Viacheslav Klimov
5 months ago
committed by
GitHub
GitHub
122 changed files with 21466 additions and 9222 deletions
File diff suppressed because one or more lines are too long
@ -0,0 +1,64 @@ |
|||
/** |
|||
* Copyright © 2016-2026 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.config; |
|||
|
|||
import lombok.RequiredArgsConstructor; |
|||
import lombok.extern.slf4j.Slf4j; |
|||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer; |
|||
import org.springframework.security.web.header.writers.StaticHeadersWriter; |
|||
import org.springframework.stereotype.Component; |
|||
import org.springframework.util.StringUtils; |
|||
|
|||
@Slf4j |
|||
@Component |
|||
@RequiredArgsConstructor |
|||
public class HttpSecurityHeadersCustomizer { |
|||
|
|||
private final HttpSecurityHeadersProperties properties; |
|||
|
|||
public void customize(HeadersConfigurer<?> headers) { |
|||
if (properties.getXContentTypeOptions().isEnabled()) { |
|||
headers.contentTypeOptions(config -> {}); |
|||
} |
|||
|
|||
if (properties.getReferrerPolicy().isEnabled()) { |
|||
headers.addHeaderWriter(new StaticHeadersWriter("Referrer-Policy", properties.getReferrerPolicy().getValue())); |
|||
} |
|||
|
|||
if (properties.getXFrameOptions().isEnabled()) { |
|||
String value = properties.getXFrameOptions().getValue(); |
|||
if ("DENY".equalsIgnoreCase(value)) { |
|||
headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::deny); |
|||
} else { |
|||
if (!"SAMEORIGIN".equalsIgnoreCase(value)) { |
|||
log.warn("Unrecognized X-Frame-Options value '{}', falling back to SAMEORIGIN. Valid values: DENY, SAMEORIGIN", value); |
|||
} |
|||
headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin); |
|||
} |
|||
} |
|||
|
|||
if (properties.getContentSecurityPolicy().isEnabled() && StringUtils.hasText(properties.getContentSecurityPolicy().getValue())) { |
|||
headers.contentSecurityPolicy(csp -> { |
|||
csp.policyDirectives(properties.getContentSecurityPolicy().getValue()); |
|||
if (properties.getContentSecurityPolicy().isReportOnly()) { |
|||
csp.reportOnly(); |
|||
} |
|||
}); |
|||
} |
|||
|
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,56 @@ |
|||
/** |
|||
* Copyright © 2016-2026 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.config; |
|||
|
|||
import lombok.Data; |
|||
import org.springframework.boot.context.properties.ConfigurationProperties; |
|||
import org.springframework.stereotype.Component; |
|||
|
|||
@Component |
|||
@ConfigurationProperties(prefix = "security.headers") |
|||
@Data |
|||
public class HttpSecurityHeadersProperties { |
|||
|
|||
private XContentTypeOptions xContentTypeOptions = new XContentTypeOptions(); |
|||
private ReferrerPolicy referrerPolicy = new ReferrerPolicy(); |
|||
private XFrameOptions xFrameOptions = new XFrameOptions(); |
|||
private ContentSecurityPolicy contentSecurityPolicy = new ContentSecurityPolicy(); |
|||
|
|||
@Data |
|||
public static class XContentTypeOptions { |
|||
private boolean enabled = true; |
|||
} |
|||
|
|||
@Data |
|||
public static class ReferrerPolicy { |
|||
private boolean enabled = true; |
|||
private String value = "strict-origin-when-cross-origin"; |
|||
} |
|||
|
|||
@Data |
|||
public static class XFrameOptions { |
|||
private boolean enabled = false; |
|||
private String value = "SAMEORIGIN"; |
|||
} |
|||
|
|||
@Data |
|||
public static class ContentSecurityPolicy { |
|||
private boolean enabled = false; |
|||
private String value = ""; |
