zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-14 00:17:20 +02:00
Code Issues Projects Releases Packages Wiki Activity

Remove xsrfScope and xsrfProtection authentication attributes

Browse source 
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=159121132
This commit is contained in:
mountford 2017-06-15 10:31:47 -07:00 • committed by Ben McIlwain
parent 580c41f2d6
commit 7d2f53a6fe
19 changed files with 103 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

8
java/google/registry/export/PublishDetailReportAction.java
View file

@ -43,13 +43,13 @@ import javax.inject.Inject;
@Action(
path = PublishDetailReportAction.PATH,
method = Action.Method.POST,
auth = @Auth(
auth =
@Auth(
methods = {AuthMethod.INTERNAL, Auth.AuthMethod.API},
minimumLevel = AuthLevel.APP,
userPolicy = UserPolicy.ADMIN
),
xsrfProtection = true,
xsrfScope = "admin")
)
)
public final class PublishDetailReportAction implements Runnable, JsonAction {
private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();

4
java/google/registry/flows/EppConsoleAction.java
View file

@ -26,8 +26,6 @@ import javax.servlet.http.HttpSession;
/** Runs EPP from the console and requires GAE user authentication. */
@Action(
path = "/registrar-xhr",
xsrfProtection = true,
xsrfScope = EppConsoleAction.XSRF_SCOPE,
method = Method.POST,
auth =
@Auth(
@ -38,8 +36,6 @@ import javax.servlet.http.HttpSession;
)
public class EppConsoleAction implements Runnable {
public static final String XSRF_SCOPE = "console";
@Inject @Payload byte[] inputXmlBytes;
@Inject HttpSession session;
@Inject EppRequestHandler eppRequestHandler;

2
java/google/registry/flows/EppToolAction.java
View file

@ -32,8 +32,6 @@ import javax.servlet.http.HttpServletRequest;
/** Runs EPP commands directly without logging in, verifying an XSRF token from the tool. */
@Action(
path = "/_dr/epptool",
xsrfProtection = true,
xsrfScope = "admin",
method = Method.POST,
auth =
@Auth(

6
java/google/registry/module/backend/BackendRequestHandler.java
View file

@ -17,7 +17,6 @@ package google.registry.module.backend;
import com.google.appengine.api.users.UserService;
import google.registry.request.RequestHandler;
import google.registry.request.auth.RequestAuthenticator;
import google.registry.security.XsrfTokenManager;
import javax.inject.Inject;
import javax.inject.Provider;
@ -27,8 +26,7 @@ public class BackendRequestHandler extends RequestHandler<BackendRequestComponen
@Inject BackendRequestHandler(
Provider<BackendRequestComponent.Builder> componentBuilderProvider,
UserService userService,
RequestAuthenticator requestAuthenticator,
XsrfTokenManager xsrfTokenManager) {
super(componentBuilderProvider, userService, requestAuthenticator, xsrfTokenManager);
RequestAuthenticator requestAuthenticator) {
super(componentBuilderProvider, userService, requestAuthenticator);
}
}

6
java/google/registry/module/frontend/FrontendRequestHandler.java
View file

@ -17,7 +17,6 @@ package google.registry.module.frontend;
import com.google.appengine.api.users.UserService;
import google.registry.request.RequestHandler;
import google.registry.request.auth.RequestAuthenticator;
import google.registry.security.XsrfTokenManager;
import javax.inject.Inject;
import javax.inject.Provider;
@ -27,8 +26,7 @@ public class FrontendRequestHandler extends RequestHandler<FrontendRequestCompon
@Inject FrontendRequestHandler(
Provider<FrontendRequestComponent.Builder> componentBuilderProvider,
UserService userService,
RequestAuthenticator requestAuthenticator,
XsrfTokenManager xsrfTokenManager) {
super(componentBuilderProvider, userService, requestAuthenticator, xsrfTokenManager);
RequestAuthenticator requestAuthenticator) {
super(componentBuilderProvider, userService, requestAuthenticator);
}
}

