sax.SAXException; |
|||
|
|||
import javax.xml.parsers.DocumentBuilder; |
|||
import javax.xml.parsers.DocumentBuilderFactory; |
|||
import javax.xml.parsers.ParserConfigurationException; |
|||
import java.io.IOException; |
|||
import java.io.InputStream; |
|||
import java.util.ArrayList; |
|||
import java.util.HashMap; |
|||
import java.util.List; |
|||
import java.util.Map; |
|||
|
|||
@Slf4j |
|||
public class TbDDFFileParser { |
|||
private static final DDFFileValidator ddfFileValidator = new DefaultDDFFileValidator(); |
|||
|
|||
public List<ObjectModel> parse(InputStream inputStream, String streamName) |
|||
throws InvalidDDFFileException, IOException { |
|||
streamName = streamName == null ? "" : streamName; |
|||
|
|||
log.debug("Parsing DDF file {}", streamName); |
|||
|
|||
try { |
|||
// Parse XML file
|
|||
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); |
|||
factory.setNamespaceAware(true); |
|||
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); |
|||
|
|||
DocumentBuilder builder = factory.newDocumentBuilder(); |
|||
Document document = builder.parse(inputStream); |
|||
|
|||
// Get DDF file validator
|
|||
LwM2m.LwM2mVersion lwm2mVersion = null; |
|||
ddfFileValidator.validate(document); |
|||
|
|||
// Build list of ObjectModel
|
|||
ArrayList<ObjectModel> objects = new ArrayList<>(); |
|||
NodeList nodeList = document.getDocumentElement().getElementsByTagName("Object"); |
|||
for (int i = 0; i < nodeList.getLength(); i++) { |
|||
objects.add(parseObject(nodeList.item(i), streamName, lwm2mVersion, true)); |
|||
} |
|||
return objects; |
|||
} catch (InvalidDDFFileException | SAXException e) { |
|||
throw new InvalidDDFFileException(e, "Invalid DDF file %s", streamName); |
|||
} |
|||
catch (ParserConfigurationException e) { |
|||
throw new IllegalStateException("Unable to create Document Builder", e); |
|||
} |
|||
} |
|||
|
|||
private ObjectModel parseObject(Node object, String streamName, LwM2m.LwM2mVersion schemaVersion, boolean validate) |
|||
throws InvalidDDFFileException { |
|||
|
|||
Node objectType = object.getAttributes().getNamedItem("ObjectType"); |
|||
if (validate && (objectType == null || !"MODefinition".equals(objectType.getTextContent()))) { |
|||
throw new InvalidDDFFileException( |
|||
"Object element in %s MUST have a ObjectType attribute equals to 'MODefinition'.", streamName); |
|||
} |
|||
|
|||
Integer id = null; |
|||
String name = null; |
|||
String description = null; |
|||
String version = ObjectModel.DEFAULT_VERSION; |
|||
Boolean multiple = null; |
|||
Boolean mandatory = null; |
|||
Map<Integer, ResourceModel> resources = new HashMap<>(); |
|||
String urn = null; |
|||
String description2 = null; |
|||
String lwm2mVersion = ObjectModel.DEFAULT_VERSION; |
|||
|
|||
for (int i = 0; i < object.getChildNodes().getLength(); i++) { |
|||
Node field = object.getChildNodes().item(i); |
|||
if (field.getNodeType() != Node.ELEMENT_NODE) |
|||
continue; |
|||
|
|||
switch (field.getNodeName()) { |
|||
case "ObjectID": |
|||
id = Integer.valueOf(field.getTextContent()); |
|||
break; |
|||
case "Name": |
|||
name = field.getTextContent(); |
|||
break; |
|||
case "Description1": |
|||
description = field.getTextContent(); |
|||
break; |
|||
case "ObjectVersion": |
|||
if (!StringUtils.isEmpty(field.getTextContent())) { |
|||
version = field.getTextContent(); |
|||
} |
|||
break; |
|||
case "MultipleInstances": |
|||
if ("Multiple".equals(field.getTextContent())) { |
|||
multiple = true; |
|||
