Skip to content

Commit 98c17a3

Browse files
mscibiliaphp-coder
mscibilia
authored and
php-coder
committed
refactor: Removed hard-coding of h2 console path and used H2ConsoleProperties instead
Fix #1269
1 parent 77d625e commit 98c17a3

File tree

4 files changed

+98
-34
lines changed

4 files changed

+98
-34
lines changed

‎src/main/java/ru/mystamps/web/support/spring/security/ContentSecurityPolicyHeaderWriter.java

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,6 @@ class ContentSecurityPolicyHeaderWriter implements HeaderWriter {
4646

4747
private static final String ADD_IMAGE_PAGE_PATTERN = "/series/(add|\\d+|\\d+/(ask|image))";
4848

49-
// see also spring.h2.console.path in application-test.properties and SecurityConfig
50-
private static final String H2_CONSOLE_PATTERN = "/console/";
51-
5249
// default policy prevents loading resources from any source
5350
private static final String DEFAULT_SRC = "default-src 'none'";
5451

@@ -156,6 +153,8 @@ class ContentSecurityPolicyHeaderWriter implements HeaderWriter {
156153
private final boolean useSingleHost;
157154
private final boolean hasH2Console;
158155
private final String host;
156+
private final String h2ConsolePath;
157+
159158

160159
@Override
161160
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
@@ -168,7 +167,7 @@ public void writeHeaders(HttpServletRequest request, HttpServletResponse respons
168167
protected String constructDirectives(String uri) {
169168
boolean onCollectionInfoPage = uri.startsWith(COLLECTION_INFO_PAGE_PATTERN);
170169
boolean onAddSeriesPage = uri.equals(SeriesUrl.ADD_SERIES_PAGE);
171-
boolean onH2ConsolePage = hasH2Console && uri.startsWith(H2_CONSOLE_PATTERN);
170+
boolean onH2ConsolePage = hasH2Console && uri.startsWith(h2ConsolePath);
172171

173172
StringBuilder sb = new StringBuilder();
174173

‎src/main/java/ru/mystamps/web/support/spring/security/SecurityConfig.java

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919

2020
import org.springframework.beans.factory.annotation.Autowired;
2121
import org.springframework.beans.factory.annotation.Qualifier;
22+
import org.springframework.boot.autoconfigure.h2.H2ConsoleProperties;
2223
import org.springframework.boot.web.servlet.FilterRegistrationBean;
2324
import org.springframework.boot.web.servlet.filter.OrderedRequestContextFilter;
2425
import org.springframework.context.ApplicationListener;
@@ -72,6 +73,9 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
7273
@Autowired
7374
private SiteService siteService;
7475

76+
@Autowired(required = false)
77+
private H2ConsoleProperties h2ConsoleProperties;
78+
7579
@Override
7680
@SuppressWarnings("PMD.SignatureDeclareThrowsException")
7781
public void configure(WebSecurity web) throws Exception {
@@ -89,8 +93,16 @@ protected void configure(HttpSecurity http) throws Exception {
8993
boolean usePublicHostname = environment.acceptsProfiles("prod");
9094
String hostname = usePublicHostname ? SiteUrl.PUBLIC_URL : SiteUrl.SITE;
9195

96+
String h2ConsolePath = hasH2Console ? h2ConsoleProperties.getPath() : null;
97+
98+
// Allow unsecured requests to H2 consoles if available.
99+
// See also spring.h2.console.path in application-test.properties
100+
String[] pathsToIgnore =
101+
hasH2Console ? new String[]{h2ConsolePath + "/**", SiteUrl.CSP_REPORTS_HANDLER}
102+
: new String[]{SiteUrl.CSP_REPORTS_HANDLER};
103+
92104
ContentSecurityPolicyHeaderWriter cspWriter =
93-
new ContentSecurityPolicyHeaderWriter(useCdn, useSingleHost, hasH2Console, hostname);
105+
new ContentSecurityPolicyHeaderWriter(useCdn, useSingleHost, hasH2Console, hostname, h2ConsolePath);
94106