6
java/google/registry/module/tools/ToolsRequestHandler.java
View file

@ -17,7 +17,6 @@ package google.registry.module.tools;
import com.google.appengine.api.users.UserService;
import google.registry.request.RequestHandler;
import google.registry.request.auth.RequestAuthenticator;
import google.registry.security.XsrfTokenManager;
import javax.inject.Inject;
import javax.inject.Provider;
@ -27,8 +26,7 @@ public class ToolsRequestHandler extends RequestHandler<ToolsRequestComponent> {
@Inject ToolsRequestHandler(
Provider<ToolsRequestComponent.Builder> componentBuilderProvider,
UserService userService,
RequestAuthenticator requestAuthenticator,
XsrfTokenManager xsrfTokenManager) {
super(componentBuilderProvider, userService, requestAuthenticator, xsrfTokenManager);
RequestAuthenticator requestAuthenticator) {
super(componentBuilderProvider, userService, requestAuthenticator);
}
}

7
java/google/registry/request/Action.java
View file

@ -46,13 +46,6 @@ public @interface Action {
*/
boolean automaticallyPrintOk() default false;
// TODO(b/26304887): Flip default to true.
/** Enables XSRF protection on all HTTP methods except GET and HEAD. */
boolean xsrfProtection() default false;
/** Arbitrary value included in the XSRF token hash. */
String xsrfScope() default "app";
/**
* Require user be logged-in or 302 redirect to the Google auth login page.
*

29
java/google/registry/request/RequestHandler.java
View file

@ -15,10 +15,8 @@
package google.registry.request;
import static com.google.common.base.Preconditions.checkNotNull;
import static com.google.common.base.Strings.nullToEmpty;
import static com.google.common.net.HttpHeaders.LOCATION;
import static com.google.common.net.MediaType.PLAIN_TEXT_UTF_8;
import static google.registry.security.XsrfTokenManager.X_CSRF_TOKEN;
import static javax.servlet.http.HttpServletResponse.SC_FORBIDDEN;
import static javax.servlet.http.HttpServletResponse.SC_METHOD_NOT_ALLOWED;
import static javax.servlet.http.HttpServletResponse.SC_MOVED_TEMPORARILY;
@ -28,7 +26,6 @@ import com.google.appengine.api.users.UserService;
import com.google.common.base.Optional;
import google.registry.request.auth.AuthResult;
import google.registry.request.auth.RequestAuthenticator;
import google.registry.security.XsrfTokenManager;
import google.registry.util.FormattingLogger;
import google.registry.util.TypeUtils.TypeInstantiator;
import java.io.IOException;
@ -61,9 +58,6 @@ import javax.servlet.http.HttpServletResponse;
*
* <h3>Security Features</h3>
*
* <p>XSRF protection is built into this class. It can be enabled or disabled on individual actions
* using {@link Action#xsrfProtection() xsrfProtection} setting.
*
* <p>This class also enforces the {@link Action#requireLogin() requireLogin} setting.
*
* @param <C> request component type
@ -76,7 +70,6 @@ public class RequestHandler<C> {
private final Provider<? extends RequestComponentBuilder<C>> requestComponentBuilderProvider;
private final UserService userService;
private final RequestAuthenticator requestAuthenticator;
private final XsrfTokenManager xsrfTokenManager;
/**
* Constructor for subclasses to create a new request handler for a specific request component.
@ -90,15 +83,12 @@ public class RequestHandler<C> {
* request-derived modules provided by this class)
* @param userService an instance of the App Engine UserService API
* @param requestAuthenticator an instance of the {@link RequestAuthenticator} class
* @param xsrfTokenManager an instance of the {@link XsrfTokenManager} class
*/
protected RequestHandler(
Provider<? extends RequestComponentBuilder<C>> requestComponentBuilderProvider,
UserService userService,
RequestAuthenticator requestAuthenticator,
XsrfTokenManager xsrfTokenManager) {
this(null, requestComponentBuilderProvider, userService, requestAuthenticator,
xsrfTokenManager);
RequestAuthenticator requestAuthenticator) {
this(null, requestComponentBuilderProvider, userService, requestAuthenticator);
}
/** Creates a new RequestHandler with an explicit component class for test purposes. */
@ -106,22 +96,19 @@ public class RequestHandler<C> {
Class<C> component,
Provider<? extends RequestComponentBuilder<C>> requestComponentBuilderProvider,
UserService userService,
RequestAuthenticator requestAuthenticator,
XsrfTokenManager xsrfTokenManager) {
RequestAuthenticator requestAuthenticator) {
return new RequestHandler<>(
checkNotNull(component),
requestComponentBuilderProvider,
userService,
requestAuthenticator,
xsrfTokenManager);
requestAuthenticator);
}
private RequestHandler(
@Nullable Class<C> component,
Provider<? extends RequestComponentBuilder<C>> requestComponentBuilderProvider,
UserService userService,
RequestAuthenticator requestAuthenticator,
XsrfTokenManager xsrfTokenManager) {
RequestAuthenticator requestAuthenticator) {
// If the component class isn't explicitly provided, infer it from the class's own typing.
// This is safe only for use by subclasses of RequestHandler where the generic parameter is
// preserved at runtime, so only expose that option via the protected constructor.
@ -130,7 +117,6 @@ public class RequestHandler<C> {
this.requestComponentBuilderProvider = checkNotNull(requestComponentBuilderProvider);
this.userService = checkNotNull(userService);
this.requestAuthenticator = checkNotNull(requestAuthenticator);
this.xsrfTokenManager = checkNotNull(xsrfTokenManager);
}
/** Runs the appropriate action for a servlet request. */
@ -163,11 +149,6 @@ public class RequestHandler<C> {
rsp.setHeader(LOCATION, userService.createLoginURL(req.getRequestURI()));
return;
}
if (route.get().shouldXsrfProtect(method)
&& !xsrfTokenManager.validateToken(nullToEmpty(req.getHeader(X_CSRF_TOKEN)))) {
rsp.sendError(SC_FORBIDDEN, "Invalid " + X_CSRF_TOKEN);
return;
}
Optional<AuthResult> authResult =
requestAuthenticator.authorize(route.get().action().auth(), req);
if (!authResult.isPresent()) {

