Fix for Proxy URL parameter vulnerability for 13.09

Fix for a vulnerability where client could access localhost resources via proxy url.

Added a permissions file so that the urls that are permitted to be proxied can be controlled.  By default all accesses to localhost (server localhost) are denied.

Also any protected services (extractorapp, geonetwork, etc...) are denied because they must be accessed using the path proxy strategy this way the spring security can add extra authorization checks.
Splitter would probably be good. This code is not new, it is just
refactored out of another method. "If its not broke don't fix it" :)


On Thu, Aug 21, 2014 at 10:56 AM, Pierre Mauduit <notifications@github.com>
wrote:

In security-proxy/src/main/java/org/georchestra/security/Proxy.java:

> +        return false;
> +    }
> +    private boolean isSameServer(HttpServletRequest request, URL url) throws UnknownHostException {
> +        return InetAddress.getByName(request.getServerName()).equals(InetAddress.getByName(url.getHost()));
> +    }
> +    private boolean samePathPrefix(String[] requestSegments, String target) throws MalformedURLException {
> +        String[] targetSegments = splitRequestPath(new URL(target).getPath());
> +        for (int i = 0; i < targetSegments.length; i++) {
> +            String targetSegment = targetSegments[i];
> +            if (!targetSegment.equals(requestSegments[i])) {
> +                return false;
> +            }
> +        }
> +        return true;
> +    }
> +    private String[] splitRequestPath(String requestURI) {


There seems to be some Splitter classes from Guava, but this method is also
fine for me


—
Reply to this email directly or view it on GitHub
<https://github.com/georchestra/georchestra/pull/743/files#r16527295>.