RED-8175 - fixed path traversal issue #310

Merged
timo.bejan.ext merged 1 commits from RED-8175 into master 2024-01-16 16:07:11 +01:00
3 changed files with 26 additions and 2 deletions

View File

@ -13,6 +13,8 @@ import java.util.ArrayList;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import com.iqser.red.service.persistence.management.v1.processor.service.persistence.DossierTemplatePersistenceService;
import org.apache.commons.io.FilenameUtils;
import org.apache.commons.io.IOUtils; import org.apache.commons.io.IOUtils;
import org.springframework.core.io.InputStreamResource; import org.springframework.core.io.InputStreamResource;
import org.springframework.http.HttpHeaders; import org.springframework.http.HttpHeaders;
@ -66,6 +68,7 @@ public class ReportTemplateController implements ReportTemplateResource {
private final PlaceholderClient placeholderClient; private final PlaceholderClient placeholderClient;
private final AuditPersistenceService auditPersistenceService; private final AuditPersistenceService auditPersistenceService;
private final DossierAttributeConfigPersistenceService dossierAttributeConfigPersistenceService; private final DossierAttributeConfigPersistenceService dossierAttributeConfigPersistenceService;
private final DossierTemplatePersistenceService dossierTemplatePersistenceService;
private final FileAttributeConfigPersistenceService fileAttributeConfigPersistenceService; private final FileAttributeConfigPersistenceService fileAttributeConfigPersistenceService;
private final StorageService storageService; private final StorageService storageService;
private final ReportTemplatePersistenceService reportTemplatePersistenceService; private final ReportTemplatePersistenceService reportTemplatePersistenceService;
@ -96,9 +99,12 @@ public class ReportTemplateController implements ReportTemplateResource {
try { try {
if (file.getOriginalFilename() != null) { if (file.getOriginalFilename() != null) {
dossierTemplatePersistenceService.checkDossierTemplateExistsOrElseThrow404(dossierTemplateId);
var cleanupName = FilenameUtils.getName(file.getOriginalFilename());
ReportTemplateUploadRequest reportTemplateUploadRequest = ReportTemplateUploadRequest.builder() ReportTemplateUploadRequest reportTemplateUploadRequest = ReportTemplateUploadRequest.builder()
.template(file.getBytes()) .template(file.getBytes())
.fileName(file.getOriginalFilename()) .fileName(cleanupName)
.dossierTemplateId(dossierTemplateId) .dossierTemplateId(dossierTemplateId)
.activeByDefault(activeByDefault) .activeByDefault(activeByDefault)
.multiFileReport(multiFileReport) .multiFileReport(multiFileReport)

View File

@ -7,6 +7,7 @@ import java.util.Optional;
import java.util.UUID; import java.util.UUID;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.BeanUtils; import org.springframework.beans.BeanUtils;
import org.springframework.beans.factory.annotation.Value; import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service; import org.springframework.stereotype.Service;
@ -104,6 +105,7 @@ public class DossierTemplatePersistenceService {
} }
} }
public void validateDossierTemplate(String name, String description) { public void validateDossierTemplate(String name, String description) {
if (!StringUtils.isEmpty(name) && name.length() > MAX_NAME_LENGTH) { if (!StringUtils.isEmpty(name) && name.length() > MAX_NAME_LENGTH) {
@ -123,6 +125,7 @@ public class DossierTemplatePersistenceService {
return dossierTemplateRepository.existsByNameAndIdNot(templateName, dossierTemplateIdToIgnore); return dossierTemplateRepository.existsByNameAndIdNot(templateName, dossierTemplateIdToIgnore);
} }
@Transactional @Transactional
public boolean isDossierTemplateNameNotUnique(String templateName) { public boolean isDossierTemplateNameNotUnique(String templateName) {
@ -150,7 +153,8 @@ public class DossierTemplatePersistenceService {
} }
var now = OffsetDateTime.now(); var now = OffsetDateTime.now();
boolean isNotInRange = !now.isAfter(dossierTemplate.getValidFrom() != null ? dossierTemplate.getValidFrom() : OffsetDateTime.MIN) || !now.isBefore(dossierTemplate.getValidTo() != null ? dossierTemplate.getValidTo() : OffsetDateTime.MAX); boolean isNotInRange = !now.isAfter(dossierTemplate.getValidFrom() != null ? dossierTemplate.getValidFrom() : OffsetDateTime.MIN) ||
!now.isBefore(dossierTemplate.getValidTo() != null ? dossierTemplate.getValidTo() : OffsetDateTime.MAX);
if (isNotInRange) { if (isNotInRange) {
return DossierTemplateStatus.INACTIVE; return DossierTemplateStatus.INACTIVE;
} }
@ -180,6 +184,14 @@ public class DossierTemplatePersistenceService {
} }
public void checkDossierTemplateExistsOrElseThrow404(String dossierTemplateId) {
if (!dossierTemplateRepository.existsByIdAndNotDeleted(dossierTemplateId)) {
throw new NotFoundException(String.format(DOSSIER_TEMPLATE_NOT_FOUND_MESSAGE, dossierTemplateId));
}
}
@Transactional @Transactional
public List<TypeEntity> getTypesForDossierTemplate(String dossierTemplateId) { public List<TypeEntity> getTypesForDossierTemplate(String dossierTemplateId) {

View File

@ -18,8 +18,14 @@ public interface DossierTemplateRepository extends JpaRepository<DossierTemplate
@Query("select d from DossierTemplateEntity d where d.id = :dossierTemplateId and d.softDeleteTime is null") @Query("select d from DossierTemplateEntity d where d.id = :dossierTemplateId and d.softDeleteTime is null")
Optional<DossierTemplateEntity> findByIdAndNotDeleted(@Param("dossierTemplateId") String dossierTemplateId); Optional<DossierTemplateEntity> findByIdAndNotDeleted(@Param("dossierTemplateId") String dossierTemplateId);
@Query("select case when exists (select 1 from DossierTemplateEntity d where d.id = :dossierTemplateId and d.softDeleteTime is null) then true else false end")
boolean existsByIdAndNotDeleted(@Param("dossierTemplateId") String dossierTemplateId);
boolean existsByName(String name); boolean existsByName(String name);
boolean existsByNameAndIdNot(String name, String id); boolean existsByNameAndIdNot(String name, String id);
} }