Fixing cross origin bug for rest calls that allow a malicious user to issue requests from a site other than the zeppelin server.

djoelz-tssr · djoelz-tssr · commit b2b418a62de7 · 2015-08-20T12:48:12.000-07:00
Adding unit tests and a dependency to mockito to the server project (please comment if that is ok or if there is another preferred mocking framework).
Also upgrading the servelet version from 2.5 to 3.0 as this also fixes a security vulnerability with respect to httonly cookies.
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/utils/SecurityUtils.java b/zeppelin-server/src/main/java/org/apache/zeppelin/utils/SecurityUtils.java
@@ -28,7 +28,11 @@
 public class SecurityUtils {
   public static Boolean isValidOrigin(String sourceHost, ZeppelinConfiguration conf)
       throws UnknownHostException, URISyntaxException {
-    URI sourceHostUri = new URI(sourceHost.toLowerCase());
+    if(sourceHost == null){
+        return false;
+    }
+
+    URI sourceHostUri = new URI(sourceHost);
     String currentHost = java.net.InetAddress.getLocalHost().getHostName().toLowerCase();
     if (currentHost.equals(sourceHostUri.getHost()) ||
             "localhost".equals(sourceHostUri.getHost()) ||
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/security/SecurityUtilsTests.java b/zeppelin-server/src/test/java/org/apache/zeppelin/security/SecurityUtilsTests.java
@@ -66,4 +66,25 @@ public void isValidFromStar() throws URISyntaxException, UnknownHostException, C
                 SecurityUtils.isValidOrigin("http://anyhost.com",
                         new ZeppelinConfiguration(this.getClass().getResource("/zeppelin-site-star.xml"))));
     }
+
+    @Test
+    public void nullOrigin() throws URISyntaxException, UnknownHostException, ConfigurationException {
+        Assert.assertFalse(
+                SecurityUtils.isValidOrigin(null,
+                        new ZeppelinConfiguration(this.getClass().getResource("/zeppelin-site.xml"))));
+    }
+
+    @Test
+    public void emptyOrigin() throws URISyntaxException, UnknownHostException, ConfigurationException {
+        Assert.assertFalse(
+                SecurityUtils.isValidOrigin("",
+                        new ZeppelinConfiguration(this.getClass().getResource("/zeppelin-site.xml"))));
+    }
+
+    @Test
+    public void notAURIOrigin() throws URISyntaxException, UnknownHostException, ConfigurationException {
+        Assert.assertFalse(
+                SecurityUtils.isValidOrigin("test123",
+                        new ZeppelinConfiguration(this.getClass().getResource("/zeppelin-site.xml"))));
+    }
 }
