();
+ for (int i = 0; i < methods.length; i++) {
+ methodsToIgnore.add(methods[i]);
+ }
+ }
+
+ /**
+ * This method interrogates the User-Agent String and returns whether it
+ * refers to a browser. If its not a browser, then the requirement for the
+ * CSRF header will not be enforced; if it is a browser, the requirement will
+ * be enforced.
+ *
+ * A User-Agent String is considered to be a browser if it matches
+ * any of the regex patterns from browser-useragent-regex; the default
+ * behavior is to consider everything a browser that matches the following:
+ * "^Mozilla.*,^Opera.*". Subclasses can optionally override
+ * this method to use different behavior.
+ *
+ * @param userAgent The User-Agent String, or null if there isn't one
+ * @return true if the User-Agent String refers to a browser, false if not
+ */
+ protected boolean isBrowser(String userAgent) {
+ if (userAgent == null) {
+ return false;
+ }
+ for (Pattern pattern : browserUserAgents) {
+ Matcher matcher = pattern.matcher(userAgent);
+ if (matcher.matches()) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Defines the minimal API requirements for the filter to execute its
+ * filtering logic. This interface exists to facilitate integration in
+ * components that do not run within a servlet container and therefore cannot
+ * rely on a servlet container to dispatch to the {@link #doFilter} method.
+ * Applications that do run inside a servlet container will not need to write
+ * code that uses this interface. Instead, they can use typical servlet
+ * container configuration mechanisms to insert the filter.
+ */
+ public interface HttpInteraction {
+
+ /**
+ * Returns the value of a header.
+ *
+ * @param header name of header
+ * @return value of header
+ */
+ String getHeader(String header);
+
+ /**
+ * Returns the method.
+ *
+ * @return method
+ */
+ String getMethod();
+
+ /**
+ * Called by the filter after it decides that the request may proceed.
+ *
+ * @throws IOException if there is an I/O error
+ * @throws ServletException if the implementation relies on the servlet API
+ * and a servlet API call has failed
+ */
+ void proceed() throws IOException, ServletException;
+
+ /**
+ * Called by the filter after it decides that the request is a potential
+ * CSRF attack and therefore must be rejected.
+ *
+ * @param code status code to send
+ * @param message response message
+ * @throws IOException if there is an I/O error
+ */
+ void sendError(int code, String message) throws IOException;
+ }
+
+ /**
+ * Handles an {@link HttpInteraction} by applying the filtering logic.
+ *
+ * @param httpInteraction caller's HTTP interaction
+ * @throws IOException if there is an I/O error
+ * @throws ServletException if the implementation relies on the servlet API
+ * and a servlet API call has failed
+ */
+ public void handleHttpInteraction(HttpInteraction httpInteraction)
+ throws IOException, ServletException {
+ if (!isBrowser(httpInteraction.getHeader(HEADER_USER_AGENT)) ||
+ methodsToIgnore.contains(httpInteraction.getMethod()) ||
+ httpInteraction.getHeader(headerName) != null) {
+ httpInteraction.proceed();
+ } else {
+ httpInteraction.sendError(HttpServletResponse.SC_BAD_REQUEST,
+ "Missing Required Header for CSRF Vulnerability Protection");
+ }
+ }
+
+ @Override
+ public void doFilter(ServletRequest request, ServletResponse response,
+ final FilterChain chain) throws IOException, ServletException {
+ final HttpServletRequest httpRequest = (HttpServletRequest)request;
+ final HttpServletResponse httpResponse = (HttpServletResponse)response;
+ handleHttpInteraction(new ServletFilterHttpInteraction(httpRequest,
+ httpResponse, chain));
+ }
+
+ @Override
+ public void destroy() {
+ }
+
+ /**
+ * Constructs a mapping of configuration properties to be used for filter
+ * initialization. The mapping includes all properties that start with the
+ * specified configuration prefix. Property names in the mapping are trimmed
+ * to remove the configuration prefix.
