Skip to content
This repository was archived by the owner on Dec 19, 2023. It is now read-only.

Commit 11a80c1

Browse files
oliemansmoliemansm
committed
Fix some security hotspots
1 parent d96445b commit 11a80c1

File tree

7 files changed

+341
-328
lines changed

7 files changed

+341
-328
lines changed

‎altair-spring-boot-autoconfigure/src/main/java/graphql/kickstart/altair/boot/AltairController.java‎

Lines changed: 87 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@
1212
import javax.servlet.http.HttpServletRequest;
1313
import javax.servlet.http.HttpServletResponse;
1414
import org.apache.commons.lang3.StringUtils;
15-
import org.apache.commons.lang3.text.StrSubstitutor;
15+
import org.apache.commons.text.StringSubstitutor;
1616
import org.springframework.beans.factory.annotation.Autowired;
1717
import org.springframework.core.env.Environment;
1818
import org.springframework.core.io.ClassPathResource;
1919
import org.springframework.stereotype.Controller;
2020
import org.springframework.util.StreamUtils;
21+
import org.springframework.web.bind.annotation.GetMapping;
2122
import org.springframework.web.bind.annotation.PathVariable;
22-
import org.springframework.web.bind.annotation.RequestMapping;
2323
import org.springframework.web.bind.annotation.RequestParam;
2424

2525
/**
@@ -28,93 +28,99 @@
2828
@Controller
2929
public class AltairController {
3030

31-
private static final String CDN_UNPKG = "//unpkg.com/";
32-
private static final String ALTAIR = "altair-static";
31+
private static final String CDN_UNPKG = "//unpkg.com/";
32+
private static final String ALTAIR = "altair-static";
3333

34-
@Autowired
35-
private AltairProperties altairProperties;
34+
@Autowired
35+
private AltairProperties altairProperties;
3636

37-
@Autowired
38-
private Environment environment;
37+
@Autowired
38+
private Environment environment;
3939

40-
private String template;
41-
private String props;
42-
private String headers;
40+
private String template;
41+
private String props;
42+
private String headers;
4343

44-
@PostConstruct
45-
public void onceConstructed() throws IOException {
46-
loadTemplate();
47-
loadProps();
48-
loadHeaders();
49-
}
50-
51-
private void loadTemplate() throws IOException {
52-
try (InputStream inputStream = new ClassPathResource("altair.html").getInputStream()) {
53-
template = StreamUtils.copyToString(inputStream, Charset.defaultCharset());
54-
}
55-
}
56-
57-
private void loadProps() throws IOException {
58-
props = new PropsLoader(environment).load();
59-
}
60-
61-
private void loadHeaders() throws JsonProcessingException {
62-
PropertyGroupReader propertyReader = new PropertyGroupReader(environment, "graphiql.headers.");
63-
Properties headerProperties = propertyReader.load();
64-
this.headers = new ObjectMapper().writeValueAsString(headerProperties);
65-
}
44+
@PostConstruct
45+
public void onceConstructed() throws IOException {
46+
loadTemplate();
47+
loadProps();
48+
loadHeaders();
49+
}
6650

