-
Notifications
You must be signed in to change notification settings - Fork 31
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Administrator should limit which URLs can Webhooks (especially test ones) hit by defining a list of allowed URL prefixes.
- Loading branch information
Showing
17 changed files
with
624 additions
and
203 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| package io.hyperfoil.tools.horreum.api; | ||
|
|
||
| class Util { | ||
| static String destringify(String str) { | ||
| if (str == null || str.isEmpty()) { | ||
| return str; | ||
| } | ||
| if (str.charAt(0) == '"' && str.charAt(str.length() - 1) == '"') { | ||
| return str.substring(1, str.length() - 1); | ||
| } else { | ||
| return str; | ||
| } | ||
| } | ||
| } |
18 changes: 18 additions & 0 deletions
18
src/main/java/io/hyperfoil/tools/horreum/entity/json/AllowedHookPrefix.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| package io.hyperfoil.tools.horreum.entity.json; | ||
|
|
||
| import javax.persistence.Entity; | ||
| import javax.persistence.GeneratedValue; | ||
| import javax.persistence.Id; | ||
| import javax.validation.constraints.NotNull; | ||
|
|
||
| import io.quarkus.hibernate.orm.panache.PanacheEntityBase; | ||
|
|
||
| @Entity(name = "allowedhookprefix") | ||
| public class AllowedHookPrefix extends PanacheEntityBase { | ||
| @Id | ||
| @GeneratedValue | ||
| public Long id; | ||
|
|
||
| @NotNull | ||
| public String prefix; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| import React, { useEffect, useState, MutableRefObject } from 'react' | ||
| import { useDispatch } from 'react-redux' | ||
|
|
||
| import { | ||
| Dropdown, | ||
| DropdownItem, | ||
| DropdownToggle, | ||
| FormGroup, | ||
| InputGroup, | ||
| TextInput, | ||
| } from '@patternfly/react-core'; | ||
|
|
||
| import { AllowedHookPrefix } from '../domain/hooks/reducers'; | ||
| import { fetchPrefixes } from '../domain/hooks/api' | ||
|
|
||
| import { alertAction } from '../alerts' | ||
|
|
||
| function isValidUrl(url: string) { | ||
| try { | ||
| new URL(url); | ||
| return true; | ||
| } catch (_) { | ||
| return false; | ||
| } | ||
| } | ||
|
|
||
| type HookUrlSelectorProps = { | ||
| active: boolean, | ||
| value: string, | ||
| setValue(value: string): void, | ||
| isDisabled?: boolean, | ||
| isReadOnly?: boolean, | ||
| setValid?(valid: boolean): void, | ||
| extraCheck?(value: string): string | boolean | ||
| } | ||
|
|
||
| function HookUrlSelector(props: HookUrlSelectorProps) { | ||
| const dispatch = useDispatch(); | ||
| const [prefixes, setPrefixes] = useState<AllowedHookPrefix[]>([{ id: -1, prefix: ""}]) | ||
| useEffect(() => { | ||
| if (props.active) { | ||
| fetchPrefixes().then(setPrefixes, | ||
| e => dispatch(alertAction('FETCH_HOOK_PREFIXES', "Failed to fetch allowed hook prefixes", e))) | ||
| } | ||
| }, [dispatch, props.active]) | ||
|
|
||
| const isUrlValid = isValidUrl(props.value) | ||
| const isUrlAllowed = prefixes.some(p => props.value.startsWith(p.prefix)) | ||
| const extraCheckResult = props.extraCheck ? props.extraCheck(props.value) : true | ||
|
|
||
| const [dropdownOpen, setDropdownOpen] = useState(false) | ||
|
|
||
| const ref = React.useRef<any>() | ||
|
|
||
| return ( | ||
| <FormGroup | ||
| label="Webhook URL" | ||
| validated={ isUrlValid && isUrlAllowed && extraCheckResult === true ? "default" : "error"} | ||
| isRequired={true} | ||
| fieldId="url" | ||
| helperText="URL (with protocol) for POST callback" | ||
| helperTextInvalid={ !isUrlValid ? "URL cannot be parsed." : !isUrlAllowed ? "URL does not start with any of the allowed prefixes." : extraCheckResult} | ||
| > | ||
| <InputGroup> | ||
| { !props.isReadOnly && <Dropdown | ||
| onSelect={ event => { | ||
| if (event && event.currentTarget) { | ||
| if (props.setValid) { | ||
| props.setValid(true) | ||
| } | ||
| props.setValue(event.currentTarget.innerText) | ||
| } | ||
| setDropdownOpen(false) | ||
| if (ref.current) { | ||
| ref.current.focus() | ||
| } | ||
| }} | ||
| toggle={ | ||
| <DropdownToggle | ||
| onToggle={ setDropdownOpen } | ||
| isDisabled={ props.isDisabled } > | ||
| Pick URL prefix | ||
| </DropdownToggle> | ||
| } | ||
| isOpen={ dropdownOpen } | ||
| dropdownItems={ prefixes.map((p, i) => ( | ||
| <DropdownItem key={i} value={ p.prefix } component="button">{p.prefix}</DropdownItem>)) } | ||
| /> } | ||
| <TextInput | ||
| ref={ ref } | ||
| value={props.value} | ||
| isRequired | ||
| type="text" | ||
| id="url" | ||
| aria-describedby="url-helper" | ||
| name="url" | ||
| validated={ isUrlValid && isUrlAllowed && extraCheckResult === true ? "default" : "error"} | ||
| placeholder="e.g. 'http://example.com/api/hook'" | ||
| onChange={ value => { | ||
| if (props.setValid) { | ||
| props.setValid(isValidUrl(value) && prefixes.some(p => value.startsWith(p.prefix)) | ||
| && (!props.extraCheck || props.extraCheck(value) === true)) | ||
| } | ||
| props.setValue(value) | ||
| } } | ||
| isDisabled={ props.isDisabled } | ||
| isReadOnly={ props.isReadOnly } | ||
| /> | ||
| </InputGroup> | ||
| </FormGroup> | ||
| ) | ||
| } | ||
|
|
||
| export default HookUrlSelector; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.