+ *
+ * @param conf configuration to read
+ * @param confPrefix configuration prefix
+ * @return mapping of configuration properties to be used for filter
+ * initialization
+ */
+ public static Map getFilterParams(Configuration conf,
+ String confPrefix) {
+ Map filterConfigMap = new HashMap<>();
+ for (Map.Entry entry : conf) {
+ String name = entry.getKey();
+ if (name.startsWith(confPrefix)) {
+ String value = conf.get(name);
+ name = name.substring(confPrefix.length());
+ filterConfigMap.put(name, value);
+ }
+ }
+ return filterConfigMap;
+ }
+
+ /**
+ * {@link HttpInteraction} implementation for use in the servlet filter.
+ */
+ private static final class ServletFilterHttpInteraction
+ implements HttpInteraction {
+
+ private final FilterChain chain;
+ private final HttpServletRequest httpRequest;
+ private final HttpServletResponse httpResponse;
+
+ /**
+ * Creates a new ServletFilterHttpInteraction.
+ *
+ * @param httpRequest request to process
+ * @param httpResponse response to process
+ * @param chain filter chain to forward to if HTTP interaction is allowed
+ */
+ public ServletFilterHttpInteraction(HttpServletRequest httpRequest,
+ HttpServletResponse httpResponse, FilterChain chain) {
+ this.httpRequest = httpRequest;
+ this.httpResponse = httpResponse;
+ this.chain = chain;
+ }
+
+ @Override
+ public String getHeader(String header) {
+ return httpRequest.getHeader(header);
+ }
+
+ @Override
+ public String getMethod() {
+ return httpRequest.getMethod();
+ }
+
+ @Override
+ public void proceed() throws IOException, ServletException {
+ chain.doFilter(httpRequest, httpResponse);
+ }
+
+ @Override
+ public void sendError(int code, String message) throws IOException {
+ httpResponse.sendError(code, message);
+ }
+ }
+}
diff --git a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/HBaseRESTTestingUtility.java b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/HBaseRESTTestingUtility.java
index 628b17cc47c..7c3e1fd9bba 100644
--- a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/HBaseRESTTestingUtility.java
+++ b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/HBaseRESTTestingUtility.java
@@ -75,6 +75,8 @@ public class HBaseRESTTestingUtility {
filter = filter.trim();
context.addFilter(Class.forName(filter), "/*", 0);
}
+ conf.set(RESTServer.REST_CSRF_BROWSER_USERAGENTS_REGEX_KEY, ".*");
+ RESTServer.addCSRFFilter(context, conf);
HttpServerUtil.constrainHttpMethods(context);
LOG.info("Loaded filter classes :" + filterClasses);
// start the server
diff --git a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestMultiRowResource.java b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestMultiRowResource.java
index 412ccdbf8d7..76c2f6192da 100644
--- a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestMultiRowResource.java
+++ b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestMultiRowResource.java
@@ -19,6 +19,7 @@
package org.apache.hadoop.hbase.rest;
+import org.apache.commons.httpclient.Header;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.*;
import org.apache.hadoop.hbase.client.Admin;
@@ -36,6 +37,8 @@ import org.junit.AfterClass;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.experimental.categories.Category;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
import javax.ws.rs.core.MediaType;
import javax.xml.bind.JAXBContext;
@@ -43,11 +46,15 @@ import javax.xml.bind.JAXBException;
import javax.xml.bind.Marshaller;
import javax.xml.bind.Unmarshaller;
import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
import static org.junit.Assert.assertEquals;
@Category(MediumTests.class)
+@RunWith(Parameterized.class)
public class TestMultiRowResource {
private static final TableName TABLE = TableName.valueOf("TestRowResource");
@@ -70,10 +77,27 @@ public class TestMultiRowResource {
private static Unmarshaller unmarshaller;
private static Configuration conf;
+ private static Header extraHdr = null;
+ private static boolean csrfEnabled = true;
+
+ @Parameterized.Parameters
+ public static Collection data() {
+ List params = new ArrayList();
+ params.add(new Object[] {Boolean.TRUE});
+ params.add(new Object[] {Boolean.FALSE});
+ return params;
+ }
+
+ public TestMultiRowResource(Boolean csrf) {
+ csrfEnabled = csrf;
