honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-02-13 16:35:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

CORS handling triggered whether User-Agent is a browser or not

Browse Source 
This commit ensures that if CORS is enabled, then Origin headers are
checked regardless of whether the request came from a browser or not.
In the past, we only proceeded with CORS checks if the User-Agent was a
browser.
This commit is contained in:
Ali Beyad 2016-05-11 13:06:56 -04:00
parent fced8dac72
commit 189341da10
3 changed files with 7 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/src/main/java/org/elasticsearch/http/netty/cors/CorsHandler.java
View File

@ -20,7 +20,6 @@
package org.elasticsearch.http.netty.cors; package org.elasticsearch.http.netty.cors;
import org.elasticsearch.common.Strings; import org.elasticsearch.common.Strings;
import org.elasticsearch.rest.support.RestUtils;
import org.jboss.netty.channel.ChannelFutureListener; import org.jboss.netty.channel.ChannelFutureListener;
import org.jboss.netty.channel.ChannelHandlerContext; import org.jboss.netty.channel.ChannelHandlerContext;
import org.jboss.netty.channel.MessageEvent; import org.jboss.netty.channel.MessageEvent;
@ -41,7 +40,6 @@ import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.ACCESS_CONTRO
import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.ACCESS_CONTROL_MAX_AGE; import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.ACCESS_CONTROL_MAX_AGE;
import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.HOST; import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.HOST;
import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.ORIGIN; import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.ORIGIN;
import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.USER_AGENT;
import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.VARY; import static org.jboss.netty.handler.codec.http.HttpHeaders.Names.VARY;
import static org.jboss.netty.handler.codec.http.HttpResponseStatus.FORBIDDEN; import static org.jboss.netty.handler.codec.http.HttpResponseStatus.FORBIDDEN;
import static org.jboss.netty.handler.codec.http.HttpResponseStatus.OK; import static org.jboss.netty.handler.codec.http.HttpResponseStatus.OK;
@ -76,7 +74,6 @@ public class CorsHandler extends SimpleChannelUpstreamHandler {
public void messageReceived(final ChannelHandlerContext ctx, final MessageEvent e) throws Exception { public void messageReceived(final ChannelHandlerContext ctx, final MessageEvent e) throws Exception {
if (config.isCorsSupportEnabled() && e.getMessage() instanceof HttpRequest) { if (config.isCorsSupportEnabled() && e.getMessage() instanceof HttpRequest) {
request = (HttpRequest) e.getMessage(); request = (HttpRequest) e.getMessage();
if (RestUtils.isBrowser(request.headers().get(USER_AGENT))) {
if (isPreflightRequest(request)) { if (isPreflightRequest(request)) {
handlePreflight(ctx, request); handlePreflight(ctx, request);
return; return;
@ -86,7 +83,6 @@ public class CorsHandler extends SimpleChannelUpstreamHandler {
return; return;
} }
} }
}
super.messageReceived(ctx, e); super.messageReceived(ctx, e);
} }

11
core/src/main/java/org/elasticsearch/rest/support/RestUtils.java
View File

@ -41,17 +41,6 @@ public class RestUtils {
} }
}; };
public static boolean isBrowser(@Nullable String userAgent) {
if (userAgent == null) {
return false;
}
// chrome, safari, firefox, ie
if (userAgent.startsWith("Mozilla")) {
return true;
}
return false;
}
public static void decodeQueryString(String s, int fromIndex, Map<String, String> params) { public static void decodeQueryString(String s, int fromIndex, Map<String, String> params) {
if (fromIndex < 0) { if (fromIndex < 0) {
return; return;

2
core/src/test/java/org/elasticsearch/http/netty/NettyHttpChannelTests.java
View File

@ -178,7 +178,6 @@ public class NettyHttpChannelTests extends ESTestCase {
httpServerTransport = new NettyHttpServerTransport(settings, networkService, bigArrays, threadPool); httpServerTransport = new NettyHttpServerTransport(settings, networkService, bigArrays, threadPool);
HttpRequest httpRequest = new TestHttpRequest(); HttpRequest httpRequest = new TestHttpRequest();
httpRequest.headers().add(HttpHeaders.Names.ORIGIN, "remote"); httpRequest.headers().add(HttpHeaders.Names.ORIGIN, "remote");
httpRequest.headers().add(HttpHeaders.Names.USER_AGENT, "Mozilla fake");
WriteCapturingChannel writeCapturingChannel = new WriteCapturingChannel(); WriteCapturingChannel writeCapturingChannel = new WriteCapturingChannel();
NettyHttpRequest request = new NettyHttpRequest(httpRequest, writeCapturingChannel); NettyHttpRequest request = new NettyHttpRequest(httpRequest, writeCapturingChannel);
@ -205,7 +204,6 @@ public class NettyHttpChannelTests extends ESTestCase {
httpServerTransport = new NettyHttpServerTransport(settings, networkService, bigArrays, threadPool); httpServerTransport = new NettyHttpServerTransport(settings, networkService, bigArrays, threadPool);
HttpRequest httpRequest = new TestHttpRequest(); HttpRequest httpRequest = new TestHttpRequest();
httpRequest.headers().add(HttpHeaders.Names.ORIGIN, originValue); httpRequest.headers().add(HttpHeaders.Names.ORIGIN, originValue);
httpRequest.headers().add(HttpHeaders.Names.USER_AGENT, "Mozilla fake");
httpRequest.headers().add(HttpHeaders.Names.HOST, host); httpRequest.headers().add(HttpHeaders.Names.HOST, host);
WriteCapturingChannel writeCapturingChannel = new WriteCapturingChannel(); WriteCapturingChannel writeCapturingChannel = new WriteCapturingChannel();
NettyHttpRequest request = new NettyHttpRequest(httpRequest, writeCapturingChannel); NettyHttpRequest request = new NettyHttpRequest(httpRequest, writeCapturingChannel);