5
java/google/registry/request/Route.java
View file

@ -42,9 +42,4 @@ abstract class Route {
}
return false;
}
boolean shouldXsrfProtect(Action.Method requestMethod) {
return action().xsrfProtection()
&& (requestMethod != Action.Method.GET) && (requestMethod != Action.Method.HEAD);
}
}

16
java/google/registry/request/RouterDisplayHelper.java
View file

@ -38,8 +38,6 @@ import java.util.Map;
* <li>the simple name of the action class
* <li>the allowable HTTP methods
* <li>whether to automatically print "ok" in the response
* <li>whether XSRF protection is enabled
* <li>the XSRF scope
* <li>whether login is required
* <li>the allowable authentication methods
* <li>the minimum authentication level
@ -53,12 +51,11 @@ public class RouterDisplayHelper {
private static final String PATH = "path";
private static final String CLASS = "class";
private static final String METHODS = "methods";
private static final String XSRF_SCOPE = "xsrfScope";
private static final String AUTH_METHODS = "authMethods";
private static final String MINIMUM_LEVEL = "minLevel";
private static final String FORMAT =
"%%-%ds %%-%ds %%-%ds %%-2s %%-4s %%-%ds %%-5s %%-%ds %%-%ds %%s";
"%%-%ds %%-%ds %%-%ds %%-2s %%-5s %%-%ds %%-%ds %%s";
/** Returns a string representation of the routing map in the specified component. */
public static String extractHumanReadableRoutesFromComponent(Class<?> componentClass) {
@ -71,7 +68,6 @@ public class RouterDisplayHelper {
columnWidths.get(PATH),
columnWidths.get(CLASS),
columnWidths.get(METHODS),
columnWidths.get(XSRF_SCOPE),
columnWidths.get(AUTH_METHODS),
columnWidths.get(MINIMUM_LEVEL));
}
@ -83,8 +79,6 @@ public class RouterDisplayHelper {
"CLASS",
"METHODS",
"OK",
"XSRF",
"SCOPE",
"LOGIN",
"AUTH_METHODS",
"MIN",
@ -98,8 +92,6 @@ public class RouterDisplayHelper {
route.actionClass().getSimpleName(),
Joiner.on(",").join(route.action().method()),
route.action().automaticallyPrintOk() ? "y" : "n",
route.action().xsrfProtection() ? "y" : "n",
route.action().xsrfScope(),
route.action().requireLogin() ? "y" : "n",
Joiner.on(",").join(route.action().auth().methods()),
route.action().auth().minimumLevel(),
@ -112,7 +104,6 @@ public class RouterDisplayHelper {
int pathWidth = 4;
int classWidth = 5;
int methodsWidth = 7;
int xsrfScopeWidth = 5;
int authMethodsWidth = 12;
int minLevelWidth = 3;
for (Route route : routes) {
@ -131,10 +122,6 @@ public class RouterDisplayHelper {
if (len > methodsWidth) {
methodsWidth = len;
}
len = route.action().xsrfScope().length();
if (len > xsrfScopeWidth) {
xsrfScopeWidth = len;
}
len = Joiner.on(",").join(route.action().auth().methods()).length();
if (len > authMethodsWidth) {
authMethodsWidth = len;
@ -150,7 +137,6 @@ public class RouterDisplayHelper {
.put(PATH, pathWidth)
.put(CLASS, classWidth)
.put(METHODS, methodsWidth)
.put(XSRF_SCOPE, xsrfScopeWidth)
.put(AUTH_METHODS, authMethodsWidth)
.put(MINIMUM_LEVEL, minLevelWidth)
.build());