+ }
+
@BeforeClass
public static void setUpBeforeClass() throws Exception {
conf = TEST_UTIL.getConfiguration();
+ conf.setBoolean(RESTServer.REST_CSRF_ENABLED_KEY, csrfEnabled);
+ extraHdr = new Header(RESTServer.REST_CSRF_CUSTOM_HEADER_DEFAULT, "");
TEST_UTIL.startMiniCluster();
REST_TEST_UTIL.startServletContainer(conf);
context = JAXBContext.newInstance(
@@ -114,16 +138,21 @@ public class TestMultiRowResource {
path.append("&row=");
path.append(ROW_2);
- client.post(row_5_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_1));
- client.post(row_6_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_2));
+ if (csrfEnabled) {
+ Response response = client.post(row_5_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_1));
+ assertEquals(400, response.getCode());
+ }
+
+ client.post(row_5_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_1), extraHdr);
+ client.post(row_6_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_2), extraHdr);
Response response = client.get(path.toString(), Constants.MIMETYPE_JSON);
assertEquals(response.getCode(), 200);
assertEquals(Constants.MIMETYPE_JSON, response.getHeader("content-type"));
- client.delete(row_5_url);
- client.delete(row_6_url);
+ client.delete(row_5_url, extraHdr);
+ client.delete(row_6_url, extraHdr);
}
@@ -141,16 +170,16 @@ public class TestMultiRowResource {
path.append("&row=");
path.append(ROW_2);
- client.post(row_5_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_1));
- client.post(row_6_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_2));
+ client.post(row_5_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_1), extraHdr);
+ client.post(row_6_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_2), extraHdr);
Response response = client.get(path.toString(), Constants.MIMETYPE_XML);
assertEquals(response.getCode(), 200);
assertEquals(Constants.MIMETYPE_XML, response.getHeader("content-type"));
- client.delete(row_5_url);
- client.delete(row_6_url);
+ client.delete(row_5_url, extraHdr);
+ client.delete(row_6_url, extraHdr);
}
@@ -166,7 +195,7 @@ public class TestMultiRowResource {
path.append("&row=");
path.append(ROW_2);
- client.post(row_5_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_1));
+ client.post(row_5_url, Constants.MIMETYPE_BINARY, Bytes.toBytes(VALUE_1), extraHdr);
Response response = client.get(path.toString(), Constants.MIMETYPE_JSON);
assertEquals(response.getCode(), 200);
ObjectMapper mapper = new JacksonProvider().locateMapper(CellSetModel.class,
@@ -175,7 +204,7 @@ public class TestMultiRowResource {
assertEquals(1, cellSet.getRows().size());
assertEquals(ROW_1, Bytes.toString(cellSet.getRows().get(0).getKey()));
assertEquals(VALUE_1, Bytes.toString(cellSet.getRows().get(0).getCells().get(0).getValue()));
- client.delete(row_5_url);
+ client.delete(row_5_url, extraHdr);
}
}
diff --git a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestSchemaResource.java b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestSchemaResource.java
index f3891641796..7ca56f363f5 100644
--- a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestSchemaResource.java
+++ b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestSchemaResource.java
@@ -22,10 +22,15 @@ package org.apache.hadoop.hbase.rest;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.StringWriter;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
import javax.xml.bind.JAXBContext;
import javax.xml.bind.JAXBException;
+import org.apache.commons.httpclient.Header;
+
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.HBaseTestingUtility;
import org.apache.hadoop.hbase.testclassification.MediumTests;
@@ -45,8 +50,11 @@ import org.junit.AfterClass;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.experimental.categories.Category;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
@Category(MediumTests.class)
+@RunWith(Parameterized.class)
public class TestSchemaResource {
private static String TABLE1 = "TestSchemaResource1";
private static String TABLE2 = "TestSchemaResource2";
@@ -58,10 +66,27 @@ public class TestSchemaResource {
private static JAXBContext context;
private static Configuration conf;
private static TestTableSchemaModel testTableSchemaModel;
+ private static Header extraHdr = null;