|||
private boolean reportOnly = false; |
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,52 @@ |
|||
/** |
|||
* Copyright © 2016-2026 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.common.data.sync.ie; |
|||
|
|||
import com.fasterxml.jackson.annotation.JsonSubTypes; |
|||
import org.junit.jupiter.api.Test; |
|||
import org.thingsboard.server.common.data.EntityType; |
|||
|
|||
import java.util.Arrays; |
|||
import java.util.Set; |
|||
import java.util.stream.Collectors; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
|
|||
public class EntityExportDataTest { |
|||
|
|||
@Test |
|||
public void newInstance_shouldSupportAllJsonSubTypes() { |
|||
JsonSubTypes subTypes = EntityExportData.class.getAnnotation(JsonSubTypes.class); |
|||
assertThat(subTypes).as("EntityExportData must have @JsonSubTypes annotation").isNotNull(); |
|||
|
|||
Set<String> jsonSubTypeNames = Arrays.stream(subTypes.value()) |
|||
.map(JsonSubTypes.Type::name) |
|||
.collect(Collectors.toSet()); |
|||
|
|||
for (String typeName : jsonSubTypeNames) { |
|||
EntityType entityType = EntityType.valueOf(typeName); |
|||
EntityExportData<?> instance = EntityExportData.newInstance(entityType); |
|||
|
|||
assertThat(instance) |
|||
.as("newInstance(%s) should not return null", typeName) |
|||
.isNotNull(); |
|||
assertThat(instance.getEntityType()) |
|||
.as("newInstance(%s).getEntityType() should return %s", typeName, entityType) |
|||
.isEqualTo(entityType); |
|||
} |
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,174 @@ |
|||
/** |
|||
* Copyright © 2016-2026 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.rule.engine.rest; |
|||
|
|||
import io.netty.resolver.AddressResolver; |
|||
import io.netty.resolver.AddressResolverGroup; |
|||
import io.netty.resolver.DefaultAddressResolverGroup; |
|||
import io.netty.util.concurrent.EventExecutor; |
|||
import io.netty.util.concurrent.Future; |
|||
import io.netty.util.concurrent.Promise; |
|||
import org.thingsboard.common.util.SsrfProtectionValidator; |
|||
|
|||
import java.net.InetAddress; |
|||
import java.net.InetSocketAddress; |
|||
import java.net.SocketAddress; |
|||
import java.util.ArrayList; |
|||
import java.util.HashSet; |
|||
import java.util.List; |
|||
import java.util.Set; |
|||
|
|||
/** |
|||
* Custom Netty {@link AddressResolverGroup} that validates every resolved IP address |
|||
* against the SSRF block-list at connection time. This eliminates the DNS rebinding |
|||
* TOCTOU gap where a hostname resolves to a safe IP during validation but to a |
|||
* private/metadata IP when the actual connection is made. |
|||
* <p> |
|||
* Only wired into {@link TbHttpClient} when SSRF protection is enabled. |
|||
*/ |
|||
public final class SsrfSafeAddressResolverGroup extends AddressResolverGroup<InetSocketAddress> { |
|||
|
|||
public static final SsrfSafeAddressResolverGroup INSTANCE = new SsrfSafeAddressResolverGroup(); |
|||
|
|||
private SsrfSafeAddressResolverGroup() { |
|||
} |
|||
|
|||
@Override |
|||
protected AddressResolver<InetSocketAddress> newResolver(EventExecutor executor) throws Exception { |
|||
AddressResolver<InetSocketAddress> delegate = DefaultAddressResolverGroup.INSTANCE.getResolver(executor); |
|||
return new SsrfValidatingResolver(executor, delegate); |
|||
} |
|||
|
|||
private static final class SsrfValidatingResolver implements AddressResolver<InetSocketAddress> { |
|||
|
|||
private final EventExecutor executor; |