2
java/google/registry/tools/server/VerifyOteAction.java
View file

@ -83,8 +83,6 @@ import javax.inject.Inject;
@Action(
path = VerifyOteAction.PATH,
method = Action.Method.POST,
xsrfProtection = true,
xsrfScope = "admin",
auth =
@Auth(
methods = {Auth.AuthMethod.INTERNAL, Auth.AuthMethod.API},

1
java/google/registry/ui/server/registrar/ConsoleUiAction.java
View file

@ -42,7 +42,6 @@ import javax.servlet.http.HttpServletRequest;
@Action(
path = ConsoleUiAction.PATH,
requireLogin = true,
xsrfProtection = false,
auth =
@Auth(
methods = {Auth.AuthMethod.INTERNAL, Auth.AuthMethod.API, Auth.AuthMethod.LEGACY},

2
java/google/registry/ui/server/registrar/RegistrarPaymentAction.java
View file

@ -95,8 +95,6 @@ import org.joda.money.Money;
@Action(
path = "/registrar-payment",
method = Action.Method.POST,
xsrfProtection = true,
xsrfScope = "console",
requireLogin = true,
auth =
@Auth(

2
java/google/registry/ui/server/registrar/RegistrarPaymentSetupAction.java
View file

@ -70,8 +70,6 @@ import org.joda.money.CurrencyUnit;
@Action(
path = "/registrar-payment-setup",
method = Action.Method.POST,
xsrfProtection = true,
xsrfScope = "console",
requireLogin = true,
auth =
@Auth(

2
java/google/registry/ui/server/registrar/RegistrarSettingsAction.java
View file

@ -64,8 +64,6 @@ import javax.servlet.http.HttpServletRequest;
@Action(
path = RegistrarSettingsAction.PATH,
requireLogin = true,
xsrfProtection = true,
xsrfScope = "console",
method = Action.Method.POST,
auth =
@Auth(

76
javatests/google/registry/module/backend/testdata/backend_routing.txt vendored
View file

