61static std::once_flag d_ah_init_once;
70 std::call_once(d_ah_init_once, AllowedHosts::initialize_instance);
74AllowedHosts::AllowedHosts() {
76 string key = ALLOWED_HOSTS_BES_KEY;
79 throw BESInternalError(
string(
"The allowed hosts key, '") + ALLOWED_HOSTS_BES_KEY
80 +
"' has not been configured.", __FILE__, __LINE__);
87void AllowedHosts::initialize_instance() {
88 d_instance =
new AllowedHosts();
90 atexit(delete_instance);
97void AllowedHosts::delete_instance() {
119 BESDEBUG(MODULE, prolog <<
"BEGIN candidate_url: " << candidate_url->str() << endl);
120 bool isAllowed =
false;
124 if (candidate_url->protocol() == FILE_PROTOCOL) {
129 string file_path = candidate_url->path();
130 BESDEBUG(MODULE, prolog <<
" file_path: '" << file_path <<
131 "' (length: " << file_path.length() <<
" size: " << file_path.size() <<
")" <<endl);
135 BESDEBUG(MODULE, prolog <<
"Searching for catalog named: '" << default_catalog_name <<
"'" << endl);
136 BESCatalog *bcat = bcl->find_catalog(default_catalog_name);
138 BESDEBUG(MODULE, prolog <<
"Found catalog named: '" << bcat->
get_catalog_name() <<
"'" << endl);
140 string error_msg =
"INTERNAL_ERROR: Unable to locate default catalog. Check BES configuration.";
141 BESDEBUG(MODULE, prolog << error_msg << endl);
145 string catalog_root = bcat->
get_root();
146 BESDEBUG(MODULE, prolog <<
"catalog_root: '" << catalog_root <<
147 "' (length: " << catalog_root.length() <<
" size: " << catalog_root.size() <<
")" << endl);
149 string relative_path;
150 if (file_path[0] ==
'/') {
151 if (file_path.length() < catalog_root.length()) {
153 why_not =
"Path is out of scope from configuration.";
156 BESDEBUG(MODULE, prolog <<
"file_path: " << file_path << endl);
157 BESDEBUG(MODULE, prolog <<
"catalog_root: " << catalog_root << endl);
158 size_t ret = file_path.find(catalog_root);
159 BESDEBUG(MODULE, prolog <<
"file_path.find(catalog_root): " << ret << endl);
160 isAllowed = (ret == 0);
161 relative_path = file_path.substr(catalog_root.length());
162 BESDEBUG(MODULE, prolog <<
"relative_path: " << relative_path << endl);
163 BESDEBUG(MODULE, prolog <<
"isAllowed: " << (isAllowed?
"true":
"false") << endl);
167 BESDEBUG(MODULE, prolog <<
"Relative path detected");
168 relative_path = file_path;
191 BESDEBUG(MODULE, prolog <<
"File Access Allowed: " << (isAllowed ?
"true " :
"false ") << endl);
192 }
else if(candidate_url->protocol() == HTTPS_PROTOCOL || candidate_url->protocol() == HTTP_PROTOCOL ){
194 isAllowed = candidate_url->is_trusted() || check(candidate_url->str());
196 if (candidate_url->is_trusted()) {
197 INFO_LOG(prolog <<
"Candidate URL is marked trusted, allowing. url: " << candidate_url->str() << endl);
199 BESDEBUG(MODULE, prolog <<
"HTTP Access Allowed: " << (isAllowed ?
"true " :
"false ") << endl);
203 ss <<
"The candidate_url utilizes an unsupported protocol '" << candidate_url->protocol() <<
"'" ;
204 BESDEBUG(MODULE, prolog << ss.str() << endl);
207 BESDEBUG(MODULE, prolog <<
"END Access Allowed: " << (isAllowed ?
"true " :
"false ") << endl);
213bool AllowedHosts::check(
const std::string &url){
214 bool isAllowed=
false;
215 auto it = d_allowed_hosts.begin();
216 auto end_it = d_allowed_hosts.end();
217 for (; it != end_it && !isAllowed; it++) {
218 string a_regex_pattern = *it;
219 BESRegex reg_expr(a_regex_pattern.c_str());
220 int match_result = reg_expr.match(url.c_str(), url.length());
221 if (match_result >= 0) {
222 auto match_length = (
unsigned int) match_result;
223 if (match_length == url.length()) {
225 prolog <<
"FULL MATCH. pattern: " << a_regex_pattern <<
" url: " << url << endl);
229 prolog <<
"No Match. pattern: " << a_regex_pattern <<
" url: " << url << endl);