|||
private final AddressResolver<InetSocketAddress> delegate; |
|||
|
|||
SsrfValidatingResolver(EventExecutor executor, AddressResolver<InetSocketAddress> delegate) { |
|||
this.executor = executor; |
|||
this.delegate = delegate; |
|||
} |
|||
|
|||
@Override |
|||
public boolean isSupported(SocketAddress address) { |
|||
return delegate.isSupported(address); |
|||
} |
|||
|
|||
@Override |
|||
public boolean isResolved(SocketAddress address) { |
|||
return delegate.isResolved(address); |
|||
} |
|||
|
|||
@Override |
|||
public Future<InetSocketAddress> resolve(SocketAddress address) { |
|||
return resolve(address, executor.newPromise()); |
|||
} |
|||
|
|||
@Override |
|||
public Future<InetSocketAddress> resolve(SocketAddress address, Promise<InetSocketAddress> promise) { |
|||
delegate.resolve(address).addListener((Future<InetSocketAddress> future) -> { |
|||
try { |
|||
if (!future.isSuccess()) { |
|||
promise.tryFailure(future.cause()); |
|||
return; |
|||
} |
|||
InetSocketAddress resolved = future.getNow(); |
|||
if (isOriginalHostAllowed(address)) { |
|||
promise.trySuccess(resolved); |
|||
} else if (isBlocked(resolved)) { |
|||
promise.tryFailure(new RuntimeException( |
|||
"URI is invalid: host '" + getHostString(address) + "' is not allowed")); |
|||
} else { |
|||
promise.trySuccess(resolved); |
|||
} |
|||
} catch (Exception e) { |
|||
promise.tryFailure(e); |
|||
} |
|||
}); |
|||
return promise; |
|||
} |
|||
|
|||
@Override |
|||
public Future<List<InetSocketAddress>> resolveAll(SocketAddress address) { |
|||
return resolveAll(address, executor.newPromise()); |
|||
} |
|||
|
|||
@Override |
|||
public Future<List<InetSocketAddress>> resolveAll(SocketAddress address, Promise<List<InetSocketAddress>> promise) { |
|||
delegate.resolveAll(address).addListener((Future<List<InetSocketAddress>> future) -> { |
|||
try { |
|||
if (!future.isSuccess()) { |
|||
promise.tryFailure(future.cause()); |
|||
return; |
|||
} |
|||
List<InetSocketAddress> resolved = future.getNow(); |
|||
if (isOriginalHostAllowed(address)) { |
|||
promise.trySuccess(resolved); |
|||
return; |
|||
} |
|||
Set<InetSocketAddress> blocked = null; |
|||
for (InetSocketAddress addr : resolved) { |
|||
if (isBlocked(addr)) { |
|||
if (blocked == null) { |
|||
blocked = new HashSet<>(2); |
|||
} |
|||
blocked.add(addr); |
|||
} |
|||
} |
|||
if (blocked == null) { |
|||
promise.trySuccess(resolved); |
|||
} else if (blocked.size() == resolved.size()) { |
|||
promise.tryFailure(new RuntimeException( |
|||
"URI is invalid: host '" + getHostString(address) + "' is not allowed")); |
|||
} else { |
|||
List<InetSocketAddress> safe = new ArrayList<>(resolved.size() - blocked.size()); |
|||
for (InetSocketAddress addr : resolved) { |
|||
if (!blocked.contains(addr)) { |
|||
safe.add(addr); |
|||
} |
|||
} |
|||
promise.trySuccess(safe); |
|||
} |
|||
} catch (Exception e) { |
|||
promise.tryFailure(e); |
|||
} |
|||
}); |
|||
return promise; |
|||
} |
|||
|
|||
@Override |
|||
public void close() { |
|||
delegate.close(); |
|||
} |
|||
|
|||
private static boolean isBlocked(InetSocketAddress socketAddress) { |
|||
InetAddress addr = socketAddress.getAddress(); |
|||
return addr != null && SsrfProtectionValidator.isBlockedAddress(addr); |
|||
} |
|||
|
|||
private static boolean isOriginalHostAllowed(SocketAddress address) { |
|||
if (address instanceof InetSocketAddress isa) { |
|||
String host = isa.getHostString(); |