@ -1,38 +1,38 @@
PATH CLASS METHODS OK XSRF SCOPE LOGIN AUTH_METHODS MIN USER_POLICY
/_dr/cron/commitLogCheckpoint CommitLogCheckpointAction GET y n app n INTERNAL APP IGNORED
/_dr/cron/commitLogFanout CommitLogFanoutAction GET y n app n INTERNAL APP IGNORED
/_dr/cron/fanout TldFanoutAction GET y n app n INTERNAL APP IGNORED
/_dr/cron/readDnsQueue ReadDnsQueueAction GET y n app n INTERNAL APP IGNORED
/_dr/dnsRefresh RefreshDnsAction GET y n app n INTERNAL APP IGNORED
/_dr/task/brdaCopy BrdaCopyAction POST y n app n INTERNAL APP IGNORED
/_dr/task/checkSnapshot CheckSnapshotAction POST,GET y n app n INTERNAL APP IGNORED
/_dr/task/deleteContactsAndHosts DeleteContactsAndHostsAction GET n n app n INTERNAL APP IGNORED
/_dr/task/deleteOldCommitLogs DeleteOldCommitLogsAction POST y n app n INTERNAL APP IGNORED
/_dr/task/deleteProberData DeleteProberDataAction POST n n app n INTERNAL APP IGNORED
/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET n n app n INTERNAL APP IGNORED
/_dr/task/exportCommitLogDiff ExportCommitLogDiffAction POST y n app n INTERNAL APP IGNORED
/_dr/task/exportDomainLists ExportDomainListsAction POST n n app n INTERNAL APP IGNORED
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n n app n INTERNAL APP IGNORED
/_dr/task/exportSnapshot ExportSnapshotAction POST y n app n INTERNAL APP IGNORED
/_dr/task/importRdeContacts RdeContactImportAction GET n n app n INTERNAL APP IGNORED
/_dr/task/importRdeDomains RdeDomainImportAction GET n n app n INTERNAL APP IGNORED
/_dr/task/importRdeHosts RdeHostImportAction GET n n app n INTERNAL APP IGNORED
/_dr/task/linkRdeHosts RdeHostLinkAction GET n n app n INTERNAL APP IGNORED
/_dr/task/loadSnapshot LoadSnapshotAction POST n n app n INTERNAL APP IGNORED
/_dr/task/mapreduceEntityCleanup MapreduceEntityCleanupAction GET n n app n INTERNAL APP IGNORED
/_dr/task/metrics MetricsExportAction POST n n app n INTERNAL APP IGNORED
/_dr/task/nordnUpload NordnUploadAction POST y n app n INTERNAL APP IGNORED
/_dr/task/nordnVerify NordnVerifyAction POST y n app n INTERNAL APP IGNORED
/_dr/task/pollBigqueryJob BigqueryPollJobAction GET,POST y n app n INTERNAL APP IGNORED
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y n app n INTERNAL APP IGNORED
/_dr/task/rdeReport RdeReportAction POST n n app n INTERNAL APP IGNORED
/_dr/task/rdeStaging RdeStagingAction GET,POST n n app n INTERNAL APP IGNORED
/_dr/task/rdeUpload RdeUploadAction POST n n app n INTERNAL APP IGNORED
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction GET n n app n INTERNAL APP IGNORED
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n n app n INTERNAL APP IGNORED
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n n app n INTERNAL APP IGNORED
/_dr/task/tmchCrl TmchCrlAction POST y n app n INTERNAL APP IGNORED
/_dr/task/tmchDnl TmchDnlAction POST y n app n INTERNAL APP IGNORED
/_dr/task/tmchSmdrl TmchSmdrlAction POST y n app n INTERNAL APP IGNORED
/_dr/task/updateSnapshotView UpdateSnapshotViewAction POST n n app n INTERNAL APP IGNORED
