Skip to content

Commit abf4eb6

Browse files
koda-masarukoda-masaru
authored
Merge pull request #106 from support-project/develop
Release v1.12.0
2 parents 2454a1f + b265aef commit abf4eb6

File tree

15 files changed

+151
-76
lines changed

15 files changed

+151
-76
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,5 @@
33
.project
44
.settings
55
.checkstyle
6+
.idea
7+
web.iml

‎pom.xml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
<groupId>org.support-project</groupId>
66
<artifactId>web</artifactId>
7-
<version>1.11.1</version>
7+
<version>1.12.0</version>
88
<packaging>jar</packaging>
99

1010
<name>web</name>
@@ -59,13 +59,13 @@
5959
<dependency>
6060
<groupId>org.support-project</groupId>
6161
<artifactId>common</artifactId>
62-
<version>1.11.0</version>
62+
<version>1.12.0</version>
6363
</dependency>
6464

6565
<dependency>
6666
<groupId>com.h2database</groupId>
6767
<artifactId>h2</artifactId>
68-
<version>1.4.183</version>
68+
<version>1.4.196</version>
6969
<scope>provided</scope>
7070
</dependency>
7171

@@ -91,27 +91,27 @@
9191
<dependency>
9292
<groupId>commons-fileupload</groupId>
9393
<artifactId>commons-fileupload</artifactId>
94-
<version>1.3.1</version>
94+
<version>1.3.3</version>
9595
</dependency>
9696

9797
<dependency>
9898
<groupId>org.apache.directory.api</groupId>
9999
<artifactId>api-all</artifactId>
100-
<version>1.0.0-M30</version>
100+
<version>1.0.0</version>
101101
</dependency>
102102

103103
<dependency>
104104
<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
105105
<artifactId>owasp-java-html-sanitizer</artifactId>
106-
<version>20160827.1</version>
106+
<version>20171016.1</version>
107107
</dependency>
108+
108109
<dependency>
109110
<groupId>com.google.guava</groupId>
110111
<artifactId>guava</artifactId>
111-
<version>19.0</version>
112+
<version>20.0</version>
112113
</dependency>
113114

114-
115115
</dependencies>
116116

117117
<profiles>

‎src/main/java/org/support/project/web/bean/CSRFTokens.java‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22

33
import java.io.Serializable;
44
import java.security.NoSuchAlgorithmException;
5-
import java.util.ArrayList;
6-
import java.util.List;
5+
import java.util.Iterator;
6+
import java.util.LinkedHashMap;
77

88
import org.support.project.common.serialize.Serialize;
99
import org.support.project.common.serialize.SerializerValue;
@@ -14,33 +14,48 @@ public class CSRFTokens implements Serializable {
1414
* シリアルバージョン
1515
*/
1616
private static final long serialVersionUID = 1L;
17-
18-
private List<CSRFToken> tokens = new ArrayList<>();
19-
17+
18+
private LinkedHashMap<String, CSRFToken> tokens = new LinkedHashMap<>();
19+
2020
/**
2121
* 指定のキーに対するTokenを発行する
22-
* @param key key
22+
*
23+
* @param key key
2324
* @throws NoSuchAlgorithmException NoSuchAlgorithmException
2425
*/
2526
public String addToken(String key) throws NoSuchAlgorithmException {
27+
if (tokens.containsKey(key)) {
28+
CSRFToken token = tokens.get(key);
29+
return token.getToken();
30+
}
2631
if (tokens.size() > 20) {
27-
tokens.remove(0);
32+
Iterator<String> iterator = tokens.keySet().iterator();
33+
while (iterator.hasNext()) {
34+
String string = (String) iterator.next();
35+
tokens.remove(string); // 初めの1件を削除（古いもの）
36+
break;
37+
}
2838
}
2939
CSRFToken token = CSRFToken.create(key);
30-
tokens.add(token);
40+
tokens.put(key, token);
3141
return token.getToken();
3242
}
33-
43+
3444
/**
3545
* トークンが正しい値かチェックする
46+
*
3647
* @param key key
3748
* @param reqTokens CSRFTokens
3849
* @return チェック結果
3950
*/
4051
public boolean checkToken(String key, CSRFTokens reqTokens) {
41-
for (CSRFToken csrfToken : tokens) {
52+
Iterator<CSRFToken> iterator = tokens.values().iterator();
53+
while (iterator.hasNext()) {
54+
CSRFToken csrfToken = (CSRFToken) iterator.next();
4255
if (csrfToken.getKey().equals(key)) {
43-
for (CSRFToken reqToken : reqTokens.tokens) {
56+
Iterator<CSRFToken> iterator2 = reqTokens.tokens.values().iterator();
57+
while (iterator2.hasNext()) {
58+
CSRFToken reqToken = (CSRFToken) iterator2.next();
4459
if (reqToken.getKey().equals(key) && csrfToken.getToken().equals(reqToken.getToken())) {
4560
return true;
4661
}
@@ -49,20 +64,23 @@ public boolean checkToken(String key, CSRFTokens reqTokens) {
4964
}
5065
return false;
5166
}
52-
67+
5368
/**
5469
* リクエストのHiddenトークンが正しい値かチェックする
70+
*
5571
* @param key key
5672
* @return チェック結果
5773
*/
5874
public boolean checkToken(String key) {
59-
for (CSRFToken csrfToken : tokens) {
75+
Iterator<CSRFToken> iterator = tokens.values().iterator();
76+
while (iterator.hasNext()) {
77+
CSRFToken csrfToken = (CSRFToken) iterator.next();
6078
if (csrfToken.getToken().equals(key)) {
6179
// 保持されているTokenのリストの中に存在すればOK
6280
return true;
6381
}
6482
}
6583
return false;
6684
}
67-
85+
6886
}

