Skip to content

Commit 1c1849d

Browse files
author
Tobias Richter
committed
Merge branch 'develop'
2 parents 246f5c0 + fa1b80d commit 1c1849d

File tree

10 files changed

+99
-40
lines changed

10 files changed

+99
-40
lines changed

‎changes.xml

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,17 +23,32 @@
2323
xsi:schemaLocation="http://maven.apache.org/changes/1.0.0 http://maven.apache.org/plugins/maven-changes-plugin/xsd/changes-1.0.0.xsd">
2424
<body>
2525

26+
<release version="1.15.0" date="2023-03-17">
27+
<action type="add" dev="trichter" issue="88">
28+
Role aem-dispatcher-cloud: Introduce httpd.rewrites (ported from aem-dispatcher-ams role).
29+
</action>
30+
<action type="add" dev="trichter" issue="87">
31+
Role aem-dispatcher-cloud: Introduce httpd.rewriteIncludes (ported from aem-dispatcher-ams role).
32+
</action>
33+
<action type="add" dev="trichter" issue="86">
34+
Role aem-dispatcher-cloud: Introduce httpd.generateAvailableVhost and httpd.generateEnabledVhost to control vhost generation.
35+
</action>
36+
<action type="fix" dev="trichter" issue="85">
37+
Role aem-dispatcher, aem-dispatcher-ams, aem-dispatcher-cloud: Revert #83, move "security-related" deny rules back to dispatcher.filter.
38+
</action>
39+
</release>
40+
2641
<release version="1.14.0" date="2023-01-12">
27-
<action type="add" dev="trichter">
42+
<action type="add" dev="trichter" issue="83">
2843
Role aem-dispatcher, aem-dispatcher-ams, aem-dispatcher-cloud: Introduce dispatcher.filterAppend filter list.
2944
</action>
30-
<action type="add" dev="trichter">
45+
<action type="add" dev="trichter" issue="84">
3146
Role aem-dispatcher, aem-dispatcher-ams, aem-dispatcher-cloud: Block form selector with a non-empty suffix on all URLs in order to fix form validator bypass issue.
3247
</action>
33-
<action type="update" dev="trichter">
48+
<action type="update" dev="trichter" issue="83">
3449
Role aem-dispatcher, aem-dispatcher-ams, aem-dispatcher-cloud: Move "security-related" existing deny rules e.g. to prevent content grabbing to dispatcher.filterAppend filter list.
3550
</action>
36-
<action type="update" dev="nbellack">
51+
<action type="update" dev="nbellack" issue="82">
3752
Role aem-dispatcher-cloud: Sync with default dispatcher configuration from Adobe project archetype 36 to 39.
3853
</action>
3954
<action type="update" dev="sseifert">

‎conga-aem-definitions/pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,13 @@
2525
<parent>
2626
<groupId>io.wcm.devops.conga.definitions</groupId>
2727
<artifactId>io.wcm.devops.conga.definitions.aem.parent</artifactId>
28-
<version>1.14.0</version>
28+
<version>1.15.0</version>
2929
<relativePath>../parent/pom.xml</relativePath>
3030
</parent>
3131

3232
<groupId>io.wcm.devops.conga.definitions</groupId>
3333
<artifactId>io.wcm.devops.conga.definitions.aem</artifactId>
34-
<version>1.14.0</version>
34+
<version>1.15.0</version>
3535
<packaging>config-definition</packaging>
3636