/_dr/task/verifyEntityIntegrity VerifyEntityIntegrityAction POST n n app n INTERNAL APP IGNORED
PATH CLASS METHODS OK LOGIN AUTH_METHODS MIN USER_POLICY
/_dr/cron/commitLogCheckpoint CommitLogCheckpointAction GET y n INTERNAL APP IGNORED
/_dr/cron/commitLogFanout CommitLogFanoutAction GET y n INTERNAL APP IGNORED
/_dr/cron/fanout TldFanoutAction GET y n INTERNAL APP IGNORED
/_dr/cron/readDnsQueue ReadDnsQueueAction GET y n INTERNAL APP IGNORED
/_dr/dnsRefresh RefreshDnsAction GET y n INTERNAL APP IGNORED
/_dr/task/brdaCopy BrdaCopyAction POST y n INTERNAL APP IGNORED
/_dr/task/checkSnapshot CheckSnapshotAction POST,GET y n INTERNAL APP IGNORED
/_dr/task/deleteContactsAndHosts DeleteContactsAndHostsAction GET n n INTERNAL APP IGNORED
/_dr/task/deleteOldCommitLogs DeleteOldCommitLogsAction POST y n INTERNAL APP IGNORED
/_dr/task/deleteProberData DeleteProberDataAction POST n n INTERNAL APP IGNORED
/_dr/task/expandRecurringBillingEvents ExpandRecurringBillingEventsAction GET n n INTERNAL APP IGNORED
/_dr/task/exportCommitLogDiff ExportCommitLogDiffAction POST y n INTERNAL APP IGNORED
/_dr/task/exportDomainLists ExportDomainListsAction POST n n INTERNAL APP IGNORED
/_dr/task/exportReservedTerms ExportReservedTermsAction POST n n INTERNAL APP IGNORED
/_dr/task/exportSnapshot ExportSnapshotAction POST y n INTERNAL APP IGNORED
/_dr/task/importRdeContacts RdeContactImportAction GET n n INTERNAL APP IGNORED
/_dr/task/importRdeDomains RdeDomainImportAction GET n n INTERNAL APP IGNORED
/_dr/task/importRdeHosts RdeHostImportAction GET n n INTERNAL APP IGNORED
/_dr/task/linkRdeHosts RdeHostLinkAction GET n n INTERNAL APP IGNORED
/_dr/task/loadSnapshot LoadSnapshotAction POST n n INTERNAL APP IGNORED
/_dr/task/mapreduceEntityCleanup MapreduceEntityCleanupAction GET n n INTERNAL APP IGNORED
/_dr/task/metrics MetricsExportAction POST n n INTERNAL APP IGNORED
/_dr/task/nordnUpload NordnUploadAction POST y n INTERNAL APP IGNORED
/_dr/task/nordnVerify NordnVerifyAction POST y n INTERNAL APP IGNORED
/_dr/task/pollBigqueryJob BigqueryPollJobAction GET,POST y n INTERNAL APP IGNORED
/_dr/task/publishDnsUpdates PublishDnsUpdatesAction POST y n INTERNAL APP IGNORED
/_dr/task/rdeReport RdeReportAction POST n n INTERNAL APP IGNORED
/_dr/task/rdeStaging RdeStagingAction GET,POST n n INTERNAL APP IGNORED
/_dr/task/rdeUpload RdeUploadAction POST n n INTERNAL APP IGNORED
/_dr/task/refreshDnsOnHostRename RefreshDnsOnHostRenameAction GET n n INTERNAL APP IGNORED
/_dr/task/syncGroupMembers SyncGroupMembersAction POST n n INTERNAL APP IGNORED
/_dr/task/syncRegistrarsSheet SyncRegistrarsSheetAction POST n n INTERNAL APP IGNORED
/_dr/task/tmchCrl TmchCrlAction POST y n INTERNAL APP IGNORED
/_dr/task/tmchDnl TmchDnlAction POST y n INTERNAL APP IGNORED
/_dr/task/tmchSmdrl TmchSmdrlAction POST y n INTERNAL APP IGNORED
/_dr/task/updateSnapshotView UpdateSnapshotViewAction POST n n INTERNAL APP IGNORED
/_dr/task/verifyEntityIntegrity VerifyEntityIntegrityAction POST n n INTERNAL APP IGNORED