|||
return host != null && SsrfProtectionValidator.isHostnameAllowed(host); |
|||
} |
|||
return false; |
|||
} |
|||
|
|||
private static String getHostString(SocketAddress address) { |
|||
return address instanceof InetSocketAddress isa ? isa.getHostString() : address.toString(); |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,161 @@ |
|||
/** |
|||
* Copyright © 2016-2026 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.rule.engine.rest; |
|||
|
|||
import io.netty.channel.nio.NioEventLoopGroup; |
|||
import io.netty.resolver.AddressResolver; |
|||
import io.netty.util.concurrent.EventExecutor; |
|||
import io.netty.util.concurrent.Promise; |
|||
import org.junit.jupiter.api.AfterAll; |
|||
import org.junit.jupiter.api.AfterEach; |
|||
import org.junit.jupiter.api.BeforeAll; |
|||
import org.junit.jupiter.api.BeforeEach; |
|||
import org.junit.jupiter.api.Test; |
|||
import org.junit.jupiter.api.parallel.ResourceLock; |
|||
import org.thingsboard.common.util.SsrfProtectionValidator; |
|||
|
|||
import java.net.InetAddress; |
|||
import java.net.InetSocketAddress; |
|||
import java.util.Collections; |
|||
import java.util.List; |
|||
import java.util.concurrent.ExecutionException; |
|||
import java.util.concurrent.TimeUnit; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
import static org.assertj.core.api.Assertions.assertThatThrownBy; |
|||
|
|||
@ResourceLock("SsrfSafeAddressResolverGroupTest") |
|||
class SsrfSafeAddressResolverGroupTest { |
|||
|
|||
private static NioEventLoopGroup eventLoopGroup; |
|||
|
|||
@BeforeAll |
|||
static void setUp() { |
|||
eventLoopGroup = new NioEventLoopGroup(1); |
|||
} |
|||
|
|||
@AfterAll |
|||
static void tearDown() { |
|||
eventLoopGroup.shutdownGracefully(0, 5, TimeUnit.SECONDS); |
|||
SsrfProtectionValidator.setEnabled(false); |
|||
SsrfProtectionValidator.setAllowedHosts(Collections.emptyList()); |
|||
} |
|||
|
|||
@BeforeEach |
|||
void enableSsrf() { |
|||
SsrfProtectionValidator.setEnabled(true); |
|||
SsrfProtectionValidator.setAllowedHosts(Collections.emptyList()); |
|||
} |
|||
|
|||
@AfterEach |
|||
void resetState() { |
|||
SsrfProtectionValidator.setAllowedHosts(Collections.emptyList()); |
|||
SsrfProtectionValidator.setEnabled(false); |
|||
} |
|||
|
|||
@Test |
|||
void isBlockedAddressWorksForLoopback() throws Exception { |
|||
assertThat(SsrfProtectionValidator.isBlockedAddress(InetAddress.getByName("127.0.0.1"))).isTrue(); |
|||
assertThat(SsrfProtectionValidator.isBlockedAddress(InetAddress.getByName("192.168.1.1"))).isTrue(); |
|||
assertThat(SsrfProtectionValidator.isBlockedAddress(InetAddress.getByName("8.8.8.8"))).isFalse(); |
|||
} |
|||
|
|||
@Test |
|||
void resolvePublicIpSucceeds() throws Exception { |
|||
EventExecutor executor = eventLoopGroup.next(); |
|||
AddressResolver<InetSocketAddress> resolver = SsrfSafeAddressResolverGroup.INSTANCE.getResolver(executor); |
|||
Promise<InetSocketAddress> promise = executor.newPromise(); |
|||
|
|||
executor.submit(() -> resolver.resolve(InetSocketAddress.createUnresolved("8.8.8.8", 80), promise)); |
|||
InetSocketAddress result = promise.get(10, TimeUnit.SECONDS); |
|||
|
|||
assertThat(result.getAddress()).isNotNull(); |
|||
assertThat(result.getAddress().getHostAddress()).isEqualTo("8.8.8.8"); |
|||
} |
|||
|
|||
@Test |
|||
void resolveLoopbackFailsWhenSsrfEnabled() throws Exception { |
|||
assertThat(SsrfProtectionValidator.isEnabled()).isTrue(); |