67-
@RequestMapping(value = "${altair.mapping:/altair}")
68-
public void altair(HttpServletRequest request, HttpServletResponse response, @PathVariable Map<String, String> params) throws IOException {
69-
response.setContentType("text/html; charset=UTF-8");
70-
71-
Map<String, String> replacements = getReplacements(
72-
constructGraphQlEndpoint(request, params),
73-
request.getContextPath() + altairProperties.getEndpoint().getSubscriptions()
74-
);
75-
76-
String populatedTemplate = StrSubstitutor.replace(template, replacements);
77-
response.getOutputStream().write(populatedTemplate.getBytes(Charset.defaultCharset()));
51+
private void loadTemplate() throws IOException {
52+
try (InputStream inputStream = new ClassPathResource("altair.html").getInputStream()) {
53+
template = StreamUtils.copyToString(inputStream, Charset.defaultCharset());
7854
}
79-
80-
private Map<String, String> getReplacements(String graphqlEndpoint, String subscriptionsEndpoint) {
81-
Map<String, String> replacements = new HashMap<>();
82-
replacements.put("graphqlEndpoint", graphqlEndpoint);
83-
replacements.put("subscriptionsEndpoint", subscriptionsEndpoint);
84-
replacements.put("pageTitle", altairProperties.getPageTitle());
85-
replacements.put("pageFavicon", getResourceUrl("favicon.ico", "favicon.ico"));
86-
replacements.put("altairBaseUrl", getResourceUrl(StringUtils.join(altairProperties.getSTATIC().getBasePath(), "/vendor/altair/"),
87-
joinJsUnpkgPath(ALTAIR, altairProperties.getCdn().getVersion(), "build/dist/")));
88-
replacements.put("altairLogoUrl", getResourceUrl("assets/img/logo_350.svg", "assets/img/logo_350.svg"));
89-
replacements.put("altairCssUrl", getResourceUrl("styles.css", "styles.css"));
90-
replacements.put("altairMainJsUrl", getResourceUrl("main.js", "main.js"));
91-
replacements.put("altairPolyfillsJsUrl", getResourceUrl("polyfills.js", "polyfills.js"));
92-
replacements.put("altairRuntimeJsUrl", getResourceUrl("runtime.js", "runtime.js"));
93-
replacements.put("props", props);
94-
replacements.put("headers", headers);
95-
return replacements;
55+
}
56+
57+
private void loadProps() throws IOException {
58+
props = new PropsLoader(environment).load();
59+
}
60+
61+
private void loadHeaders() throws JsonProcessingException {
62+
PropertyGroupReader propertyReader = new PropertyGroupReader(environment, "graphiql.headers.");
63+
Properties headerProperties = propertyReader.load();
64+
this.headers = new ObjectMapper().writeValueAsString(headerProperties);
65+
}
66+
67+
@GetMapping(value = "${altair.mapping:/altair}")
68+
public void altair(HttpServletRequest request, HttpServletResponse response,
69+
@PathVariable Map<String, String> params) throws IOException {
70+
response.setContentType("text/html; charset=UTF-8");
71+
72+
Map<String, String> replacements = getReplacements(
73+
constructGraphQlEndpoint(request, params),
74+
request.getContextPath() + altairProperties.getEndpoint().getSubscriptions()
75+
);
76+
77+
String populatedTemplate = StringSubstitutor.replace(template, replacements);
78+
response.getOutputStream().write(populatedTemplate.getBytes(Charset.defaultCharset()));
79+
}
80+
81+
private Map<String, String> getReplacements(String graphqlEndpoint,
82+
String subscriptionsEndpoint) {
83+
Map<String, String> replacements = new HashMap<>();
84+
replacements.put("graphqlEndpoint", graphqlEndpoint);
85+
replacements.put("subscriptionsEndpoint", subscriptionsEndpoint);
86+
replacements.put("pageTitle", altairProperties.getPageTitle());
87+
replacements.put("pageFavicon", getResourceUrl("favicon.ico", "favicon.ico"));
88+
replacements.put("altairBaseUrl", getResourceUrl(
89+
StringUtils.join(altairProperties.getSTATIC().getBasePath(), "/vendor/altair/"),
90+
joinJsUnpkgPath(ALTAIR, altairProperties.getCdn().getVersion(), "build/dist/")));
91+
replacements
92+
.put("altairLogoUrl", getResourceUrl("assets/img/logo_350.svg", "assets/img/logo_350.svg"));
93+
replacements.put("altairCssUrl", getResourceUrl("styles.css", "styles.css"));
94+
replacements.put("altairMainJsUrl", getResourceUrl("main.js", "main.js"));
95+
replacements.put("altairPolyfillsJsUrl", getResourceUrl("polyfills.js", "polyfills.js"));
96+
replacements.put("altairRuntimeJsUrl", getResourceUrl("runtime.js", "runtime.js"));
97+
replacements.put("props", props);
98+
replacements.put("headers", headers);
99+
return replacements;
100+
}
101+
102+
private String getResourceUrl(String staticFileName, String cdnUrl) {
103+
if (altairProperties.getCdn().isEnabled() && StringUtils.isNotBlank(cdnUrl)) {
104+
return cdnUrl;
96105
}
97-
98-
private String getResourceUrl(String staticFileName, String cdnUrl) {
99-
if (altairProperties.getCdn().isEnabled() && StringUtils.isNotBlank(cdnUrl)) {
100-
return cdnUrl;
101-
}
102-
return staticFileName;
106+
return staticFileName;
107+
}
108+
109+
private String joinJsUnpkgPath(String library, String cdnVersion, String cdnFileName) {
110+
return CDN_UNPKG + library + "@" + cdnVersion + "/" + cdnFileName;
111+
}
112+
113+
private String constructGraphQlEndpoint(HttpServletRequest request,
114+
@RequestParam Map<String, String> params) {
115+
String endpoint = altairProperties.getEndpoint().getGraphql();
116+
for (Map.Entry<String, String> param : params.entrySet()) {
117+
endpoint = endpoint.replaceAll("\\{" + param.getKey() + "}", param.getValue());
103118
}
104-
105-
private String joinJsUnpkgPath(String library, String cdnVersion, String cdnFileName) {
106-
return CDN_UNPKG + library + "@" + cdnVersion + "/" + cdnFileName;
107-
}
108-
109-
private String constructGraphQlEndpoint(HttpServletRequest request, @RequestParam Map<String, String> params) {
110-
String endpoint = altairProperties.getEndpoint().getGraphql();
111-
for (Map.Entry<String, String> param : params.entrySet()) {
112-
endpoint = endpoint.replaceAll("\\{" + param.getKey() + "}", param.getValue());
113-
}
114-
if (StringUtils.isNotBlank(request.getContextPath()) && !endpoint.startsWith(request.getContextPath())) {
115-
return request.getContextPath() + endpoint;
116-
}
117-
return endpoint;
119+
if (StringUtils.isNotBlank(request.getContextPath()) && !endpoint
120+
.startsWith(request.getContextPath())) {
121+
return request.getContextPath() + endpoint;
118122
}
123+
return endpoint;
124+
}
119125

120126
}

0 commit comments

Comments
 (0)