CsrfProtectionRefererFilter implements javax.servlet.Filter { public static List<URI> parseAllowedReferers(String allowedReferersConfigProperty) { if (allowedReferersConfigProperty == null || allowedReferersConfigProperty.isEmpty()) { throw new IllegalAllowedReferersException("must not be null or empty", allowedReferersConfigProperty); } String[] split = allowedReferersConfigProperty.split("\\,"); List<URI> allowedReferers = new ArrayList<>(); for (String allowedReferer : split) { if (allowedReferer == null || allowedReferer.isEmpty()) { continue; } else { if (allowedReferer.contains("*")) { throw new IllegalAllowedReferersException("do not support regexs (*)", allowedReferer); } URI uri; try { uri = new URI(allowedReferer); } catch (NullPointerException | IllegalArgumentException | URISyntaxException e) { throw new IllegalAllowedReferersException("includes invalid referer", allowedReferer, e); } if (uri == null) { throw new IllegalAllowedReferersException("must not be null", allowedReferer); } if (uri.getUserInfo() != null) { throw new IllegalAllowedReferersException("must not contain user information", allowedReferer); } if (uri.getPath() != null && !uri.getPath().isEmpty() && !uri.getPath().equals("/")) { throw new IllegalAllowedReferersException("do not support restricting by path", allowedReferer); } if (uri.getFragment() != null) { throw new IllegalAllowedReferersException("do not support restricting by fragment", allowedReferer); } if (uri.getScheme() == null || (!uri.getScheme().equals("http") && !uri.getScheme().equals("https"))) { throw new IllegalAllowedReferersException("must be http or https", allowedReferer); } if (uri.getAuthority() == null || uri.getHost() == null) { throw new IllegalAllowedReferersException("must be hierarchical (e.g. http: } allowedReferers.add(uri); } } if (allowedReferers.isEmpty()) { throw new IllegalAllowedReferersException("Invalid List of allowed csrf referers must not be null or empty", allowedReferersConfigProperty); } return allowedReferers; }  @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain); @Override void destroy(); static List<URI> parseAllowedReferers(String allowedReferersConfigProperty); static boolean isAllowedUri(List<URI> allowedReferers, String referer, boolean isGetRequest); static final String REFERER_HEADER; static final String ALLOWED_REFERERS_PARAM; }
@Test public void testParseThreeAllowedReferers() { List<URI> uris = CsrfProtectionRefererFilter.parseAllowedReferers("http: assertEquals(3, uris.size()); assertUri("http", "my-site.com", 45, uris.get(0)); assertUri("https", "other.site.com", -1, uris.get(1)); assertUri("http", "wherever.edu", -1, uris.get(2)); }
@Test public void testParseAllowedReferersWithLeadingComma() { List<URI> uris = CsrfProtectionRefererFilter.parseAllowedReferers(",https: assertEquals(2, uris.size()); assertUri("https", "other.site.com", -1, uris.get(0)); assertUri("http", "wherever.edu", -1, uris.get(1)); }
@Test public void testParseBlankAllowedRefererInTheMiddle() { List<URI> uris = CsrfProtectionRefererFilter.parseAllowedReferers("http: assertEquals(2, uris.size()); assertUri("http", "my-site.com", 45, uris.get(0)); assertUri("http", "wherever.edu", -1, uris.get(1)); }
@Test public void testParseThreeAllowedReferersWithTrailingComma() { List<URI> uris = CsrfProtectionRefererFilter.parseAllowedReferers("http: assertEquals(3, uris.size()); assertUri("http", "my-site.com", 45, uris.get(0)); assertUri("https", "other.site.com", -1, uris.get(1)); assertUri("http", "wherever.edu", -1, uris.get(2)); }