1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34 package info.magnolia.cms.filters;
35
36 import info.magnolia.cms.beans.config.MIMEMapping;
37 import info.magnolia.cms.beans.config.ServerConfiguration;
38 import info.magnolia.cms.core.AggregationState;
39 import info.magnolia.cms.util.ServletUtil;
40 import info.magnolia.context.MgnlContext;
41 import info.magnolia.util.EscapeUtil;
42
43 import java.io.IOException;
44 import java.io.UnsupportedEncodingException;
45 import java.net.URI;
46 import java.net.URLDecoder;
47
48 import javax.inject.Inject;
49 import javax.servlet.FilterChain;
50 import javax.servlet.ServletException;
51 import javax.servlet.http.HttpServletRequest;
52 import javax.servlet.http.HttpServletResponse;
53
54 import org.apache.commons.lang3.StringUtils;
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70 public class ContentTypeFilter extends AbstractMgnlFilter {
71
72 private static final org.slf4j.Logger log = org.slf4j.LoggerFactory.getLogger(ContentTypeFilter.class);
73
74 private boolean sanitizeXssUri = true;
75
76
77
78
79 private static final String AGGREGATION_STATE_INITIALIZED = ContentTypeFilter.class.getName() + ".aggregationStateInitialized";
80
81 private boolean registeredExtensionsOnly = false;
82
83 private ServerConfiguration serverConfiguration;
84
85
86
87
88 @Deprecated
89 public ContentTypeFilter() {
90 }
91
92 @Inject
93 public ContentTypeFilter(ServerConfiguration serverConfiguration) {
94 this.serverConfiguration = serverConfiguration;
95 }
96
97
98 @Override
99 public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
100
101
102
103 if (request.getAttribute(AGGREGATION_STATE_INITIALIZED) != null) {
104 MgnlContext.resetAggregationState();
105 } else {
106 request.setAttribute(AGGREGATION_STATE_INITIALIZED, Boolean.TRUE);
107 }
108
109 final String originalUri = ServletUtil.getOriginalRequestURI(request);
110 final String originalUrl = ServletUtil.getOriginalRequestURLIncludingQueryString(request);
111 final String extension = getUriExtension(originalUri);
112 final String mimeType = setupContentType(extension, response);
113 if (isRegisteredExtensionsOnly() && mimeType == null && !response.isCommitted()) {
114 response.sendError(HttpServletResponse.SC_BAD_REQUEST, String.format("Unsupported extension=%1$s.", extension));
115 return;
116 }
117 final String characterEncoding = setupCharacterEncoding(mimeType, request, response);
118 final AggregationState aggregationState = MgnlContext.getAggregationState();
119 aggregationState.setCharacterEncoding(characterEncoding);
120
121 final String decodedOriginalUri = decodeUri(originalUri, characterEncoding);
122 aggregationState.setOriginalURI(decodedOriginalUri);
123
124 try {
125 final String decodedOriginalUrl = decodeUri(originalUrl, characterEncoding);
126 aggregationState.setOriginalURL(decodedOriginalUrl);
127 } catch (IllegalArgumentException e) {
128
129 if (!response.isCommitted()) {
130 response.sendError(HttpServletResponse.SC_BAD_REQUEST, "URL is malformed (not encoded properly).");
131 }
132
133 return;
134 }
135 aggregationState.setOriginalBrowserURI(originalUri);
136 aggregationState.setOriginalBrowserURL(originalUrl);
137 final String requestURI = URI.create(ServletUtil.getRequestUri(request)).normalize().getRawPath();
138 final String currentURI = decodeUri(requestURI, characterEncoding);
139 aggregationState.setCurrentURI(currentURI);
140 aggregationState.setExtension(extension);
141 aggregationState.setQueryString(request.getQueryString());
142
143 chain.doFilter(request, response);
144 }
145
146 protected String getUriExtension(String uri) {
147 final String fileName = StringUtils.substringAfterLast(uri, "/");
148 return StringUtils.substringAfterLast(fileName, ".");
149 }
150
151 protected String setupContentType(String extension, HttpServletResponse response) {
152 final String mimeType;
153
154 if (isRegisteredExtensionsOnly()) {
155 if (StringUtils.isBlank(extension)) {
156 extension = serverConfiguration.getDefaultExtension();
157 if (StringUtils.isBlank(extension)) {
158 extension = MIMEMapping.DEFAULT_EXTENSION;
159 }
160 }
161 mimeType = MIMEMapping.getMIMEType(extension);
162 if (mimeType == null) {
163 return null;
164 }
165 } else {
166 mimeType = MIMEMapping.getMIMETypeOrDefault(extension);
167 }
168
169 response.setContentType(mimeType);
170
171 return mimeType;
172 }
173
174 protected String setupCharacterEncoding(String mimeType, HttpServletRequest request, HttpServletResponse response) {
175 final String characterEncoding = MIMEMapping.getContentEncodingOrDefault(mimeType);
176
177 try {
178
179 if (request.getCharacterEncoding() == null) {
180 request.setCharacterEncoding(characterEncoding);
181 }
182 } catch (UnsupportedEncodingException e) {
183 log.error("Can't set character encoding for the request (mimetype={})", mimeType, e);
184 }
185
186 response.setCharacterEncoding(characterEncoding);
187
188 return characterEncoding;
189 }
190
191
192
193
194
195
196 private String sanitizeXss(String uri) {
197 final String afterLastDot = StringUtils.substringAfterLast(uri, ".");
198 if (StringUtils.isNotEmpty(afterLastDot)) {
199 final String xssEscapedAfterLastDot = EscapeUtil.escapeXss(afterLastDot);
200 final String sanitizedXssUri = StringUtils.removeEnd(uri, afterLastDot).concat(xssEscapedAfterLastDot);
201 return sanitizedXssUri;
202 }
203
204 return uri;
205 }
206
207
208
209
210 private String decodeUri(String uri, String characterEncoding) throws UnsupportedEncodingException {
211 final String decodedUri = URLDecoder.decode(uri, characterEncoding);
212 return isSanitizeXssUri() ? sanitizeXss(decodedUri) : decodedUri;
213 }
214
215 public boolean isSanitizeXssUri() {
216 return sanitizeXssUri;
217 }
218
219 public void setSanitizeXssUri(boolean sanitizeXssUri) {
220 this.sanitizeXssUri = sanitizeXssUri;
221 }
222
223 public boolean isRegisteredExtensionsOnly() {
224 return registeredExtensionsOnly;
225 }
226
227 public void setRegisteredExtensionsOnly(boolean registeredExtensionsOnly) {
228 this.registeredExtensionsOnly = registeredExtensionsOnly;
229 }
230
231
232
233
234 @Deprecated
235 protected String setupContentTypeAndCharacterEncoding(String extension, HttpServletRequest request, HttpServletResponse response) {
236 final String mimeType = setupContentType(extension, response);
237 return setupCharacterEncoding(mimeType, request, response);
238 }
239 }