} else if ("Single".equals(field.getTextContent())) { |
|||
multiple = false; |
|||
} |
|||
break; |
|||
case "Mandatory": |
|||
if ("Mandatory".equals(field.getTextContent())) { |
|||
mandatory = true; |
|||
} else if ("Optional".equals(field.getTextContent())) { |
|||
mandatory = false; |
|||
} |
|||
break; |
|||
case "Resources": |
|||
for (int j = 0; j < field.getChildNodes().getLength(); j++) { |
|||
Node item = field.getChildNodes().item(j); |
|||
if (item.getNodeType() != Node.ELEMENT_NODE) |
|||
continue; |
|||
|
|||
if (item.getNodeName().equals("Item")) { |
|||
ResourceModel resource = parseResource(item, streamName); |
|||
if (validate && resources.containsKey(resource.id)) { |
|||
throw new InvalidDDFFileException( |
|||
"Object %s in %s contains at least 2 resources with same id %s.", |
|||
id != null ? id : "", streamName, resource.id); |
|||
} else { |
|||
resources.put(resource.id, resource); |
|||
} |
|||
} |
|||
} |
|||
break; |
|||
case "ObjectURN": |
|||
urn = field.getTextContent(); |
|||
break; |
|||
case "LWM2MVersion": |
|||
if (!StringUtils.isEmpty(field.getTextContent())) { |
|||
lwm2mVersion = field.getTextContent(); |
|||
if (schemaVersion != null && !schemaVersion.toString().equals(lwm2mVersion)) { |
|||
throw new InvalidDDFFileException( |
|||
"LWM2MVersion is not consistent with xml shema(xsi:noNamespaceSchemaLocation) in %s : %s expected but was %s.", |
|||
streamName, schemaVersion, lwm2mVersion); |
|||
} |
|||
} |
|||
break; |
|||
case "Description2": |
|||
description2 = field.getTextContent(); |
|||
break; |
|||
default: |
|||
break; |
|||
} |
|||
} |
|||
|
|||
return new ObjectModel(id, name, description, version, multiple, mandatory, resources.values(), urn, |
|||
lwm2mVersion, description2); |
|||
|
|||
} |
|||
|
|||
private ResourceModel parseResource(Node item, String streamName) throws DOMException, InvalidDDFFileException { |
|||
|
|||
Integer id = Integer.valueOf(item.getAttributes().getNamedItem("ID").getTextContent()); |
|||
String name = null; |
|||
ResourceModel.Operations operations = null; |
|||
Boolean multiple = false; |
|||
Boolean mandatory = false; |
|||
ResourceModel.Type type = null; |
|||
String rangeEnumeration = null; |
|||
String units = null; |
|||
String description = null; |
|||
|
|||
for (int i = 0; i < item.getChildNodes().getLength(); i++) { |
|||
Node field = item.getChildNodes().item(i); |
|||
if (field.getNodeType() != Node.ELEMENT_NODE) |
|||
continue; |
|||
|
|||
switch (field.getNodeName()) { |
|||
case "Name": |
|||
name = field.getTextContent(); |
|||
break; |
|||
case "Operations": |
|||
String strOp = field.getTextContent(); |
|||
if (strOp != null && !strOp.isEmpty()) { |
|||
operations = ResourceModel.Operations.valueOf(strOp); |
|||
} else { |
|||
operations = ResourceModel.Operations.NONE; |
|||
} |
|||
break; |
|||
case "MultipleInstances": |
|||
if ("Multiple".equals(field.getTextContent())) { |
|||
multiple = true; |
|||
} else if ("Single".equals(field.getTextContent())) { |
|||
multiple = false; |
|||
} |
|||
break; |
|||
case "Mandatory": |
|||
if ("Mandatory".equals(field.getTextContent())) { |
|||
mandatory = true; |
|||
} else if ("Optional".equals(field.getTextContent())) { |
|||
mandatory = false; |
|||
} |
|||
break; |
|||
case "Type": |
|||
switch (field.getTextContent()) { |
|||
case "String": |
|||
type = ResourceModel.Type.STRING; |
|||
break; |
|||
case "Integer": |
|||
type = ResourceModel.Type.INTEGER; |
|||
break; |
|||
case "Float": |
|||