95107
http
96108
.authorizeRequests()
@@ -138,10 +150,7 @@ protected void configure(HttpSecurity http) throws Exception {
138150
.authenticationEntryPoint(new Http403ForbiddenEntryPoint())
139151
.and()
140152
.csrf()
141-
// Allow unsecured requests to H2 consoles.
142-
// See also spring.h2.console.path in application-test.properties and
143-
// ContentSecurityPolicyHeaderWriter.H2_CONSOLE_PATTERN
144-
.ignoringAntMatchers("/console/**", SiteUrl.CSP_REPORTS_HANDLER)
153+
.ignoringAntMatchers(pathsToIgnore)
145154
.and()
146155
.rememberMe()
147156
// FIXME: GH #27

‎src/main/resources/application-test.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ spring.datasource.driver-class-name: org.h2.Driver
77
spring.datasource.initialization-mode: NEVER
88

99
spring.h2.console.enabled: true
10-
# see also SecurityConfig and ContentSecurityPolicyHeaderWriter.H2_CONSOLE_PATTERN
10+
# see also SecurityConfig
1111
spring.h2.console.path: /console
1212

1313
# required for using /console with CSP because we have many hashes as a workaround

‎src/test/java/ru/mystamps/web/support/spring/security/ContentSecurityPolicyHeaderWriterTest.java

Lines changed: 80 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@ public class ContentSecurityPolicyHeaderWriterTest implements WithAssertions {
3838
private static final int NUMBER_OF_DIRECTIVES_ON_ADD_SERIES_PAGE = 7;
3939
private static final int NUMBER_OF_DIRECTIVES_ON_INFO_SERIES_PAGE = 7;
4040
private static final int NUMBER_OF_DIRECTIVES_ON_H2_CONSOLE_PAGE = 7;
41-
41+
private static final String H2_CONSOLE_PATH = "/console/";
42+
4243
@Rule
4344
public TogglzRule togglz = TogglzRule.allEnabled(Features.class);
4445

@@ -49,8 +50,13 @@ public class ContentSecurityPolicyHeaderWriterTest implements WithAssertions {
4950
@Test
5051
public void writeContentSecurityPolicyHeader() {
5152
// given
52-
ContentSecurityPolicyHeaderWriter writer =
53-
new ContentSecurityPolicyHeaderWriter(bool(), bool(), bool(), Random.host());
53+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
54+
bool(),
55+
bool(),
56+
bool(),
57+
Random.host(),
58+
H2_CONSOLE_PATH
59+
);
5460
HttpServletRequest request = new MockHttpServletRequest();
5561
HttpServletResponse response = new MockHttpServletResponse();
5662

@@ -76,8 +82,13 @@ public void writeContentSecurityPolicyHeader() {
7682

7783
@Test
7884
public void onIndexPageWithLocalResources() {
79-
ContentSecurityPolicyHeaderWriter writer =
80-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), SiteUrl.SITE);
85+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
86+
false,
87+
true,
88+
bool(),
89+
SiteUrl.SITE,
90+
H2_CONSOLE_PATH
91+
);
8192
String[] directives = writer.constructDirectives("/").split(";");
8293

8394
assertThat(directives)
@@ -91,11 +102,16 @@ public void onIndexPageWithLocalResources() {
91102
)
92103
.hasSize(NUMBER_OF_DIRECTIVES_ON_STANDARD_PAGES);
93104
}
94-
105+
95106
@Test
96107
public void onIndexPageWithResourcesFromCdn() {
97-
ContentSecurityPolicyHeaderWriter writer
98-
= new ContentSecurityPolicyHeaderWriter(true, false, bool(), SiteUrl.PUBLIC_URL);
108+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
109+
true,
110+
false,
111+
bool(),
112+
SiteUrl.PUBLIC_URL,
113+
H2_CONSOLE_PATH
114+
);
99115
String[] directives = writer.constructDirectives("/").split(";");
100116

101117
assertThat(directives)
@@ -125,8 +141,13 @@ public void onIndexPageWithResourcesFromCdn() {
125141

126142
@Test
127143
public void onCollectionInfoPageWithLocalResources() {
128-
ContentSecurityPolicyHeaderWriter writer =
129-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), Random.host());
144+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
145+
false,
146+
true,
147+
bool(),
148+
Random.host(),
149+
H2_CONSOLE_PATH
150+
);
130151
String[] directives = writer.constructDirectives("/collection/user").split(";");
131152

132153
// test only the directives that differ from the index page
@@ -152,8 +173,13 @@ public void onCollectionInfoPageWithLocalResources() {
152173