38
javatests/google/registry/module/frontend/testdata/frontend_routing.txt vendored
View file

@ -1,19 +1,19 @@
PATH CLASS METHODS OK XSRF SCOPE LOGIN AUTH_METHODS MIN USER_POLICY
/_dr/epp EppTlsAction POST n n app n INTERNAL,API APP ADMIN
/_dr/whois WhoisServer POST n n app n INTERNAL,API APP ADMIN
/check CheckApiAction GET n n app n INTERNAL NONE PUBLIC
/rdap/autnum/(*) RdapAutnumAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/domain/(*) RdapDomainAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/domains RdapDomainSearchAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/entities RdapEntitySearchAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/entity/(*) RdapEntityAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/help(*) RdapHelpAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/ip/(*) RdapIpAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/nameserver/(*) RdapNameserverAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/rdap/nameservers RdapNameserverSearchAction GET,HEAD n n app n INTERNAL NONE PUBLIC
/registrar ConsoleUiAction GET n n app y INTERNAL,API,LEGACY NONE PUBLIC
/registrar-payment RegistrarPaymentAction POST n y console y INTERNAL,API,LEGACY USER PUBLIC
/registrar-payment-setup RegistrarPaymentSetupAction POST n y console y INTERNAL,API,LEGACY USER PUBLIC
/registrar-settings RegistrarSettingsAction POST n y console y INTERNAL,API,LEGACY USER PUBLIC
/registrar-xhr EppConsoleAction POST n y console n INTERNAL,API,LEGACY USER PUBLIC
/whois/(*) WhoisHttpServer GET n n app n INTERNAL NONE PUBLIC
PATH CLASS METHODS OK LOGIN AUTH_METHODS MIN USER_POLICY
/_dr/epp EppTlsAction POST n n INTERNAL,API APP ADMIN
/_dr/whois WhoisServer POST n n INTERNAL,API APP ADMIN
/check CheckApiAction GET n n INTERNAL NONE PUBLIC
/rdap/autnum/(*) RdapAutnumAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/domain/(*) RdapDomainAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/domains RdapDomainSearchAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/entities RdapEntitySearchAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/entity/(*) RdapEntityAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/help(*) RdapHelpAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/ip/(*) RdapIpAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/nameserver/(*) RdapNameserverAction GET,HEAD n n INTERNAL NONE PUBLIC
/rdap/nameservers RdapNameserverSearchAction GET,HEAD n n INTERNAL NONE PUBLIC
/registrar ConsoleUiAction GET n y INTERNAL,API,LEGACY NONE PUBLIC
/registrar-payment RegistrarPaymentAction POST n y INTERNAL,API,LEGACY USER PUBLIC
/registrar-payment-setup RegistrarPaymentSetupAction POST n y INTERNAL,API,LEGACY USER PUBLIC
/registrar-settings RegistrarSettingsAction POST n y INTERNAL,API,LEGACY USER PUBLIC
/registrar-xhr EppConsoleAction POST n n INTERNAL,API,LEGACY USER PUBLIC
/whois/(*) WhoisHttpServer GET n n INTERNAL NONE PUBLIC

42
javatests/google/registry/module/tools/testdata/tools_routing.txt vendored
View file

@ -1,21 +1,21 @@
PATH CLASS METHODS OK XSRF SCOPE LOGIN AUTH_METHODS MIN USER_POLICY
/_dr/admin/createGroups CreateGroupsAction POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/createPremiumList CreatePremiumListAction POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/deleteEntity DeleteEntityAction GET n n app n INTERNAL,API APP ADMIN
/_dr/admin/list/domains ListDomainsAction GET,POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/list/hosts ListHostsAction GET,POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/list/tlds ListTldsAction GET,POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/updatePremiumList UpdatePremiumListAction POST n n app n INTERNAL,API APP ADMIN
/_dr/admin/verifyOte VerifyOteAction POST n y admin n INTERNAL,API APP ADMIN
/_dr/epptool EppToolAction POST n y admin n INTERNAL,API APP ADMIN
/_dr/loadtest LoadTestAction POST y n app n INTERNAL,API APP ADMIN
/_dr/publishDetailReport PublishDetailReportAction POST n y admin n INTERNAL,API APP ADMIN
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n n app n INTERNAL,API APP ADMIN
/_dr/task/killAllCommitLogs KillAllCommitLogsAction POST n n app n INTERNAL APP IGNORED
/_dr/task/killAllEppResources KillAllEppResourcesAction POST n n app n INTERNAL APP IGNORED
/_dr/task/refreshAllDomains RefreshAllDomainsAction GET n n app n INTERNAL,API APP ADMIN
/_dr/task/resaveAllEppResources ResaveAllEppResourcesAction GET n n app n INTERNAL,API APP ADMIN
/_dr/task/restoreCommitLogs RestoreCommitLogsAction POST y n app n INTERNAL,API APP ADMIN
PATH CLASS METHODS OK LOGIN AUTH_METHODS MIN USER_POLICY
/_dr/admin/createGroups CreateGroupsAction POST n n INTERNAL,API APP ADMIN
/_dr/admin/createPremiumList CreatePremiumListAction POST n n INTERNAL,API APP ADMIN
/_dr/admin/deleteEntity DeleteEntityAction GET n n INTERNAL,API APP ADMIN
/_dr/admin/list/domains ListDomainsAction GET,POST n n INTERNAL,API APP ADMIN
/_dr/admin/list/hosts ListHostsAction GET,POST n n INTERNAL,API APP ADMIN
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n n INTERNAL,API APP ADMIN
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n n INTERNAL,API APP ADMIN
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n n INTERNAL,API APP ADMIN
/_dr/admin/list/tlds ListTldsAction GET,POST n n INTERNAL,API APP ADMIN
/_dr/admin/updatePremiumList UpdatePremiumListAction POST n n INTERNAL,API APP ADMIN
/_dr/admin/verifyOte VerifyOteAction POST n n INTERNAL,API APP ADMIN
/_dr/epptool EppToolAction POST n n INTERNAL,API APP ADMIN
/_dr/loadtest LoadTestAction POST y n INTERNAL,API APP ADMIN
/_dr/publishDetailReport PublishDetailReportAction POST n n INTERNAL,API APP ADMIN
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n n INTERNAL,API APP ADMIN
/_dr/task/killAllCommitLogs KillAllCommitLogsAction POST n n INTERNAL APP IGNORED
/_dr/task/killAllEppResources KillAllEppResourcesAction POST n n INTERNAL APP IGNORED
/_dr/task/refreshAllDomains RefreshAllDomainsAction GET n n INTERNAL,API APP ADMIN
/_dr/task/resaveAllEppResources ResaveAllEppResourcesAction GET n n INTERNAL,API APP ADMIN
/_dr/task/restoreCommitLogs RestoreCommitLogsAction POST y n INTERNAL,API APP ADMIN