type = ResourceModel.Type.FLOAT; |
|||
break; |
|||
case "Boolean": |
|||
type = ResourceModel.Type.BOOLEAN; |
|||
break; |
|||
case "Opaque": |
|||
type = ResourceModel.Type.OPAQUE; |
|||
break; |
|||
case "Time": |
|||
type = ResourceModel.Type.TIME; |
|||
break; |
|||
case "Objlnk": |
|||
type = ResourceModel.Type.OBJLNK; |
|||
break; |
|||
case "Unsigned Integer": |
|||
type = ResourceModel.Type.UNSIGNED_INTEGER; |
|||
break; |
|||
case "Corelnk": |
|||
type = ResourceModel.Type.CORELINK; |
|||
break; |
|||
case "": |
|||
type = ResourceModel.Type.NONE; |
|||
break; |
|||
default: |
|||
break; |
|||
} |
|||
break; |
|||
case "RangeEnumeration": |
|||
rangeEnumeration = field.getTextContent(); |
|||
break; |
|||
case "Units": |
|||
units = field.getTextContent(); |
|||
break; |
|||
case "Description": |
|||
description = field.getTextContent(); |
|||
break; |
|||
default: |
|||
break; |
|||
} |
|||
} |
|||
return new ResourceModel(id, name, operations, multiple, mandatory, type, rangeEnumeration, units, description); |
|||
} |
|||
} |
|||
@ -0,0 +1,17 @@ |
|||
# Security Policy |
|||
|
|||
## Reporting a Vulnerability |
|||
|
|||
Security is of the highest importance and all security vulnerabilities or suspected security vulnerabilities should be reported to Thingsboard privately, |
|||
to minimize attacks against current users of Thingsboard before they are fixed. Vulnerabilities will be investigated and release as soon as possible. |
|||
|
|||
To report a vulnerability or a security-related issue, please email the private address security@thingsboard.io with the details of the vulnerability. |
|||
Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. |
|||
Do not report non-security-impacting bugs through this channel. Use GitHub issues instead. |
|||
|
|||
**Proposed Email Content** |
|||
Provide a descriptive subject line and in the body of the email include the following information: |
|||
|
|||
- Basic identity information, such as your name and your affiliation or company. |
|||
- Detailed steps to reproduce the vulnerability (log errors, screenshots are all helpful to us). |
|||
- Description of the effects of the vulnerability on Thingsboard. |
|||
@ -0,0 +1,20 @@ |
|||
diff --git a/node_modules/@angular/core/fesm2020/core.mjs b/node_modules/@angular/core/fesm2020/core.mjs
|
|||
index 3e93015..9efcb96 100755
|
|||
--- a/node_modules/@angular/core/fesm2020/core.mjs
|
|||
+++ b/node_modules/@angular/core/fesm2020/core.mjs
|
|||
@@ -11053,13 +11053,13 @@ function findDirectiveDefMatches(tView, tNode) {
|
|||
if (isNodeMatchingSelectorList(tNode, def.selectors, /* isProjectionMode */ false)) { |
|||
matches || (matches = []); |
|||
if (isComponentDef(def)) { |
|||
- if (ngDevMode) {
|
|||
+ // if (ngDevMode) {
|
|||
assertTNodeType(tNode, 2 /* TNodeType.Element */, `"${tNode.value}" tags cannot be used as component hosts. ` + |
|||
`Please use a different tag to activate the ${stringify(def.type)} component.`); |
|||
if (isComponentHost(tNode)) { |
|||
throwMultipleComponentError(tNode, matches.find(isComponentDef).type, def.type); |
|||
} |
|||
- }
|
|||
+ // }
|
|||
// Components are inserted at the front of the matches array so that their lifecycle |
|||
// hooks run before any directive lifecycle hooks. This appears to be for ViewEngine |
|||
// compatibility. This logic doesn't make sense with host directives, because it |
|||
Some files were not shown because too many files changed in this diff
Loading…
Reference in new issue