|
18 | 18 |
|
19 | 19 | import java.net.URI; |
20 | 20 | import java.net.URISyntaxException; |
21 | | -import java.util.Arrays; |
22 | 21 | import java.util.Map; |
23 | 22 |
|
24 | 23 | import org.apache.hc.client5.http.classic.methods.HttpGet; |
25 | 24 | import org.apache.hc.client5.http.classic.methods.HttpHead; |
26 | | -import org.apache.hc.client5.http.classic.methods.HttpUriRequestBase; |
27 | 25 | import org.apache.hc.client5.http.impl.DefaultRedirectStrategy; |
28 | 26 | import org.apache.hc.core5.http.Header; |
29 | 27 | import org.apache.hc.core5.http.HttpException; |
|
62 | 60 | * @author Janne Valkealahti |
63 | 61 | * @author Christian Tzolov |
64 | 62 | * @author Cheng Guan Poh |
| 63 | + * @author Corneil du Plessis |
65 | 64 | */ |
66 | 65 | public class DropAuthorizationHeaderRequestRedirectStrategy extends DefaultRedirectStrategy { |
67 | 66 |
|
@@ -92,109 +91,82 @@ public URI getLocationURI(final HttpRequest request, final HttpResponse response |
92 | 91 | URI httpUriRequest = super.getLocationURI(request, response, context); |
93 | 92 | String query = httpUriRequest.getQuery(); |
94 | 93 | String method = request.getMethod(); |
95 | | - |
96 | 94 | // Handle Amazon requests |
97 | 95 | if (StringUtils.hasText(query) && query.contains(AMZ_CREDENTIAL)) { |
98 | 96 | if (isHeadOrGetMethod(method)) { |
99 | | - try { |
100 | | - return new DropAuthorizationHeaderHttpRequestBase(httpUriRequest, method).getUri(); |
101 | | - } catch (URISyntaxException e) { |
102 | | - throw new HttpException("Unable to get location URI", e); |
103 | | - } |
104 | | - } |
| 97 | + removeAuthorizationHeader(request, response, false); |
| 98 | + try { |
| 99 | + if (isHeadMethod(method)) { |
| 100 | + return new HttpHead(httpUriRequest).getUri(); |
| 101 | + } |
| 102 | + else { |
| 103 | + return new HttpGet(httpUriRequest).getUri(); |
| 104 | + } |
| 105 | + } |
| 106 | + catch (URISyntaxException e) { |
| 107 | + throw new HttpException("Unable to get location URI", e); |
| 108 | + } |
| 109 | + } |
105 | 110 | } |
106 | 111 |
|
107 | 112 | // Handle Azure requests |
108 | | - try { |
109 | | - if (request.getUri().getRawPath().contains(AZURECR_URI_SUFFIX)) { |
110 | | - if (isHeadOrGetMethod(method)) { |
111 | | - return (new DropAuthorizationHeaderHttpRequestBase(httpUriRequest, method) { |
112 | | - // Drop headers only for the Basic Auth and leave unchanged for OAuth2 |
113 | | - @Override |
114 | | - protected boolean isDropHeader(String name, Object value) { |
115 | | - return name.equalsIgnoreCase(AUTHORIZATION_HEADER) && StringUtils.hasText((String) value) && ((String)value).contains(BASIC_AUTH); |
116 | | - } |
117 | | - }).getUri(); |
118 | | - } |
119 | | - } |
120 | | - |
121 | | - |
122 | | - // Handle Custom requests |
123 | | - if (extra.containsKey(CUSTOM_REGISTRY) && request.getUri().getRawPath().contains(extra.get(CUSTOM_REGISTRY))) { |
124 | | - if (isHeadOrGetMethod(method)) { |
125 | | - return new DropAuthorizationHeaderHttpRequestBase(httpUriRequest, method).getUri(); |
| 113 | + try { |
| 114 | + if (request.getUri().getRawPath().contains(AZURECR_URI_SUFFIX)) { |
| 115 | + if (isHeadOrGetMethod(method)) { |
| 116 | + removeAuthorizationHeader(request, response, true); |
| 117 | + if (isHeadMethod(method)) { |
| 118 | + return new HttpHead(httpUriRequest).getUri(); |
| 119 | + } |
| 120 | + else { |
| 121 | + return new HttpGet(httpUriRequest).getUri(); |
| 122 | + } |
| 123 | + } |
| 124 | + } |
| 125 | + |
| 126 | + // Handle Custom requests |
| 127 | + if (extra.containsKey(CUSTOM_REGISTRY) |
| 128 | + && request.getUri().getRawPath().contains(extra.get(CUSTOM_REGISTRY))) { |
| 129 | + if (isHeadOrGetMethod(method)) { |
| 130 | + removeAuthorizationHeader(request, response, false); |
| 131 | + if (isHeadMethod(method)) { |
| 132 | + return new HttpHead(httpUriRequest).getUri(); |