3737
<name>CONGA AEM Definitions</name>

‎conga-aem-definitions/src/main/roles/aem-dispatcher-ams.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -75,12 +75,6 @@ variants:
7575
- url: /libs/cq/personalization(/.*)?
7676
method: "GET"
7777
type: allow
78-
# Allow current user [from default_filters.any]
79-
- url: /libs/granite/security/currentuser.json
80-
type: allow
81-
82-
# list of filters that will be appended after the "normal" filter list to ensure denied content is not accidentally allowed again by other selectors
83-
filterAppend:
8478
# Deny content grabbing for greedy queries and prevent un-intended self DOS attacks [from default_filters.any]
8579
- selectors: (feed|rss|pages|languages|blueprint|infinity|tidy|sysview|docview|query|[0-9-]+|jcr:content)
8680
extension: (json|xml|html|feed)
@@ -90,6 +84,9 @@ variants:
9084
type: deny
9185
- query: wcmmode=.*
9286
type: deny
87+
# Allow current user [from default_filters.any]
88+
- url: /libs/granite/security/currentuser.json
89+
type: allow
9390
# Deny content grabbing for /content - additional selectors not included in default dispatcher.any
9491
- path: /content(/.*)?
9592
selectors: (ambits|assetsearch|assignments|childrenlist|cloudservices|contentfinder|context|emailservice|exacttarget|ext|form|media|missingpages|mobileapps|pages|paragraphs|payloadsummary|permissions|publications|referencelist|savedsearch|skippedpages|search|social|style|tags|tagtree|timezones)
@@ -106,6 +103,9 @@ variants:
106103
- path: /content(/.*)?
107104
selectors: (overlay)
108105
type: deny
106+
107+
# list of filters that will be appended after the "normal" filter list to ensure denied content is not accidentally allowed again by other selectors
108+
filterAppend:
109109
# block form validator bypass
110110
- url: '/.*'
111111
selectors: "(form)"

‎conga-aem-definitions/src/main/roles/aem-dispatcher-cloud.yaml

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,15 @@ variants:
7878
- url: /libs/cq/personalization(/.*)?
7979
method: GET
8080
type: allow
81+
# Deny content grabbing for greedy queries and prevent un-intended self DOS attacks [from default_filters.any]
82+
- selectors: (feed|rss|pages|languages|blueprint|infinity|tidy|sysview|docview|query|[0-9-]+|jcr:content)
83+
extension: (json|xml|html|feed)
84+
type: deny
85+
# Deny authoring query params [from default_filters.any]
86+
- query: debug=.*
87+
type: deny
88+
- query: wcmmode=.*
89+
type: deny
8190
# Allow current user [from default_filters.any]
8291
- url: /libs/granite/security/currentuser.json
8392
type: allow
@@ -96,18 +105,6 @@ variants:
96105
- url: /graphql/execute.json*
97106
method: (GET|POST|OPTIONS)
98107
type: allow
99-
100-
# list of filters that will be appended after the "normal" filter list to ensure denied content is not accidentally allowed again by other selectors
101-
filterAppend:
102-
# Deny content grabbing for greedy queries and prevent un-intended self DOS attacks [from default_filters.any]
103-
- selectors: (feed|rss|pages|languages|blueprint|infinity|tidy|sysview|docview|query|[0-9-]+|jcr:content)
104-
extension: (json|xml|html|feed)
105-
type: deny
106-
# Deny authoring query params [from default_filters.any]
107-
- query: debug=.*
108-
type: deny
109-
- query: wcmmode=.*
110-
type: deny
111108
# Deny content grabbing for /content - additional selectors not included in default dispatcher.any
112109
- path: /content(/.*)?
113110
selectors: (ambits|assetsearch|assignments|childrenlist|cloudservices|contentfinder|context|emailservice|exacttarget|ext|form|media|missingpages|mobileapps|pages|paragraphs|payloadsummary|permissions|publications|referencelist|savedsearch|skippedpages|search|social|style|tags|tagtree|timezones)
@@ -124,6 +121,9 @@ variants:
124121
- path: /content(/.*)?
125122
selectors: (overlay)
126123
type: deny
124+
125+
# list of filters that will be appended after the "normal" filter list to ensure denied content is not accidentally allowed again by other selectors
126+
filterAppend:
127127
# block form validator bypass
128128
- url: '/.*'
129129
selectors: "(form)"
@@ -169,6 +169,7 @@ files:
169169
template: conf.d/available_vhosts/tenant.vhost.hbs
170170
multiply: tenant
171171
fileHeader: conf
172+
condition: ${httpd.generateAvailableVhost}
172173

