Skip to content

Commit 1c92afa

Browse files
LEDfanLEDfan
committed
Merge branch 'release/2.6.0'
2 parents a3248ad + d373645 commit 1c92afa

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+3289
-328
lines changed

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
/target/
22
/shinyproxy.log
33
/application.yml
4-
/.project
4+
/.project
5+
*.gz

‎Jenkinsfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ pipeline {
2020

2121
configFileProvider([configFile(fileId: 'maven-settings-rsb', variable: 'MAVEN_SETTINGS_RSB')]) {
2222

23-
sh 'mvn -s $MAVEN_SETTINGS_RSB -U clean deploy'
23+
sh 'mvn -B -s $MAVEN_SETTINGS_RSB -U clean deploy'
2424

2525
}
2626
}

‎owasp-suppression.xml

Lines changed: 62 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,80 +1,81 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3-
<suppress>
4-
<notes><![CDATA[
5-
file name: spring-security-ldap-5.3.4.RELEASE.jar
6-
]]></notes>
7-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-ldap@.*$</packageUrl>
8-
<cve>CVE-2018-1258</cve>
9-
</suppress>
10-
<suppress>
11-
<notes><![CDATA[
12-
file name: spring-security-core-5.3.4.RELEASE.jar
13-
]]></notes>
14-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-core@.*$</packageUrl>
15-
<cve>CVE-2018-1258</cve>
16-
</suppress>
17-
<suppress>
18-
<notes><![CDATA[
19-
file name: spring-security-jwt-1.1.1.RELEASE.jar
20-
]]></notes>
21-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-jwt@.*$</packageUrl>
22-
<cve>CVE-2018-1258</cve>
23-
</suppress>
3+
<!--
4+
https://nvd.nist.gov/vuln/detail/CVE-2018-1258
5+
Vulnerability only applies when using spring-framework 5.0.5 -> we are not using that version.
6+
-->
247
<suppress>
25-
<notes><![CDATA[
26-
file name: spring-security-oauth2-core-5.3.4.RELEASE.jar
27-
]]></notes>
28-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-oauth2\-core@.*$</packageUrl>
29-
<cve>CVE-2018-1258</cve>
8+
<!-- <notes><![CDATA[-->
9+
<!-- file name: spring-security-ldap-5.3.9.RELEASE.jar-->
10+
<!-- ]]></notes>-->
11+
<!-- <packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-ldap@.*$</packageUrl>-->
12+
<cve>CVE-2018-1258</cve>
3013
</suppress>
14+
15+
<!--
16+
https://nvd.nist.gov/vuln/detail/CVE-2021-22112
17+
Only applies if using Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE,
18+
we are using 5.3.9.
19+
-->
3120
<suppress>
32-
<notes><![CDATA[
33-
file name: spring-security-core-5.3.4.RELEASE.jar
34-
]]></notes>
35-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-core@.*$</packageUrl>
36-
<cve>CVE-2018-1258</cve>
21+
<notes><![CDATA[
22+
file name: spring-security-jwt-1.1.1.RELEASE.jar
23+
]]></notes>
24+
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-jwt@.*$</packageUrl>
25+
<cve>CVE-2021-22112</cve>
3726
</suppress>
27+
28+
<!--
29+
https://nvd.nist.gov/vuln/detail/CVE-2020-14359
30+
Only applies to Keycloak-gatekeeper not the keycloak libraries.
31+
-->
3832
<suppress>
39-
<notes><![CDATA[
40-
file name: spring-security-jwt-1.1.1.RELEASE.jar
41-
]]></notes>
42-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-jwt@.*$</packageUrl>
43-
<cve>CVE-2018-1258</cve>
33+
<cve>CVE-2020-14359</cve>
4434
</suppress>
35+
36+
37+
<!--
38+
https://nvd.nist.gov/vuln/detail/CVE-2020-8908
39+
Only applies if using com.google.common.io.Files.createTempDir().
40+
We are not using this function directly. We are dependent on our library to remove the usage of this method.
41+
(the method is not fixed/removed from Guava so updating has no influence)
42+
-->
4543
<suppress>
46-
<notes><![CDATA[
47-
file name: spring-security-oauth2-core-5.3.4.RELEASE.jar
48-
]]></notes>
49-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-oauth2\-core@.*$</packageUrl>
50-
<cve>CVE-2018-1258</cve>
44+
<cve>CVE-2020-8908</cve>
5145
</suppress>
46+
47+
<!--
48+
https://nvd.nist.gov/vuln/detail/CVE-2020-8554
49+
Only applies to Kubernetes API server not the kubernetes libraries.
50+
-->
5251
<suppress>
53-
<notes><![CDATA[
54-
file name: spring-security-web-5.3.4.RELEASE.jar
55-
]]></notes>
56-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-web@.*$</packageUrl>
57-
<cve>CVE-2018-1258</cve>
52+
<cve>CVE-2020-8554</cve>
5853
</suppress>
54+
55+
56+
<!--
57+
Only applies to the official Kubernetes Java client, not the client from fabric8io we are using.
58+
-->
5959
<suppress>
60-
<notes><![CDATA[
61-
file name: spring-security-oauth2-jose-5.3.4.RELEASE.jar
62-
]]></notes>
63-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-oauth2\-jose@.*$</packageUrl>
64-
<cve>CVE-2018-1258</cve>
60+
<cve>CVE-2020-8570</cve>
6561
</suppress>
62+
63+
64+
<!--
65+
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
66+
Only applies to Apache Commons IO before 2.7, but we are using 2.7. (however somewhere this version is referred).
67+
-->
6668
<suppress>
67-
<notes><![CDATA[
68-
file name: spring-security-oauth2-client-5.3.4.RELEASE.jar
69-
]]></notes>
70-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-oauth2\-client@.*$</packageUrl>
71-
<cve>CVE-2018-1258</cve>
69+
<sha1>7e39112810f6096061c43504188d18edc7d7eece</sha1>
70+
<cve>CVE-2021-29425</cve>
7271
</suppress>
72+
73+
74+
<!--
75+
https://tanzu.vmware.com/security/cve-2015-5258
76+
Only applies to springframework-social before 1.1.3, but we are using 1.1.6 (however somewhere this version is referred).
77+
-->
7378
<suppress>
74-
<notes><![CDATA[
75-
file name: spring-security-config-5.3.4.RELEASE.jar
76-
]]></notes>
77-
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-config@.*$</packageUrl>
78-
<cve>CVE-2018-1258</cve>
79+
<cve>CVE-2015-5258</cve>
7980
</suppress>
8081
</suppressions>

