Skip to content

Commit 06af47e

Browse files
ranjanihranjani2412
ranjanih
and
ranjani2412
authored
Spring CSRF (thombergs#223)
* Initial test commit * Update UN PWD * Updates * Updates * Updates * Test updates * Updates to tests * Updates to code * Update README Co-authored-by: ranjani2412 <[email protected]>
1 parent f96a022 commit 06af47e

40 files changed

+2675
-0
lines changed

‎spring-boot/csrf/AttackerApplication/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Project exclude paths
2+
/target/

‎spring-boot/csrf/AttackerApplication/.mvn/wrapper/MavenWrapperDownloader.java‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
/*
2+
* Copyright 2007-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
import java.net.*;
17+
import java.io.*;
18+
import java.nio.channels.*;
19+
import java.util.Properties;
20+
21+
public class MavenWrapperDownloader {
22+
23+
private static final String WRAPPER_VERSION = "0.5.6";
24+
/**
25+
* Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided.
26+
*/
27+
private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/"
28+
+ WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar";
29+
30+
/**
31+
* Path to the maven-wrapper.properties file, which might contain a downloadUrl property to
32+
* use instead of the default one.
33+
*/
34+
private static final String MAVEN_WRAPPER_PROPERTIES_PATH =
35+
".mvn/wrapper/maven-wrapper.properties";
36+
37+
/**
38+
* Path where the maven-wrapper.jar will be saved to.
39+
*/
40+
private static final String MAVEN_WRAPPER_JAR_PATH =
41+
".mvn/wrapper/maven-wrapper.jar";
42+
43+
/**
44+
* Name of the property which should be used to override the default download url for the wrapper.
45+
*/
46+
private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl";
47+
48+
public static void main(String args[]) {
49+
System.out.println("- Downloader started");
50+
File baseDirectory = new File(args[0]);
51+
System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath());
52+
53+
// If the maven-wrapper.properties exists, read it and check if it contains a custom
54+
// wrapperUrl parameter.
55+
File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH);
56+
String url = DEFAULT_DOWNLOAD_URL;
57+
if(mavenWrapperPropertyFile.exists()) {
58+
FileInputStream mavenWrapperPropertyFileInputStream = null;
59+
try {
60+
mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile);
61+
Properties mavenWrapperProperties = new Properties();
62+
mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream);
63+
url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url);
64+
} catch (IOException e) {
65+
System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'");
66+
} finally {
67+
try {
68+
if(mavenWrapperPropertyFileInputStream != null) {
69+
mavenWrapperPropertyFileInputStream.close();
70+
}
71+
} catch (IOException e) {
72+
// Ignore ...
73+
}
74+
}
75+
}
76+
System.out.println("- Downloading from: " + url);
77+
78+
File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH);
79+
if(!outputFile.getParentFile().exists()) {
80+
if(!outputFile.getParentFile().mkdirs()) {
81+
System.out.println(
82+
"- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'");
83+
}
84+
}
85+
System.out.println("- Downloading to: " + outputFile.getAbsolutePath());
86+
try {
87+
downloadFileFromURL(url, outputFile);
88+
System.out.println("Done");
89+
System.exit(0);
90+
} catch (Throwable e) {
91+
System.out.println("- Error downloading");
92+
e.printStackTrace();
93+
System.exit(1);
94+
}
95+
}
96+
97+
private static void downloadFileFromURL(String urlString, File destination) throws Exception {
98+
if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) {
99+
String username = System.getenv("MVNW_USERNAME");
100+
char[] password = System.getenv("MVNW_PASSWORD").toCharArray();
101+
Authenticator.setDefault(new Authenticator() {
102+
@Override
103+
protected PasswordAuthentication getPasswordAuthentication() {
104+
return new PasswordAuthentication(username, password);
105+
}
106+
});
107+
}
108+
URL website = new URL(urlString);
109+
ReadableByteChannel rbc;
110+
rbc = Channels.newChannel(website.openStream());
111+
FileOutputStream fos = new FileOutputStream(destination);
112+
fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
113+
fos.close();
114+
rbc.close();
115+
}
116+
117+
}

‎spring-boot/csrf/AttackerApplication/.mvn/wrapper/maven-wrapper.jar‎

49.5 KB
Binary file not shown.

‎spring-boot/csrf/AttackerApplication/.mvn/wrapper/maven-wrapper.properties‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip
2+
wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar

‎spring-boot/csrf/AttackerApplication/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# A sample Spring Web application
2+
A sample Spring Web application that uses Spring Boot and thymeleaf
3+
4+
## Details
5+
* It uses Spring Boot to create REST endpoints
6+
* It uses Maven and Java11 to build and run.
7+
8+
## How to run
9+
* Clone this project
10+
* Use maven command: `mvn clean verify spring-boot:run`
11+
* The application should run at `http://localhost:8091`

