1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34 package info.magnolia.setup;
35
36 import info.magnolia.cms.filters.AddHeadersFilter;
37 import info.magnolia.cors.AbstractCorsFilter;
38 import info.magnolia.jcr.util.NodeUtil;
39 import info.magnolia.jcr.wrapper.JCRMgnlPropertiesFilteringNodeWrapper;
40 import info.magnolia.module.InstallContext;
41 import info.magnolia.module.delta.AbstractRepositoryTask;
42 import info.magnolia.module.delta.TaskExecutionException;
43
44 import javax.jcr.Node;
45 import javax.jcr.Property;
46 import javax.jcr.PropertyIterator;
47 import javax.jcr.RepositoryException;
48
49 import com.machinezoo.noexception.Exceptions;
50
51
52
53
54 public class WarnOnCorsAddedByAddHeadersFilter extends AbstractRepositoryTask {
55
56 private static final String WARN_MESSAGE = "A custom CORS configuration has been detected via the AddHeadersFilter. " +
57 "Please either disable or remove this configuration, and use the out-of-the-box Magnolia CORS configuration. For more information, see the CORS section on https://documentation.magnolia-cms.com/display/DOCS/Filters.";
58
59 public WarnOnCorsAddedByAddHeadersFilter() {
60 super("Warn on CORS filter configuration", "Warn if CORS filter configuration added using AddHeadersFilter is present");
61 }
62
63 @Override
64 protected void doExecute(final InstallContext installContext) throws RepositoryException, TaskExecutionException {
65 final Node filtersNode = installContext.getConfigJCRSession().getNode("/server/filters");
66 final boolean shouldWarn = NodeUtil.asList(NodeUtil.getNodes(filtersNode)).stream()
67 .filter(Exceptions.wrap().predicate(this::isAddHeadersFilter))
68 .filter(Exceptions.wrap().predicate(this::isFilterEnabled))
69 .anyMatch(Exceptions.wrap().predicate(this::hasCorsHeaders));
70 if (shouldWarn) {
71 installContext.warn(WARN_MESSAGE);
72 }
73 }
74
75 private boolean hasCorsHeaders(final Node node) throws RepositoryException {
76 if (node.hasNode("headers")) {
77 final PropertyIterator properties = new JCRMgnlPropertiesFilteringNodeWrapper(node.getNode("headers")).getProperties();
78 while (properties.hasNext()) {
79 final Property property = properties.nextProperty();
80 if (property.getName().equalsIgnoreCase(AbstractCorsFilter.Headers.ACCESS_CONTROL_ALLOW_ORIGIN.getName())) {
81 return true;
82 }
83 }
84 }
85 return false;
86 }
87
88 private boolean isAddHeadersFilter(final Node node) throws RepositoryException {
89 return node.hasProperty("class") && node.getProperty("class").getString().equals(AddHeadersFilter.class.getName());
90 }
91
92 private boolean isFilterEnabled(final Node node) throws RepositoryException {
93 return !node.hasProperty("enabled") || (node.hasProperty("enabled") && node.getProperty("enabled").getBoolean());
94 }
95 }