‎src/main/java/org/support/project/web/common/InvokeSearch.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,8 +159,17 @@ private void addTarget(Class<?> class1, Method method, String targetPackageName,
159159
}
160160
InvokeTarget invokeTarget = new InvokeTarget(class1, method, targetPackageName, classSuffix, new LinkedHashMap<>());
161161
if (invokeTargets.containsKey(key)) {
162+
InvokeTarget exists = invokeTargets.get(key);
163+
if (exists.getTargetClass().getName().equals(invokeTarget.getTargetClass().getName())
164+
&& exists.getTargetMethod().getName().equals(invokeTarget.getTargetMethod().getName())) {
165+
//なぜか、同じクラスの同じメソッドが二回登録されることがあるのでスキップ
166+
LOG.info("same target duplicate add. [" + key + "]");
167+
return;
168+
}
162169
// 既に指定のパスが使われている
163170
LOG.error("Target duplicated. [" + key + "]");
171+
LOG.error("class:" + invokeTarget.getTargetClass().getName() + " method:" + invokeTarget.getTargetMethod().getName());
172+
LOG.error("class:" + exists.getTargetClass().getName() + " method:" + exists.getTargetMethod().getName());
164173
throw new SystemException("Target duplicated. [" + key + "]");
165174
}
166175
// 大文字／小文字は判定しない

‎src/main/java/org/support/project/web/control/ApiControl.java‎

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
package org.support.project.web.control;
22

33
import org.support.project.common.config.Resources;
4-
import org.support.project.common.util.StringUtils;
5-
import org.support.project.web.bean.ApiParams;
64
import org.support.project.web.bean.Msg;
75
import org.support.project.web.boundary.Boundary;
86
import org.support.project.web.common.HttpStatus;
@@ -30,48 +28,4 @@ protected Boundary sendError(InvalidParamException e) {
3028
return this.sendError(HttpStatus.SC_400_BAD_REQUEST);
3129
}
3230
}
33-
34-
public abstract Boundary getList(ApiParams params);
35-
public abstract Boundary getSingle(String id);
36-
public int maxLimit() {
37-
return 50;
38-
}
39-
40-
protected ApiParams getApiParams() {
41-
// 一覧取得
42-
int limit = 10;
43-
int offset = 0;
44-
String limitStr = getParam("limit");
45-
if (StringUtils.isInteger(limitStr)) {
46-
limit = Integer.parseInt(limitStr);
47-
}
48-
if (limit > maxLimit()) {
49-
limit = maxLimit();
50-
}
51-
String offsetStr = getParam("offset");
52-
if (StringUtils.isInteger(offsetStr)) {
53-
offset = Integer.parseInt(offsetStr);
54-
}
55-
ApiParams params = new ApiParams();
56-
params.setLimit(limit);
57-
params.setOffset(offset);
58-
return params;
59-
}
60-
61-
/**
62-
* APIの基本的なGetのパターンを処理
63-
* 上の getList or getSingle が呼び出される
64-
* @return
65-
*/
66-
protected Boundary get() {
67-
String id = super.getPathString("");
68-
if (StringUtils.isEmpty(id)) {
69-
ApiParams params = getApiParams();
70-
return getList(params);
71-
} else {
72-
// 1件取得
73-
return getSingle(id);
74-
}
75-
}
76-
7731
}

‎src/main/java/org/support/project/web/control/Control.java‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -786,7 +786,27 @@ protected Map<String, String> getParams() {
786786
}
787787
return map;
788788
}
789-
789+
790+
/**
791+
* 数値の情報を取得
792+
* @param param パラメータ名
793+
* @param defaultVal デフォルト
794+
* @param maxVal 最大値
795+
* @return 数値
796+
*/
797+
protected int getParamInt(String param, int defaultVal, int maxVal) {
798+
int num = defaultVal;
799+
String str = getParam(param);
800+
if (StringUtils.isInteger(str)) {
801+
num = Integer.parseInt(str);
802+
}
803+
if(num > maxVal) {
804+
num = maxVal;
805+
}
806+
return num;
807+
}
808+
809+
790810
/**
791811
* @return the sendEscapeHtml
792812
*/