30
javatests/google/registry/request/RequestHandlerTest.java
View file

@ -90,8 +90,6 @@ public final class RequestHandlerTest {
@Action(
path = "/safe-sloth",
method = {GET, POST},
xsrfProtection = true,
xsrfScope = "vampire",
auth = @Auth(minimumLevel = AuthLevel.NONE)
)
public static class SafeSlothTask implements Runnable {
@ -262,8 +260,7 @@ public final class RequestHandlerTest {
}
}),
userService,
requestAuthenticator,
xsrfTokenManager);
requestAuthenticator);
when(rsp.getWriter()).thenReturn(new PrintWriter(httpOutput));
}
@ -283,7 +280,10 @@ public final class RequestHandlerTest {
@Test
public void testHandleRequest_multipleMethodMappings_works() throws Exception {
userService.setUser(testUser, false);
when(req.getMethod()).thenReturn("POST");
when(req.getHeader("X-CSRF-Token"))
.thenReturn(xsrfTokenManager.generateToken(testUser.getEmail()));
when(req.getRequestURI()).thenReturn("/bumblebee");
handler.handleRequest(req, rsp);
verify(bumblebeeTask).run();
@ -299,7 +299,10 @@ public final class RequestHandlerTest {
@Test
public void testHandleRequest_taskHasAutoPrintOk_printsOk() throws Exception {
userService.setUser(testUser, false);
when(req.getMethod()).thenReturn("POST");
when(req.getHeader("X-CSRF-Token"))
.thenReturn(xsrfTokenManager.generateToken(testUser.getEmail()));
when(req.getRequestURI()).thenReturn("/sloth");
handler.handleRequest(req, rsp);
verify(slothTask).run();
@ -378,14 +381,6 @@ public final class RequestHandlerTest {
tester.testAllPublicInstanceMethods(handler);
}
@Test
public void testXsrfProtection_noTokenProvided_returns403Forbidden() throws Exception {
when(req.getMethod()).thenReturn("POST");
when(req.getRequestURI()).thenReturn("/safe-sloth");
handler.handleRequest(req, rsp);
verify(rsp).sendError(403, "Invalid X-CSRF-Token");
}
@Test
public void testXsrfProtection_validTokenProvided_runsAction() throws Exception {
userService.setUser(testUser, false);
@ -397,17 +392,6 @@ public final class RequestHandlerTest {
verify(safeSlothTask).run();
}
@Test
public void testXsrfProtection_tokenWithInvalidUserProvided_returns403() throws Exception {
userService.setUser(testUser, false);
when(req.getMethod()).thenReturn("POST");
when(req.getHeader("X-CSRF-Token"))
.thenReturn(xsrfTokenManager.generateToken("wrong@example.com"));
when(req.getRequestURI()).thenReturn("/safe-sloth");
handler.handleRequest(req, rsp);
verify(rsp).sendError(403, "Invalid X-CSRF-Token");
}
@Test
public void testXsrfProtection_GETMethodWithoutToken_doesntCheckToken() throws Exception {
when(req.getMethod()).thenReturn("GET");