153174
@Test
154175
public void onCollectionInfoPageWithResourcesFromCdn() {
155-
ContentSecurityPolicyHeaderWriter writer =
156-
new ContentSecurityPolicyHeaderWriter(true, false, bool(), Random.host());
176+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
177+
true,
178+
false,
179+
bool(),
180+
Random.host(),
181+
H2_CONSOLE_PATH
182+
);
157183
String[] directives = writer.constructDirectives("/collection/user").split(";");
158184

159185
// test only the directives that differ from the index page
@@ -182,8 +208,13 @@ public void onCollectionInfoPageWithResourcesFromCdn() {
182208

183209
@Test
184210
public void onSeriesAddImagePageWithLocalResources() {
185-
ContentSecurityPolicyHeaderWriter writer =
186-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), Random.host());
211+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
212+
false,
213+
true,
214+
bool(),
215+
Random.host(),
216+
H2_CONSOLE_PATH
217+
);
187218

188219
for (String page : new String[]{"/series/11", "/series/12/ask", "/series/13/image"}) {
189220
String[] directives = writer.constructDirectives(page).split(";");
@@ -205,8 +236,13 @@ public void onSeriesAddImagePageWithLocalResources() {
205236

206237
@Test
207238
public void onSeriesAddImagePageWithResourcesFromCdn() {
208-
ContentSecurityPolicyHeaderWriter writer =
209-
new ContentSecurityPolicyHeaderWriter(true, false, bool(), Random.host());
239+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
240+
true,
241+
false,
242+
bool(),
243+
Random.host(),
244+
H2_CONSOLE_PATH
245+
);
210246

211247
for (String page : new String[]{"/series/11", "/series/12/ask", "/series/13/image"}) {
212248
String[] directives = writer.constructDirectives(page).split(";");
@@ -238,8 +274,13 @@ public void onSeriesAddImagePageWithResourcesFromCdn() {
238274

239275
@Test
240276
public void onSeriesAddPageWithLocalResources() {
241-
ContentSecurityPolicyHeaderWriter writer =
242-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), Random.host());
277+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
278+
false,
279+
true,
280+
bool(),
281+
Random.host(),
282+
H2_CONSOLE_PATH
283+
);
243284
String[] directives = writer.constructDirectives("/series/add").split(";");
244285

245286
// test only the directives that differ from the index page
@@ -266,8 +307,13 @@ public void onSeriesAddPageWithLocalResources() {
266307

267308
@Test
268309
public void onSeriesAddPageWithResourcesFromCdn() {
269-
ContentSecurityPolicyHeaderWriter writer =
270-
new ContentSecurityPolicyHeaderWriter(true, false, bool(), Random.host());
310+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
311+
true,
312+
false,
313+
bool(),
314+
Random.host(),
315+
H2_CONSOLE_PATH
316+
);
271317
String[] directives = writer.constructDirectives("/series/add").split(";");
272318

273319
// test only the directives that differ from the index page
@@ -297,8 +343,13 @@ public void onSeriesAddPageWithResourcesFromCdn() {
297343

298344
@Test
299345
public void onH2ConsoleWithLocalResources() {
300-
ContentSecurityPolicyHeaderWriter writer =
301-
new ContentSecurityPolicyHeaderWriter(false, true, true, Random.host());
346+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
347+
false,
348+
true,
349+
true,
350+
Random.host(),
351+
H2_CONSOLE_PATH
352+
);
302353
String[] directives = writer.constructDirectives("/console/").split(";");
303354

304355
// test only the directives that are differ from the index page
@@ -325,8 +376,13 @@ public void onH2ConsoleWithLocalResources() {
325376

326377
@Test
327378
public void onH2ConsoleWithResourcesFromCdn() {
328-
ContentSecurityPolicyHeaderWriter writer =
329-
new ContentSecurityPolicyHeaderWriter(true, false, false, Random.host());
379+
ContentSecurityPolicyHeaderWriter writer = new ContentSecurityPolicyHeaderWriter(
380+
true,
381+
false,
382+
false,
383+
Random.host(),
384+
H2_CONSOLE_PATH
385+
);
330386
String[] directives = writer.constructDirectives("/console/").split(";");
331387

332388
assertThat(directives)

0 commit comments

Comments
 (0)