|||
|
|||
EventExecutor executor = eventLoopGroup.next(); |
|||
AddressResolver<InetSocketAddress> resolver = SsrfSafeAddressResolverGroup.INSTANCE.getResolver(executor); |
|||
Promise<InetSocketAddress> promise = executor.newPromise(); |
|||
|
|||
executor.submit(() -> resolver.resolve(InetSocketAddress.createUnresolved("127.0.0.1", 80), promise)); |
|||
|
|||
assertThatThrownBy(() -> promise.get(10, TimeUnit.SECONDS)) |
|||
.isInstanceOf(ExecutionException.class) |
|||
.hasRootCauseInstanceOf(RuntimeException.class) |
|||
.rootCause().hasMessageContaining("is not allowed"); |
|||
} |
|||
|
|||
@Test |
|||
void resolvePrivateIpFailsWhenSsrfEnabled() throws Exception { |
|||
assertThat(SsrfProtectionValidator.isEnabled()).isTrue(); |
|||
|
|||
EventExecutor executor = eventLoopGroup.next(); |
|||
AddressResolver<InetSocketAddress> resolver = SsrfSafeAddressResolverGroup.INSTANCE.getResolver(executor); |
|||
Promise<InetSocketAddress> promise = executor.newPromise(); |
|||
|
|||
executor.submit(() -> resolver.resolve(InetSocketAddress.createUnresolved("192.168.1.1", 80), promise)); |
|||
|
|||
assertThatThrownBy(() -> promise.get(10, TimeUnit.SECONDS)) |
|||
.isInstanceOf(ExecutionException.class) |
|||
.hasRootCauseInstanceOf(RuntimeException.class) |
|||
.rootCause().hasMessageContaining("is not allowed"); |
|||
} |
|||
|
|||
@Test |
|||
void resolveAllowedPrivateIpSucceeds() throws Exception { |
|||
SsrfProtectionValidator.setAllowedHosts(List.of("192.168.1.0/24")); |
|||
|
|||
EventExecutor executor = eventLoopGroup.next(); |
|||
AddressResolver<InetSocketAddress> resolver = SsrfSafeAddressResolverGroup.INSTANCE.getResolver(executor); |
|||
Promise<InetSocketAddress> promise = executor.newPromise(); |
|||
|
|||
executor.submit(() -> resolver.resolve(InetSocketAddress.createUnresolved("192.168.1.1", 80), promise)); |
|||
InetSocketAddress result = promise.get(10, TimeUnit.SECONDS); |
|||
|
|||
assertThat(result.getAddress().getHostAddress()).isEqualTo("192.168.1.1"); |
|||
} |
|||
|
|||
@Test |
|||
void resolveAllPublicIpSucceeds() throws Exception { |
|||
EventExecutor executor = eventLoopGroup.next(); |
|||
AddressResolver<InetSocketAddress> resolver = SsrfSafeAddressResolverGroup.INSTANCE.getResolver(executor); |
|||
Promise<List<InetSocketAddress>> promise = executor.newPromise(); |
|||
|
|||
executor.submit(() -> resolver.resolveAll(InetSocketAddress.createUnresolved("8.8.8.8", 80), promise)); |
|||
List<InetSocketAddress> results = promise.get(10, TimeUnit.SECONDS); |
|||
|
|||
assertThat(results).isNotEmpty(); |
|||
assertThat(results.get(0).getAddress().getHostAddress()).isEqualTo("8.8.8.8"); |
|||
} |
|||
|
|||
@Test |
|||
void resolveAllPrivateIpFailsWhenSsrfEnabled() { |
|||
assertThatThrownBy(() -> { |
|||
EventExecutor executor = eventLoopGroup.next(); |
|||
AddressResolver<InetSocketAddress> resolver = SsrfSafeAddressResolverGroup.INSTANCE.getResolver(executor); |
|||
Promise<List<InetSocketAddress>> promise = executor.newPromise(); |
|||
executor.submit(() -> resolver.resolveAll(InetSocketAddress.createUnresolved("127.0.0.1", 80), promise)); |
|||
promise.get(10, TimeUnit.SECONDS); |
|||
}).isInstanceOf(ExecutionException.class) |
|||
.hasRootCauseInstanceOf(RuntimeException.class) |
|||
.rootCause().hasMessageContaining("is not allowed"); |
|||
} |
|||
|
|||
} |
|||
Some files were not shown because too many files changed in this diff
Loading…
Reference in new issue