‎pom.xml

Lines changed: 47 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
<groupId>eu.openanalytics</groupId>
77
<artifactId>shinyproxy</artifactId>
8-
<version>2.5.1</version>
8+
<version>2.6.0</version>
99
<packaging>jar</packaging>
1010

1111
<name>ShinyProxy</name>
@@ -19,14 +19,14 @@
1919
<parent>
2020
<groupId>org.springframework.boot</groupId>
2121
<artifactId>spring-boot-starter-parent</artifactId>
22-
<version>2.3.4.RELEASE</version>
22+
<version>2.3.12.RELEASE</version>
2323
<relativePath />
2424
</parent>
2525

2626
<properties>
2727
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
2828
<java.version>1.8</java.version>
29-
<containerproxy.version>0.8.9</containerproxy.version>
29+
<containerproxy.version>0.8.10</containerproxy.version>
3030
<resource.delimiter>&amp;</resource.delimiter>
3131
</properties>
3232

@@ -83,9 +83,51 @@
8383
<artifactId>js-cookie</artifactId>
8484
<version>2.2.1</version>
8585
</dependency>
86+
<dependency>
87+
<groupId>org.webjars</groupId>
88+
<artifactId>handlebars</artifactId>
89+
<version>4.7.6</version>
90+
</dependency>
91+
<dependency>
92+
<groupId>io.undertow</groupId>
93+
<artifactId>undertow-core</artifactId>
94+
<version>2.2.8.Final</version>
95+
</dependency>
96+
<dependency>
97+
<groupId>io.undertow</groupId>
98+
<artifactId>undertow-servlet</artifactId>
99+
<version>2.2.8.Final</version>
100+
</dependency>
101+
<dependency>
102+
<groupId>io.undertow</groupId>
103+
<artifactId>undertow-websockets-jsr</artifactId>
104+
<version>2.2.8.Final</version>
105+
</dependency>
106+
<dependency>
107+
<groupId>org.jboss.xnio</groupId>
108+
<artifactId>xnio-nio</artifactId>
109+
<version>3.8.4.Final</version>
110+
</dependency>
111+
<dependency>
112+
<groupId>org.jboss.xnio</groupId>
113+
<artifactId>xnio-api</artifactId>
114+
<version>3.8.4.Final</version>
115+
</dependency>
86116
</dependencies>
87117

88118
<build>
119+
<resources>
120+
<resource>
121+
<directory>src/main/resources</directory>
122+
<excludes>
123+
<exclude>static/handlebars/node_modules/**</exclude>
124+
<exclude>static/handlebars/.gitignore</exclude>
125+
<exclude>static/handlebars/generate.sh</exclude>
126+
<exclude>static/handlebars/*.handlebars</exclude>
127+
<exclude>**/.gitignore</exclude>
128+
</excludes>
129+
</resource>
130+
</resources>
89131
<plugins>
90132
<plugin>
91133
<groupId>org.springframework.boot</groupId>
@@ -307,7 +349,7 @@
307349
<exclude>.gitignore</exclude>
308350
<exclude>src/deb/**</exclude>
309351
<exclude>templates/**</exclude>
310-
<exclude>src/main/resources/static/js/js.cookie-2.2.1.min.js</exclude>
352+
<exclude>src/main/resources/static/handlebars/node_modules/**</exclude>
311353
</excludes>
312354
</configuration>
313355
<executions>
@@ -380,7 +422,7 @@
380422
<plugin>
381423
<groupId>org.owasp</groupId>
382424
<artifactId>dependency-check-maven</artifactId>
383-
<version>5.3.0</version>
425+
<version>6.1.6</version>
384426
<configuration>
385427
<suppressionFiles>
386428
<suppressionFile>owasp-suppression.xml</suppressionFile>