173174
# enabled vhosts
174175
- file: ${new('java.text.DecimalFormat','0000').format(multiplyIndex)}_${tenant}.vhost
@@ -177,6 +178,7 @@ files:
177178
variants:
178179
- aem-publish
179180
multiply: tenant
181+
condition: ${httpd.generateEnabledVhost}
180182

181183
# global rewrite rules
182184
- file: rewrite.rules
@@ -357,6 +359,17 @@ config:
357359
# Set the default experiation time for text/html responses (enabled by default in AEM Cloud Service webserver)
358360
htmlExpirationTimeMin: 5
359361

362+
# List of rewrite rules to include in the vhost
363+
rewriteIncludes:
364+
- conf.d/rewrites/rewrite.rules
365+
366+
# These rewrite rules are evaluated before the mapping rules
367+
# rewrites:
368+
# - rule: ^/crx/(.*)$ - [R=404,L]
369+
# - conditions:
370+
# - '%{REQUEST_URI} !^/system/sling/logout(.*)$'
371+
# rule: ^/system/(.*)$ - [R=404,L]
372+
360373
# Request URI patterns for Sling maping short URL configuration
361374
mapping:
362375
uriExcludeFromMapping:
@@ -385,6 +398,12 @@ config:
385398
# Placed at the bottom of the vhost confign file
386399
after:
387400

401+
# Controls the generation of available_vhosts files
402+
generateAvailableVhost: true
403+
404+
# Controls the generation of enabled_vhosts files
405+
generateEnabledVhost: true
406+
388407
# Allows to define different server names/alias names per environment in a single dispatcher configuration
389408
#cloudManagerConditional:
390409
# targetEnvironment: # to be substituted with e.g. "dev"

‎conga-aem-definitions/src/main/roles/aem-dispatcher.yaml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,6 @@ variants:
5353
# Enable features [from default dispatcher.any]
5454
- url: /libs/cq/personalization(/.*)?
5555
type: allow
56-
# Allow access to client libraries and designs at /etc
57-
- url: (/etc/clientlibs|/etc.clientlibs|/etc/designs/.*/clientlibs)(/.*)?
58-
type: allow
59-
# open consoles (access is controlled in httpd config)
60-
- url: /(admin|crx|system)(/.*)?
61-
type: allow
62-
63-
# list of filters that will be appended after the "normal" filter list to ensure denied content is not accidentally allowed again by other selectors
64-
filterAppend:
6556
# Deny content grabbing, on all accessible pages [from default dispatcher.any]
6657
- selectors: ((sys|doc)view|query|[0-9-]+)
6758
extension: (json|xml)
@@ -87,6 +78,15 @@ variants:
8778
- path: /content(/.*)?
8879
selectors: (overlay)
8980
type: deny
81+
# Allow access to client libraries and designs at /etc
82+
- url: (/etc/clientlibs|/etc.clientlibs|/etc/designs/.*/clientlibs)(/.*)?
83+
type: allow
84+
# open consoles (access is controlled in httpd config)
85+
- url: /(admin|crx|system)(/.*)?
86+
type: allow
87+
88+
# list of filters that will be appended after the "normal" filter list to ensure denied content is not accidentally allowed again by other selectors
89+
filterAppend:
9090
# block form validator bypass
9191
- url: '/.*'
9292
selectors: "(form)"

‎conga-aem-definitions/src/main/templates/aem-dispatcher-cloud/conf.d/available_vhosts/tenant.vhost.partials.hbs

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,9 @@ AllowEncodedSlashes NoDecode
7373
</IfModule>
7474
<IfModule mod_rewrite.c>
7575
RewriteEngine on
76-
Include conf.d/rewrites/rewrite.rules
76+
{{~#each httpd.rewriteIncludes}}
77+
Include {{ this }}
78+
{{~/each}}
7779
</IfModule>
7880