+
+ private static boolean csrfEnabled = true;
+
+ @Parameterized.Parameters
+ public static Collection data() {
+ List params = new ArrayList();
+ params.add(new Object[] {Boolean.TRUE});
+ params.add(new Object[] {Boolean.FALSE});
+ return params;
+ }
+
+ public TestSchemaResource(Boolean csrf) {
+ csrfEnabled = csrf;
+ }
@BeforeClass
public static void setUpBeforeClass() throws Exception {
conf = TEST_UTIL.getConfiguration();
+ conf.setBoolean(RESTServer.REST_CSRF_ENABLED_KEY, csrfEnabled);
+ extraHdr = new Header(RESTServer.REST_CSRF_CUSTOM_HEADER_DEFAULT, "");
TEST_UTIL.startMiniCluster();
REST_TEST_UTIL.startServletContainer(conf);
client = new Client(new Cluster().add("localhost",
@@ -102,12 +127,18 @@ public class TestSchemaResource {
// create the table
model = testTableSchemaModel.buildTestModel(TABLE1);
testTableSchemaModel.checkModel(model, TABLE1);
- response = client.put(schemaPath, Constants.MIMETYPE_XML, toXML(model));
+ if (csrfEnabled) {
+ // test put operation is forbidden without custom header
+ response = client.put(schemaPath, Constants.MIMETYPE_XML, toXML(model));
+ assertEquals(response.getCode(), 400);
+ }
+
+ response = client.put(schemaPath, Constants.MIMETYPE_XML, toXML(model), extraHdr);
assertEquals(response.getCode(), 201);
// recall the same put operation but in read-only mode
conf.set("hbase.rest.readonly", "true");
- response = client.put(schemaPath, Constants.MIMETYPE_XML, toXML(model));
+ response = client.put(schemaPath, Constants.MIMETYPE_XML, toXML(model), extraHdr);
assertEquals(response.getCode(), 403);
// retrieve the schema and validate it
@@ -124,15 +155,21 @@ public class TestSchemaResource {
model = testTableSchemaModel.fromJSON(Bytes.toString(response.getBody()));
testTableSchemaModel.checkModel(model, TABLE1);
+ if (csrfEnabled) {
+ // test delete schema operation is forbidden without custom header
+ response = client.delete(schemaPath);
+ assertEquals(400, response.getCode());
+ }
+
// test delete schema operation is forbidden in read-only mode
- response = client.delete(schemaPath);
+ response = client.delete(schemaPath, extraHdr);
assertEquals(response.getCode(), 403);
// return read-only setting back to default
conf.set("hbase.rest.readonly", "false");
// delete the table and make sure HBase concurs
- response = client.delete(schemaPath);
+ response = client.delete(schemaPath, extraHdr);
assertEquals(response.getCode(), 200);
assertFalse(admin.tableExists(TableName.valueOf(TABLE1)));
}
@@ -149,14 +186,21 @@ public class TestSchemaResource {
// create the table
model = testTableSchemaModel.buildTestModel(TABLE2);
testTableSchemaModel.checkModel(model, TABLE2);
+
+ if (csrfEnabled) {
+ // test put operation is forbidden without custom header
+ response = client.put(schemaPath, Constants.MIMETYPE_PROTOBUF, model.createProtobufOutput());
+ assertEquals(response.getCode(), 400);
+ }
response = client.put(schemaPath, Constants.MIMETYPE_PROTOBUF,
- model.createProtobufOutput());
+ model.createProtobufOutput(), extraHdr);
assertEquals(response.getCode(), 201);
// recall the same put operation but in read-only mode
conf.set("hbase.rest.readonly", "true");
response = client.put(schemaPath, Constants.MIMETYPE_PROTOBUF,
- model.createProtobufOutput());
+ model.createProtobufOutput(), extraHdr);
+ assertNotNull(extraHdr);
assertEquals(response.getCode(), 403);
// retrieve the schema and validate it
@@ -175,15 +219,21 @@ public class TestSchemaResource {
model.getObjectFromMessage(response.getBody());
testTableSchemaModel.checkModel(model, TABLE2);
+ if (csrfEnabled) {
+ // test delete schema operation is forbidden without custom header
+ response = client.delete(schemaPath);
+ assertEquals(400, response.getCode());
+ }
+
// test delete schema operation is forbidden in read-only mode
- response = client.delete(schemaPath);
+ response = client.delete(schemaPath, extraHdr);
assertEquals(response.getCode(), 403);
// return read-only setting back to default
conf.set("hbase.rest.readonly", "false");
// delete the table and make sure HBase concurs
- response = client.delete(schemaPath);
+ response = client.delete(schemaPath, extraHdr);
assertEquals(response.getCode(), 200);
assertFalse(admin.tableExists(TableName.valueOf(TABLE2)));
}