From 343583e14b79fda2beb0b7b47589dd0b056f7c36 Mon Sep 17 00:00:00 2001 From: usbharu <64310155+usbharu@users.noreply.github.com> Date: Wed, 21 Feb 2024 00:16:50 +0900 Subject: [PATCH] style: fix lint --- .../kotlin/activitypub/note/NoteTest.kt | 30 +++++++++++++++++++ .../application/config/SecurityConfig.kt | 10 ++++--- .../httpsignature/HttpSignatureFilter.kt | 25 ++++++++++------ .../HttpSignatureHeaderChecker.kt | 2 +- 4 files changed, 53 insertions(+), 14 deletions(-) diff --git a/src/intTest/kotlin/activitypub/note/NoteTest.kt b/src/intTest/kotlin/activitypub/note/NoteTest.kt index b9619d0c..604d4ee3 100644 --- a/src/intTest/kotlin/activitypub/note/NoteTest.kt +++ b/src/intTest/kotlin/activitypub/note/NoteTest.kt @@ -22,6 +22,7 @@ import org.junit.jupiter.api.AfterAll import org.junit.jupiter.api.BeforeEach import org.junit.jupiter.api.Test import org.springframework.beans.factory.annotation.Autowired +import org.springframework.beans.factory.annotation.Qualifier import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc import org.springframework.boot.test.context.SpringBootTest import org.springframework.http.MediaType @@ -36,6 +37,8 @@ import org.springframework.transaction.annotation.Transactional import org.springframework.web.context.WebApplicationContext import util.WithHttpSignature import util.WithMockHttpSignature +import java.time.ZonedDateTime +import java.time.format.DateTimeFormatter @SpringBootTest(classes = [SpringApplication::class]) @AutoConfigureMockMvc @@ -46,6 +49,10 @@ class NoteTest { @Autowired private lateinit var context: WebApplicationContext + @Autowired + @Qualifier("http") + private lateinit var dateTimeFormatter: DateTimeFormatter + @BeforeEach fun setUp() { mockMvc = MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).build() @@ -197,6 +204,29 @@ class NoteTest { .andExpect { jsonPath("\$.attachment[1].url") { value("https://example.com/media/test-media2.png") } } } + @Test + fun signatureヘッダーがあるのにhostヘッダーがないと401() { + mockMvc + .get("/users/test-user10/posts/9999") { + accept(MediaType("application", "activity+json")) + header("Signature", "a") + header("Date", ZonedDateTime.now().format(dateTimeFormatter)) + + } + .andExpect { status { isUnauthorized() } } + } + + @Test + fun signatureヘッダーがあるのにdateヘッダーがないと401() { + mockMvc + .get("/users/test-user10/posts/9999") { + accept(MediaType("application", "activity+json")) + header("Signature", "a") + header("Host", "example.com") + } + .andExpect { status { isUnauthorized() } } + } + companion object { @JvmStatic @AfterAll diff --git a/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt b/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt index 8978da0c..249c3ab4 100644 --- a/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt +++ b/src/main/kotlin/dev/usbharu/hideout/application/config/SecurityConfig.kt @@ -92,16 +92,14 @@ import java.security.interfaces.RSAPrivateKey import java.security.interfaces.RSAPublicKey import java.util.* - @EnableWebSecurity(debug = false) @Configuration @Suppress("FunctionMaxLength", "TooManyFunctions", "LongMethod") class SecurityConfig { @Bean - fun authenticationManager(authenticationConfiguration: AuthenticationConfiguration): AuthenticationManager? { - return authenticationConfiguration.authenticationManager - } + fun authenticationManager(authenticationConfiguration: AuthenticationConfiguration): AuthenticationManager? = + authenticationConfiguration.authenticationManager @Bean @Order(1) @@ -416,6 +414,9 @@ class SecurityConfig { return roleHierarchyImpl } + // Spring Security 3.2.1 に存在する EnableWebSecurity(debug = true)にすると発生するエラーに対処するためのコード + // trueにしないときはコメントアウト + // @Bean fun beanDefinitionRegistryPostProcessor(): BeanDefinitionRegistryPostProcessor { return BeanDefinitionRegistryPostProcessor { registry: BeanDefinitionRegistry -> @@ -424,6 +425,7 @@ class SecurityConfig { } } + @Suppress("ExpressionBodySyntax") internal class CompositeFilterChainProxy(filters: List) : FilterChainProxy() { private val doFilterDelegate: Filter diff --git a/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureFilter.kt b/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureFilter.kt index b55388a8..27886cfb 100644 --- a/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureFilter.kt +++ b/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureFilter.kt @@ -45,7 +45,7 @@ class HttpSignatureFilter( return signature.keyId } - override fun getPreAuthenticatedCredentials(request: HttpServletRequest?): Any { + override fun getPreAuthenticatedCredentials(request: HttpServletRequest?): Any? { requireNotNull(request) val url = request.requestURL.toString() @@ -58,17 +58,24 @@ class HttpSignatureFilter( "get" -> HttpMethod.GET "post" -> HttpMethod.POST else -> { - throw IllegalArgumentException("Unsupported method: $method") +// throw IllegalArgumentException("Unsupported method: $method") + return null } } - httpSignatureHeaderChecker.checkDate(request.getHeader("date")) - httpSignatureHeaderChecker.checkHost(request.getHeader("host")) - - - - if (request.method.equals("post", true)) { - httpSignatureHeaderChecker.checkDigest(request.inputStream.readAllBytes(), request.getHeader("digest")) + try { + httpSignatureHeaderChecker.checkDate(request.getHeader("date")!!) + httpSignatureHeaderChecker.checkHost(request.getHeader("host")!!) + if (request.method.equals("post", true)) { + httpSignatureHeaderChecker.checkDigest( + request.inputStream.readAllBytes()!!, + request.getHeader("digest")!! + ) + } + } catch (_: NullPointerException) { + return null + } catch (_: IllegalArgumentException) { + return null } return HttpRequest( diff --git a/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureHeaderChecker.kt b/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureHeaderChecker.kt index 1f0ec70f..eab673cb 100644 --- a/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureHeaderChecker.kt +++ b/src/main/kotlin/dev/usbharu/hideout/core/infrastructure/springframework/httpsignature/HttpSignatureHeaderChecker.kt @@ -55,4 +55,4 @@ class HttpSignatureHeaderChecker(private val applicationConfig: ApplicationConfi private val dateFormat = DateTimeFormatter.ofPattern("EEE, dd MMM yyyy HH:mm:ss zzz", Locale.US) private val regex = Regex("^([a-zA-Z0-9\\-]+)=(.+)$") } -} \ No newline at end of file +}