7981
# Do not allow RFC 2616 trace requests
@@ -171,6 +173,17 @@ Header set X-XSS-Protection "{{httpd.headers.xssProtection}}"
171173
{{~/if}}
172174
{{/block}}
173175

176+
{{~#block "rewrites"}}
177+
{{~#if httpd.rewrites}}
178+
# Rewrites
179+
{{~#each httpd.rewrites}}
180+
{{~#each this.conditions}}
181+
RewriteCond {{this}}
182+
{{~/each}}
183+
RewriteRule {{this.rule}}
184+
{{~/each}}
185+
{{/if ~}}
186+
{{/block}}
174187

175188
{{~#block "rewriteSlingShortUrlMapping"}}
176189
{{~#if sling.mapping.rootPath}}

‎example/pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
<groupId>io.wcm.devops.conga.definitions</groupId>
3333
<artifactId>io.wcm.devops.conga.definitions.aem.example</artifactId>
3434
<packaging>config</packaging>
35-
<version>1.14.0</version>
35+
<version>1.15.0</version>
3636

3737
<name>CONGA AEM Definitions Example</name>
3838
<description>Example environment definition.</description>
@@ -43,7 +43,7 @@
4343
<dependency>
4444
<groupId>io.wcm.devops.conga.definitions</groupId>
4545
<artifactId>io.wcm.devops.conga.definitions.aem</artifactId>
46-
<version>1.14.0</version>
46+
<version>1.15.0</version>
4747
</dependency>
4848

4949
</dependencies>

‎example/src/main/environments/test.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,11 +310,15 @@ tenants:
310310
prod:
311311
serverName: www.prod-sample3.com
312312
rootRedirect.url: /en.html
313+
rewrites:
314+
- rule: ^/subpage/?$ /subpage.html [NC,R=301,L]
313315
sling.mapping.rootPath: /content/sample3
314316

315317
- tenant: cloud-sample4.com
316318
config:
317319
httpd:
320+
generateEnabledVhost: false
321+
generateAvailableVhost: false
318322
cloudManagerConditional:
319323
dev:
320324
serverName: www.dev-sample4.com
@@ -326,6 +330,9 @@ tenants:
326330
prod:
327331
serverName: www.prod-sample4.com
328332
rootRedirect.url: /content/sample4/en.html
333+
rewriteIncludes:
334+
- _merge_
335+
- conf.d/rewrites/additional_rewrite.rules
329336

330337
- tenant: ams-sample5.com
331338
config:

‎parent/pom.xml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131

3232
<groupId>io.wcm.devops.conga.definitions</groupId>
3333
<artifactId>io.wcm.devops.conga.definitions.aem.parent</artifactId>
34-
<version>1.14.0</version>
34+
<version>1.15.0</version>
3535
<packaging>pom</packaging>
3636

3737
<name>CONGA AEM Definitions</name>
@@ -40,7 +40,12 @@
4040
<system>GitHub Actions</system>
4141
<url>https://github.com/wcm-io-devops/conga-aem-definitions/actions</url>
4242
</ciManagement>
43-
43+
44+
<issueManagement>
45+
<system>GitHub</system>
46+
<url>https://github.com/wcm-io-devops/conga-aem-definitions/issues/</url>
47+
</issueManagement>
48+
4449
<build>
4550
<plugins>
4651

‎pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@
2323
<parent>
2424
<groupId>io.wcm.devops.conga.definitions</groupId>
2525
<artifactId>io.wcm.devops.conga.definitions.aem.parent</artifactId>
26-
<version>1.14.0</version>
26+
<version>1.15.0</version>
2727
<relativePath>parent/pom.xml</relativePath>
2828
</parent>
2929

3030
<groupId>io.wcm.devops.conga.definitions</groupId>
3131
<artifactId>io.wcm.devops.conga.definitions.aem.root</artifactId>
32-
<version>1.14.0</version>
32+
<version>1.15.0</version>
3333
<packaging>pom</packaging>
3434

3535
<name>CONGA AEM Definitions</name>

0 commit comments

Comments
 (0)