‎src/main/java/eu/openanalytics/shinyproxy/AppRequestInfo.java

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
/**
2+
* ShinyProxy
3+
*
4+
* Copyright (C) 2016-2021 Open Analytics
5+
*
6+
* ===========================================================================
7+
*
8+
* This program is free software: you can redistribute it and/or modify
9+
* it under the terms of the Apache License as published by
10+
* The Apache Software Foundation, either version 2 of the License, or
11+
* (at your option) any later version.
12+
*
13+
* This program is distributed in the hope that it will be useful,
14+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
* Apache License for more details.
17+
*
18+
* You should have received a copy of the Apache License
19+
* along with this program. If not, see <http://www.apache.org/licenses/>
20+
*/
21+
package eu.openanalytics.shinyproxy;
22+
23+
import eu.openanalytics.containerproxy.util.BadRequestException;
24+
25+
import javax.servlet.http.HttpServletRequest;
26+
import java.util.regex.Matcher;
27+
import java.util.regex.Pattern;
28+
29+
public class AppRequestInfo {
30+
31+
private static final Pattern APP_INSTANCE_PATTERN = Pattern.compile(".*?/(app_i|app_direct_i)/([^/]*)/([^/]*)(/?.*)");
32+
private static final Pattern APP_PATTERN = Pattern.compile(".*?/(app|app_direct)/([^/]*)(/?.*)");
33+
private static final Pattern INSTANCE_NAME_PATTERN = Pattern.compile("^[a-zA-Z0-9_.-]*$");
34+
35+
private final String appName;
36+
private final String appInstance;
37+
private final String subPath;
38+
39+
public AppRequestInfo(String appName, String appInstance, String subPath) {
40+
this.appName = appName;
41+
this.appInstance = appInstance;
42+
this.subPath = subPath;
43+
}
44+
45+
public static AppRequestInfo fromRequestOrException(HttpServletRequest request) {
46+
AppRequestInfo result = fromURI(request.getRequestURI());
47+
if (result == null) {
48+
throw new BadRequestException("Error parsing URL.");
49+
}
50+
return result;
51+
}
52+
53+
public static AppRequestInfo fromURI(String uri) {
54+
Matcher appMatcher = APP_PATTERN.matcher(uri);
55+
Matcher appInstanceMatcher = APP_INSTANCE_PATTERN.matcher(uri);
56+
if (appInstanceMatcher.matches()) {
57+
String appName = appInstanceMatcher.group(2);
58+
if (appName == null || appName.trim().equals("")) {
59+
throw new BadRequestException("Error parsing URL: name of app not found in URL.");
60+
}
61+
62+
String appInstance = appInstanceMatcher.group(3);
63+
if (appInstance == null || appInstance.trim().equals("")) {
64+
throw new BadRequestException("Error parsing URL: name of instance not found in URL.");
65+
}
66+
67+
if (appInstance.length() > 64 || !INSTANCE_NAME_PATTERN.matcher(appInstance).matches()) {
68+
throw new BadRequestException("Error parsing URL: name of instance contains invalid characters or is too long.");
69+
}
70+
71+
String subPath = appInstanceMatcher.group(4);
72+
if (subPath == null || subPath.trim().equals("")) {
73+
subPath = null;
74+
} else {
75+
subPath = subPath.trim();
76+
}
77+
78+
return new AppRequestInfo(appName, appInstance, subPath);
79+
} else if (appMatcher.matches()) {
80+
String appName = appMatcher.group(2);
81+
if (appName == null || appName.trim().equals("")) {
82+
throw new BadRequestException("Error parsing URL: name of app not found in URL.");
83+
}
84+
85+
String appInstance = "_";
86+
87+
String subPath = appMatcher.group(3);
88+
if (subPath == null || subPath.trim().equals("")) {
89+
subPath = null;
90+
} else {
91+
subPath = subPath.trim();
92+
}
93+
94+
return new AppRequestInfo(appName, appInstance, subPath);
95+
} else {
96+
return null;
97+
}
98+
}
99+
100+
public String getAppInstance() {
101+
return appInstance;
102+
}
103+
104+
public String getAppInstanceDisplayName() {
105+
if (appInstance.equals("_")) {
106+
return "Default";
107+
}
108+
return appInstance;
109+
}
110+
111+
public String getAppName() {
112+
return appName;
113+
}
114+
115+
public String getSubPath() {
116+
return subPath;
117+
}
118+
}

0 commit comments

Comments
 (0)