Merge pull request #410 from jbonofre/AMQ-7327

[AMQ-7327] Use maxFrameSize to limit HTTP content length
This commit is contained in:
Jean-Baptiste Onofré 2019-11-12 17:30:59 +01:00 committed by GitHub
commit 1846df4863
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 94 additions and 0 deletions

View File

@ -48,9 +48,11 @@ public class HttpTransportFactory extends TransportFactory {
Map<String, Object> jettyOptions = IntrospectionSupport.extractProperties(options, "jetty.");
Map<String, Object> httpOptions = IntrospectionSupport.extractProperties(options, "http.");
Map<String, Object> transportOptions = IntrospectionSupport.extractProperties(options, "transport.");
Map<String, Object> wireFormatOptions = IntrospectionSupport.extractProperties(options, "wireFormat.");
result.setJettyOptions(jettyOptions);
result.setTransportOption(transportOptions);
result.setHttpOptions(httpOptions);
result.setWireFormatOptions(wireFormatOptions);
return result;
} catch (URISyntaxException e) {
throw IOExceptionSupport.create(e);

View File

@ -18,6 +18,7 @@ package org.apache.activemq.transport.http;
import java.net.InetSocketAddress;
import java.net.URI;
import java.util.HashMap;
import java.util.Map;
import org.apache.activemq.command.BrokerInfo;
@ -38,6 +39,7 @@ public class HttpTransportServer extends WebTransportServerSupport {
private TextWireFormat wireFormat;
private final HttpTransportFactory transportFactory;
private Map<String, Object> wireFormatOptions = new HashMap<>();
public HttpTransportServer(URI uri, HttpTransportFactory factory) {
super(uri);
@ -93,6 +95,7 @@ public class HttpTransportServer extends WebTransportServerSupport {
contextHandler.setAttribute("wireFormat", getWireFormat());
contextHandler.setAttribute("transportFactory", transportFactory);
contextHandler.setAttribute("transportOptions", transportOptions);
contextHandler.setAttribute("wireFormatOptions", wireFormatOptions);
//AMQ-6182 - disabling trace by default
configureTraceMethod((ConstraintSecurityHandler) contextHandler.getSecurityHandler(),
@ -171,6 +174,10 @@ public class HttpTransportServer extends WebTransportServerSupport {
super.setTransportOption(transportOptions);
}
public void setWireFormatOptions(Map<String, Object> wireFormatOptions) {
this.wireFormatOptions = wireFormatOptions;
}
@Override
public boolean isSslServer() {
return false;

View File

@ -60,6 +60,7 @@ public class HttpTunnelServlet extends HttpServlet {
private ConcurrentMap<String, BlockingQueueTransport> clients = new ConcurrentHashMap<String, BlockingQueueTransport>();
private final long requestTimeout = 30000L;
private HashMap<String, Object> transportOptions;
private HashMap<String, Object> wireFormatOptions;
@SuppressWarnings("unchecked")
@Override
@ -74,6 +75,7 @@ public class HttpTunnelServlet extends HttpServlet {
throw new ServletException("No such attribute 'transportFactory' available in the ServletContext");
}
transportOptions = (HashMap<String, Object>)getServletContext().getAttribute("transportOptions");
wireFormatOptions = (HashMap<String, Object>)getServletContext().getAttribute("wireFormatOptions");
wireFormat = (TextWireFormat)getServletContext().getAttribute("wireFormat");
if (wireFormat == null) {
wireFormat = createWireFormat();
@ -118,6 +120,10 @@ public class HttpTunnelServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
if (wireFormatOptions.get("maxFrameSize") != null && request.getContentLength() > Integer.parseInt(wireFormatOptions.get("maxFrameSize").toString())) {
throw new ServletException("maxFrameSize exceeded");
}
InputStream stream = request.getInputStream();
String contentType = request.getContentType();
if (contentType != null && contentType.equals("application/x-gzip")) {

View File

@ -0,0 +1,79 @@
/**
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.activemq.transport.http;
import org.apache.activemq.ActiveMQConnectionFactory;
import org.apache.activemq.broker.BrokerService;
import org.apache.activemq.command.ActiveMQQueue;
import org.apache.commons.lang.StringUtils;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import javax.jms.Connection;
import javax.jms.JMSException;
import javax.jms.MessageProducer;
import javax.jms.Session;
import javax.jms.TextMessage;
public class HttpMaxFrameSizeTest {
protected BrokerService brokerService;
@Before
public void setup() throws Exception {
brokerService = new BrokerService();
brokerService.setPersistent(false);
brokerService.setUseJmx(false);
brokerService.deleteAllMessages();
brokerService.addConnector("http://localhost:8888?wireFormat.maxFrameSize=4000");
brokerService.start();
brokerService.waitUntilStarted();
}
@After
public void teardown() throws Exception {
brokerService.stop();
}
@Test
public void sendOversizedMessageTest() throws Exception {
try {
send(5000);
} catch (JMSException jmsException) {
Assert.assertTrue(jmsException.getMessage().contains("500 Server Error"));
}
}
@Test
public void sendGoodMessageTest() throws Exception {
// no exception expected there
send(10);
}
private void send(int size) throws Exception {
ActiveMQConnectionFactory connectionFactory = new ActiveMQConnectionFactory("http://localhost:8888");
Connection connection = connectionFactory.createConnection();
Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE);
MessageProducer producer = session.createProducer(new ActiveMQQueue("test"));
String payload = StringUtils.repeat("*", size);
TextMessage textMessage = session.createTextMessage(payload);
producer.send(textMessage);
}
}