added SSRF

Author: abel.rincon

src/main/java/org/hdivsamples/controllers/DashboardController.java

@@ -9,6 +9,7 @@
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.OutputStream;
+import java.net.URL;
 import java.security.Principal;
 import java.util.List;
 
@@ -23,6 +24,7 @@
 import org.hdivsamples.dao.CashAccountDao;
 import org.hdivsamples.dao.CreditAccountDao;
 import org.hdivsamples.facade.StorageFacade;
+import org.hdivsamples.util.InsecureBankUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -91,6 +93,16 @@ public void getImage(final HttpServletResponse response, @RequestParam(value = "
 		}
 	}
 
+	@RequestMapping(value = "/userDetail/creditCardImage", method = RequestMethod.GET)
+	public void getCreditCardImage(@RequestParam(value = "url") final String image, HttpServletResponse response) throws IOException {
+		String downLoadImgFileName = InsecureBankUtils.getNameWithoutExtension(image) + "." + InsecureBankUtils.getFileExtension(image);
+		// download
+		response.setHeader( "content-disposition", "attachment;fileName=" + downLoadImgFileName);
+		URL u = new URL(image);
+		writeResponse(u.openStream(),response.getOutputStream());
+	}
+	
+
 	@RequestMapping(value = "/userDetail/avatar/update", method = RequestMethod.POST)
 	public String updateAvatar(@RequestParam("imageFile") final MultipartFile imageFile, final Principal principal,
 			final RedirectAttributes redirectAttributes) {

src/main/java/org/hdivsamples/util/InsecureBankUtils.java

@@ -1,5 +1,9 @@
 package org.hdivsamples.util;
 
+import com.google.common.base.Preconditions;
+
+import java.io.File;
+
 public abstract class InsecureBankUtils {
 
 	public static double round(double value, final int places) {
@@ -11,4 +15,17 @@ public static double round(double value, final int places) {
 		long tmp = Math.round(value);
 		return (double) tmp / factor;
 	}
+	public static String getFileExtension(String fullName) {
+		Preconditions.checkNotNull(fullName);
+		String fileName = (new File(fullName)).getName();
+		int dotIndex = fileName.lastIndexOf('.');
+		return dotIndex == -1 ? "" : fileName.substring(dotIndex + 1);
+	}
+
+	public static String getNameWithoutExtension(String file) {
+		Preconditions.checkNotNull(file);
+		String fileName = (new File(file)).getName();
+		int dotIndex = fileName.lastIndexOf('.');
+		return dotIndex == -1 ? fileName : fileName.substring(0, dotIndex);
+	}
 }

src/main/resources/creditCards/amex.png

@@ -159,15 +159,22 @@
 														<c:forEach items="${creditAccounts}" var="credit">
 															<tr>
 																<td>
-																<c:if test="${fn:contains(credit.description, 'Visa')}">
-																   <i class="fa fa-cc-visa"></i>
-																</c:if>
-																<c:if test="${fn:contains(credit.description, 'AmEx')}">
-																   <i class="fa fa-cc-amex"></i>
-																</c:if>
-																<c:if test="${fn:contains(credit.description, 'Master')}">
-																	<i class="fa fa-cc-mastercard"></i>
-																</c:if>																														
+                                                                  <c:if test="${fn:contains(credit.description, 'Visa')}">
+                                                                    <spring:url value="/dashboard/userDetail/creditCardImage" var="cardIcon" htmlEscape="true" >
+                                                                   		<spring:param name="url" value="classpath:creditCards/visa.png"></spring:param>
+                                                             		</spring:url>
+                                                             	  </c:if>
+                                                             	  <c:if test="${fn:contains(credit.description, 'AmEx')}">
+                                                             	    <spring:url value="/dashboard/userDetail/creditCardImage" var="cardIcon" htmlEscape="true" >
+                                                                      <spring:param name="url" value="classpath:creditCards/amex.png"></spring:param>
+                                                                    </spring:url>
+                                                             	  </c:if>
+                                                             	  <c:if test="${fn:contains(credit.description, 'Master')}">
+                                                                    <spring:url value="/dashboard/userDetail/creditCardImage" var="cardIcon" htmlEscape="true" >
+                                                                      <spring:param name="url" value="classpath:creditCards/mastercard.png"></spring:param>
+                                                                    </spring:url>
+                                                                  </c:if>
+										                           <img id="card-ico" src="${cardIcon}" class="img-thumbnail" alt="card" style="border:solid 1px grey;cursor:pointer;" />
 																<c:out value="${credit.number}"/></td>
 																<td><c:out value="${credit.description}"/></td>																		
 															</tr>