AntiCsrfHelper extends ComponentSupport { public boolean isAccessAllowed(final HttpServletRequest httpRequest) { if (!enabled) { return true; } return isSafeHttpMethod(httpRequest) || isMultiPartFormDataPost(httpRequest) || isNotBrowserRequest(httpRequest) || isAntiCsrfTokenValid(httpRequest, Optional.ofNullable(httpRequest.getHeader(ANTI_CSRF_TOKEN_NAME))); } @Inject  AntiCsrfHelper(
      @Named("${nexus.security.anticsrftoken.enabled:-true}") final boolean enabled,
      @Named("${nexus.security.anticsrftoken.whitelist}") @Nullable final String whitelist); boolean isAccessAllowed(final HttpServletRequest httpRequest); void requireValidToken(final HttpServletRequest httpRequest, @Nullable final String token); boolean isEnabled(); static final String ENABLED; static final String ERROR_MESSAGE_TOKEN_MISMATCH; static final String ANTI_CSRF_TOKEN_NAME; }
@Test public void testIsAccessAllowed_Disabled() { underTest = new AntiCsrfHelper(false, ""); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); verifyZeroInteractions(httpServletRequest); }
@Test public void testIsAccessAllowed_SafeMethodsAllowed() { when(httpServletRequest.getMethod()).thenReturn(HttpMethod.HEAD); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.GET); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); }
@Test public void testIsAccessAllowed_UnsafeMethodsBlocked() { when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)).thenReturn(BROWSER_UA); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); assertThat(underTest.isAccessAllowed(httpServletRequest), is(false)); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.PUT); assertThat(underTest.isAccessAllowed(httpServletRequest), is(false)); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.DELETE); assertThat(underTest.isAccessAllowed(httpServletRequest), is(false)); }
@Test public void testIsAccessAllowed_NotBrowser() { when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)).thenReturn(CLIENT_UA); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); }
@Test public void testIsAccessAllowed_PowerShell() { when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)) .thenReturn("Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CA) WindowsPowerShell/5.1.17134.590"); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); }
@Test public void shouldGrantAccessWhenUserAgentIsWhiteListed() { underTest = new AntiCsrfHelper(true, "foo"); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)) .thenReturn("Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CA) foo/5.1.17134.590"); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); underTest = new AntiCsrfHelper(true, "foo,bar"); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)) .thenReturn("Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CA) foo/5.1.17134.590"); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)) .thenReturn("Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CA) bar/5.1.17134.590"); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); }
@Test public void shouldAllowAccessWhenUserAgentIsNull() { underTest = new AntiCsrfHelper(true, EMPTY); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); }
@Test public void shouldAlwaysAllowAccessForWindowsPowerShell() { underTest = new AntiCsrfHelper(true, EMPTY); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)) .thenReturn("Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CA) WindowsPowerShell/5.1.17134.590") .thenReturn("Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CA) PowerShell/6.2.55342.442"); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); }
@Test public void shouldDenyAccessWhenUserAgentIsNotWhiteListed() { underTest = new AntiCsrfHelper(true, "foo"); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)) .thenReturn("Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CA) bar/5.1.17134.590"); assertThat(underTest.isAccessAllowed(httpServletRequest), is(false)); }
@Test public void testIsAccessAllowed_ValidCsrfToken() { when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)).thenReturn(BROWSER_UA); when(httpServletRequest.getHeader("NX-ANTI-CSRF-TOKEN")).thenReturn("avalue"); when(httpServletRequest.getCookies()).thenReturn(new Cookie[] { new Cookie("NX-ANTI-CSRF-TOKEN", "avalue") }); assertThat(underTest.isAccessAllowed(httpServletRequest), is(true)); verify(httpServletRequest, times(1)).getCookies(); }
@Test public void testIsAccessAllowed_MissingCsrfCookie() { when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)).thenReturn(BROWSER_UA); when(httpServletRequest.getHeader("NX-ANTI-CSRF-TOKEN")).thenReturn("avalue"); assertThat(underTest.isAccessAllowed(httpServletRequest), is(false)); verify(httpServletRequest, times(1)).getCookies(); }
@Test public void testIsAccessAllowed_MissingCsrfHeader() { when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)).thenReturn(BROWSER_UA); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); when(httpServletRequest.getCookies()).thenReturn(new Cookie[] { new Cookie("NX-ANTI-CSRF-TOKEN", "avalue") }); assertThat(underTest.isAccessAllowed(httpServletRequest), is(false)); verify(httpServletRequest, times(1)).getCookies(); }
@Test public void testIsAccessAllowed_MismatchedCsrfToken() { when(httpServletRequest.getHeader(HttpHeaders.USER_AGENT)).thenReturn(BROWSER_UA); when(httpServletRequest.getMethod()).thenReturn(HttpMethod.POST); when(httpServletRequest.getHeader(HttpHeaders.REFERER)).thenReturn("referrer"); when(httpServletRequest.getHeader("NX-ANTI-CSRF-TOKEN")).thenReturn("some-value"); when(httpServletRequest.getCookies()) .thenReturn(new Cookie[] { new Cookie("NX-ANTI-CSRF-TOKEN", "some-other-value") }); assertThat(underTest.isAccessAllowed(httpServletRequest), is(false)); verify(httpServletRequest, times(1)).getCookies(); }