| 133 | + } |
| 134 | + else { |
| 135 | + return new HttpGet(httpUriRequest).getUri(); |
| 136 | + } |
| 137 | + } |
126 | 138 | } |
127 | 139 | } |
128 | | - } catch (URISyntaxException e) { |
| 140 | + catch (URISyntaxException e) { |
129 | 141 | throw new HttpException("Unable to get Locaction URI", e); |
130 | 142 | } |
131 | 143 | return httpUriRequest; |
132 | 144 | } |
133 | 145 |
|
134 | | - private boolean isHeadOrGetMethod(String method) { |
135 | | - return StringUtils.hasText(method) |
136 | | - && (method.equalsIgnoreCase(HttpHead.METHOD_NAME) || method.equalsIgnoreCase(HttpGet.METHOD_NAME)); |
137 | | - } |
138 | | - |
139 | | - /** |
140 | | - * Overrides all header setter methods to filter out the Authorization headers. |
141 | | - */ |
142 | | - static class DropAuthorizationHeaderHttpRequestBase extends HttpUriRequestBase { |
143 | | - |
144 | | - private final String method; |
145 | | - |
146 | | - DropAuthorizationHeaderHttpRequestBase(URI uri, String method) { |
147 | | - super(method, uri); |
148 | | - this.method = method; |
149 | | - } |
150 | | - |
151 | | - @Override |
152 | | - public String getMethod() { |
153 | | - return this.method; |
154 | | - } |
155 | | - |
156 | | - @Override |
157 | | - public void addHeader(Header header) { |
158 | | - if (!isDropHeader(header)) { |
159 | | - super.addHeader(header); |
| 146 | + private static void removeAuthorizationHeader(HttpRequest request, HttpResponse response, boolean onlyBasicAuth) { |
| 147 | + for (Header header : response.getHeaders()) { |
| 148 | + if (header.getName().equalsIgnoreCase(AUTHORIZATION_HEADER) |
| 149 | + && (!onlyBasicAuth || (onlyBasicAuth && header.getValue().contains(BASIC_AUTH)))) { |
| 150 | + response.removeHeaders(header.getName()); |
| 151 | + break; |
160 | 152 | } |
161 | 153 | } |
162 | | - |
163 | | - @Override |
164 | | - public void addHeader(String name, Object value) { |
165 | | - if (!isDropHeader(name, value)) { |
166 | | - super.addHeader(name, value); |
| 154 | + for (Header header : request.getHeaders()) { |
| 155 | + if (header.getName().equalsIgnoreCase(AUTHORIZATION_HEADER) |
| 156 | + && (!onlyBasicAuth || (onlyBasicAuth && header.getValue().contains(BASIC_AUTH)))) { |
| 157 | + request.removeHeaders(header.getName()); |
| 158 | + break; |
167 | 159 | } |
168 | 160 | } |
| 161 | + } |
169 | 162 |
|
170 | | - @Override |
171 | | - public void setHeader(Header header) { |
172 | | - if (!isDropHeader(header)) { |
173 | | - super.setHeader(header); |
174 | | - } |
175 | | - } |
176 | | - |
177 | | - @Override |
178 | | - public void setHeader(String name, Object value) { |
179 | | - if (!isDropHeader(name, value)) { |
180 | | - super.setHeader(name, value); |
181 | | - } |
182 | | - } |
183 | | - |
184 | | - @Override |
185 | | - public void setHeaders(Header[] headers) { |
186 | | - Header[] filteredHeaders = Arrays.stream(headers) |
187 | | - .filter(header -> !isDropHeader(header)) |
188 | | - .toArray(Header[]::new); |
189 | | - super.setHeaders(filteredHeaders); |
190 | | - } |
191 | | - |
192 | | - protected boolean isDropHeader(Header header) { |
193 | | - return isDropHeader(header.getName(), header.getValue()); |
194 | | - } |
| 163 | + private boolean isHeadOrGetMethod(String method) { |
| 164 | + return StringUtils.hasText(method) |
| 165 | + && (method.equalsIgnoreCase(HttpHead.METHOD_NAME) || method.equalsIgnoreCase(HttpGet.METHOD_NAME)); |
| 166 | + } |
195 | 167 |
|
196 | | - protected boolean isDropHeader(String name, Object value) { |
197 | | - return name.equalsIgnoreCase(AUTHORIZATION_HEADER); |
198 | | - } |
| 168 | + private boolean isHeadMethod(String method) { |
| 169 | + return StringUtils.hasText(method) && method.equalsIgnoreCase(HttpHead.METHOD_NAME); |
199 | 170 | } |
| 171 | + |
200 | 172 | } |
0 commit comments