Browse Source

Fix XSS policy file loading

pull/4414/head
Viacheslav Klimov 5 years ago
committed by Andrew Shvayka
parent
commit
d4718ae354
  1. 18
      dao/src/main/java/org/thingsboard/server/dao/service/NoXssValidator.java

18
dao/src/main/java/org/thingsboard/server/dao/service/NoXssValidator.java

@ -15,7 +15,6 @@
*/ */
package org.thingsboard.server.dao.service; package org.thingsboard.server.dao.service;
import com.google.common.io.Resources;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.owasp.validator.html.AntiSamy; import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.Policy; import org.owasp.validator.html.Policy;
@ -25,6 +24,7 @@ import org.thingsboard.server.common.data.validation.NoXss;
import javax.validation.ConstraintValidator; import javax.validation.ConstraintValidator;
import javax.validation.ConstraintValidatorContext; import javax.validation.ConstraintValidatorContext;
import java.util.Optional;
@Slf4j @Slf4j
public class NoXssValidator implements ConstraintValidator<NoXss, Object> { public class NoXssValidator implements ConstraintValidator<NoXss, Object> {
@ -34,17 +34,21 @@ public class NoXssValidator implements ConstraintValidator<NoXss, Object> {
@Override @Override
public void initialize(NoXss constraintAnnotation) { public void initialize(NoXss constraintAnnotation) {
if (xssPolicy == null) { if (xssPolicy == null) {
try { xssPolicy = Optional.ofNullable(getClass().getClassLoader().getResourceAsStream("xss-policy.xml"))
xssPolicy = Policy.getInstance(Resources.getResource("xss-policy.xml")); .map(inputStream -> {
} catch (Exception e) { try {
log.error("Failed to set xss policy: {}", e.getMessage()); return Policy.getInstance(inputStream);
} } catch (Exception e) {
throw new RuntimeException(e);
}
})
.orElseThrow(() -> new IllegalStateException("XSS policy file not found"));
} }
} }
@Override @Override
public boolean isValid(Object value, ConstraintValidatorContext constraintValidatorContext) { public boolean isValid(Object value, ConstraintValidatorContext constraintValidatorContext) {
if (!(value instanceof String) || ((String) value).isEmpty() || xssPolicy == null) { if (!(value instanceof String) || ((String) value).isEmpty()) {
return true; return true;
} }

Loading…
Cancel
Save