‎src/main/java/org/support/project/web/control/GetApiControl.java‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
package org.support.project.web.control;
2+
3+
import org.support.project.common.util.StringUtils;
4+
import org.support.project.web.bean.ApiParams;
5+
import org.support.project.web.boundary.Boundary;
6+
7+
public abstract class GetApiControl extends ApiControl {
8+
9+
public abstract Boundary getList(ApiParams params);
10+
public abstract Boundary getSingle(String id);
11+
public int maxLimit() {
12+
return 50;
13+
}
14+
15+
protected ApiParams getApiParams() {
16+
// 一覧取得
17+
int limit = 10;
18+
int offset = 0;
19+
String limitStr = getParam("limit");
20+
if (StringUtils.isInteger(limitStr)) {
21+
limit = Integer.parseInt(limitStr);
22+
}
23+
if (limit > maxLimit()) {
24+
limit = maxLimit();
25+
}
26+
String offsetStr = getParam("offset");
27+
if (StringUtils.isInteger(offsetStr)) {
28+
offset = Integer.parseInt(offsetStr);
29+
}
30+
ApiParams params = new ApiParams();
31+
params.setLimit(limit);
32+
params.setOffset(offset);
33+
return params;
34+
}
35+
36+
/**
37+
* APIの基本的なGetのパターンを処理
38+
* 上の getList or getSingle が呼び出される
39+
* @return
40+
*/
41+
protected Boundary get() {
42+
String id = super.getPathString("");
43+
if (StringUtils.isEmpty(id)) {
44+
ApiParams params = getApiParams();
45+
return getList(params);
46+
} else {
47+
// 1件取得
48+
return getSingle(id);
49+
}
50+
}
51+
}
52+

‎src/main/java/org/support/project/web/dao/UsersDao.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ public List<UsersEntity> selectOnKeyword(int offset, int pageLimit, String keywo
159159
List<Object> params = new ArrayList<Object>();
160160
sql.append("SELECT * FROM USERS WHERE DELETE_FLAG = 0 ");
161161
if (!StringUtils.isEmpty(keyword)) {
162-
sql.append("AND USER_NAME LIKE ? ");
162+
sql.append("AND USER_NAME ILIKE ? ");
163163
params.add("%" + keyword + "%");
164164
}
165165
sql.append("ORDER BY USER_ID ASC Limit ? offset ?;");

‎src/main/java/org/support/project/web/logic/HttpRequestCheckLogic.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,10 @@ public void setCSRFTocken(InvokeTarget invokeTarget, HttpServletRequest request,
171171
tokens = new CSRFTokens();
172172
session.setAttribute(CSRF_TOKENS, tokens);
173173
}
174-
tokens.addToken(tokenkey);
174+
String result = tokens.addToken(tokenkey);
175+
if (LOG.isDebugEnabled()) {
176+
LOG.debug("Add token to CSRF_TOKENS. key:" + tokenkey + " token:" + result);
177+
}
175178
try {
176179
HttpUtil.setCookie(request, response, CSRF_TOKENS, SerializeUtils.objectToBase64(tokens));
177180
} catch (SerializeException e) {
@@ -185,7 +188,7 @@ public void setCSRFTocken(InvokeTarget invokeTarget, HttpServletRequest request,
185188
}
186189
String reqid = reqids.addToken(tokenkey);
187190
if (LOG.isDebugEnabled()) {
188-
LOG.debug("Req Token : " + reqid);
191+
LOG.debug("Add token to CSRF_REQIDS. key:" + tokenkey + " token:" + reqid);
189192
}
190193
request.setAttribute(REQ_ID_KEY, reqid);
191194
}
@@ -230,6 +233,7 @@ public boolean checkCSRF(InvokeTarget invokeTarget, HttpServletRequest request)
230233
}
231234

232235
if (isCheckReqToken(invokeTarget)) {
236+
// HiddenパラメータにRequestTokenがセットされているかチェックする場合
233237
String reqId = request.getParameter(REQ_ID_KEY);
234238
CSRFTokens reqids = (CSRFTokens) session.getAttribute(CSRF_REQIDS);
235239
if (reqids == null) {

‎src/main/java/org/support/project/web/logic/SanitizingLogic.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,8 @@ public boolean apply(String s) {
8585
"var")
8686
.allowAttributes("id").matching(HTML_ID).globally()
8787
.allowAttributes("slide").matching(NUMBER).globally()
88+
.allowAttributes("transition").matching(HTML_CLASS).globally()
89+
.allowAttributes("centered").matching(HTML_CLASS).globally()
8890
.allowAttributes("class").matching(HTML_CLASS).globally()
8991
.allowAttributes("lang").matching(Pattern.compile("[a-zA-Z]{2,20}")).globally()
9092
.allowAttributes("title").matching(HTML_TITLE).globally()

0 commit comments

Comments
 (0)