aboutsummaryrefslogtreecommitdiff
path: root/src/org
diff options
context:
space:
mode:
authorAnton Tananaev <anton.tananaev@gmail.com>2015-12-07 09:41:42 +1300
committerAnton Tananaev <anton.tananaev@gmail.com>2015-12-07 09:41:42 +1300
commita20e996c0929bcca43e5b5595f7ec320fad3c213 (patch)
tree4c8a6f962d8c3a33468d801f7d955e368ad00115 /src/org
parent1c534f33c3c0c4de018b1ae223d539ac9651180d (diff)
downloadtrackermap-server-a20e996c0929bcca43e5b5595f7ec320fad3c213.tar.gz
trackermap-server-a20e996c0929bcca43e5b5595f7ec320fad3c213.tar.bz2
trackermap-server-a20e996c0929bcca43e5b5595f7ec320fad3c213.zip
Restrict CORS origin header value
Diffstat (limited to 'src/org')
-rw-r--r--src/org/traccar/api/CorsResponseFilter.java19
-rw-r--r--src/org/traccar/web/BaseServlet.java2
2 files changed, 17 insertions, 4 deletions
diff --git a/src/org/traccar/api/CorsResponseFilter.java b/src/org/traccar/api/CorsResponseFilter.java
index 8aab5ad68..001f6ab4c 100644
--- a/src/org/traccar/api/CorsResponseFilter.java
+++ b/src/org/traccar/api/CorsResponseFilter.java
@@ -15,7 +15,12 @@
*/
package org.traccar.api;
+import org.jboss.netty.handler.codec.http.HttpHeaders;
+import org.traccar.Context;
+
import java.io.IOException;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerResponseContext;
import javax.ws.rs.container.ContainerResponseFilter;
@@ -36,9 +41,6 @@ public class CorsResponseFilter implements ContainerResponseFilter {
@Override
public void filter(ContainerRequestContext request, ContainerResponseContext response) throws IOException {
- if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_ORIGIN_KEY)) {
- response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, ACCESS_CONTROL_ALLOW_ORIGIN_VALUE);
- }
if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_HEADERS_KEY)) {
response.getHeaders().add(ACCESS_CONTROL_ALLOW_HEADERS_KEY, ACCESS_CONTROL_ALLOW_HEADERS_VALUE);
}
@@ -48,6 +50,17 @@ public class CorsResponseFilter implements ContainerResponseFilter {
if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_METHODS_KEY)) {
response.getHeaders().add(ACCESS_CONTROL_ALLOW_METHODS_KEY, ACCESS_CONTROL_ALLOW_METHODS_VALUE);
}
+
+ if (!response.getHeaders().containsKey(ACCESS_CONTROL_ALLOW_ORIGIN_KEY)) {
+ String origin = request.getHeaderString(HttpHeaders.Names.ORIGIN);
+ String allowed = Context.getConfig().getString("web.origin");
+ if (allowed == null) {
+ response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, ACCESS_CONTROL_ALLOW_ORIGIN_VALUE);
+ } else if (allowed.contains(origin)) {
+ String originSafe = URLEncoder.encode(origin, StandardCharsets.UTF_8.name());
+ response.getHeaders().add(ACCESS_CONTROL_ALLOW_ORIGIN_KEY, originSafe);
+ }
+ }
}
}
diff --git a/src/org/traccar/web/BaseServlet.java b/src/org/traccar/web/BaseServlet.java
index 69a073d39..8b022d556 100644
--- a/src/org/traccar/web/BaseServlet.java
+++ b/src/org/traccar/web/BaseServlet.java
@@ -56,7 +56,7 @@ public abstract class BaseServlet extends HttpServlet {
if (allowed == null) {
resp.setHeader(HttpHeaders.Names.ACCESS_CONTROL_ALLOW_ORIGIN, ALLOW_ORIGIN_VALUE);
} else if (allowed.contains(origin)) {
- String originSafe = URLEncoder.encode(origin, StandardCharsets.UTF_8.displayName());
+ String originSafe = URLEncoder.encode(origin, StandardCharsets.UTF_8.name());
resp.setHeader(HttpHeaders.Names.ACCESS_CONTROL_ALLOW_ORIGIN, originSafe);
}