‎spring-boot/csrf/AttackerApplication/checkstyle-suppressions.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE suppressions PUBLIC
3+
"-//Checkstyle//DTD SuppressionFilter Configuration 1.2//EN"
4+
"https://checkstyle.org/dtds/suppressions_1_2.dtd">
5+
<suppressions>
6+
<suppress files="[/\\]target[/\\]generated-sources[/\\]" checks=".*" />
7+
</suppressions>

‎spring-boot/csrf/AttackerApplication/checkstyle.xml‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE module PUBLIC
3+
"-//Checkstyle//DTD Checkstyle Configuration 1.3//EN"
4+
"https://checkstyle.org/dtds/configuration_1_3.dtd">
5+
6+
<module name="Checker">
7+
<property name="charset" value="UTF-8"/>
8+
9+
<property name="severity" value="error"/>
10+
11+
<property name="fileExtensions" value="java, properties, xml"/>
12+
13+
<module name="BeforeExecutionExclusionFileFilter">
14+
<property name="fileNamePattern" value="module\-info\.java$"/>
15+
</module>
16+
17+
<module name="FileTabCharacter">
18+
<property name="eachLine" value="true"/>
19+
</module>
20+
21+
<module name="LineLength">
22+
<property name="max" value="120"/>
23+
<property name="ignorePattern" value="^package.*|^import.*|a href|href|http://|https://|ftp://"/>
24+
</module>
25+
26+
<module name="TreeWalker">
27+
<module name="OuterTypeFilename"/>
28+
<module name="IllegalTokenText">
29+
<property name="tokens" value="STRING_LITERAL, CHAR_LITERAL"/>
30+
<property name="format"
31+
value="\\u00(09|0(a|A)|0(c|C)|0(d|D)|22|27|5(C|c))|\\(0(10|11|12|14|15|42|47)|134)"/>
32+
<property name="message"
33+
value="Consider using special escape sequence instead of octal value or Unicode escaped value."/>
34+
</module>
35+
<module name="AvoidEscapedUnicodeCharacters">
36+
<property name="allowEscapesForControlCharacters" value="true"/>
37+
<property name="allowByTailComment" value="true"/>
38+
<property name="allowNonPrintableEscapes" value="true"/>
39+
</module>
40+
<module name="OneTopLevelClass"/>
41+
<module name="NoLineWrap"/>
42+
<module name="EmptyBlock">
43+
<property name="option" value="TEXT"/>
44+
<property name="tokens"
45+
value="LITERAL_TRY, LITERAL_FINALLY, LITERAL_IF, LITERAL_ELSE, LITERAL_SWITCH"/>
46+
</module>
47+
<module name="LeftCurly"/>
48+
<module name="RightCurly">
49+
<property name="id" value="RightCurlySame"/>
50+
<property name="tokens"
51+
value="LITERAL_TRY, LITERAL_CATCH, LITERAL_FINALLY, LITERAL_IF, LITERAL_ELSE,
52+
LITERAL_DO"/>
53+
</module>
54+
<module name="RightCurly">
55+
<property name="id" value="RightCurlyAlone"/>
56+
<property name="option" value="alone"/>
57+
<property name="tokens"
58+
value="CLASS_DEF, METHOD_DEF, CTOR_DEF, LITERAL_FOR, LITERAL_WHILE, STATIC_INIT,
59+
INSTANCE_INIT"/>
60+
</module>
61+
<module name="WhitespaceAround">
62+
<property name="allowEmptyConstructors" value="true"/>
63+
<property name="allowEmptyLambdas" value="true"/>
64+
<property name="allowEmptyMethods" value="true"/>
65+
<property name="allowEmptyTypes" value="true"/>
66+
<property name="allowEmptyLoops" value="true"/>
67+
<message key="ws.notFollowed"
68+
value="WhitespaceAround: ''{0}'' is not followed by whitespace. Empty blocks may only be represented as '{}' when not part of a multi-block statement (4.1.3)"/>
69+
<message key="ws.notPreceded"
70+
value="WhitespaceAround: ''{0}'' is not preceded with whitespace."/>
71+
</module>
72+
<module name="OneStatementPerLine"/>
73+
<module name="MultipleVariableDeclarations"/>
74+
<module name="ArrayTypeStyle"/>
75+
<module name="MissingSwitchDefault"/>
76+
<module name="FallThrough"/>
77+
<module name="UpperEll"/>
78+
<module name="ModifierOrder"/>
79+
<module name="SeparatorWrap">
80+
<property name="id" value="SeparatorWrapDot"/>
81+
<property name="tokens" value="DOT"/>
82+
<property name="option" value="nl"/>
83+
</module>
84+
<module name="SeparatorWrap">
85+
<property name="id" value="SeparatorWrapComma"/>
86+
<property name="tokens" value="COMMA"/>
87+
<property name="option" value="EOL"/>
88+
</module>
89+
<module name="SeparatorWrap">
90+
<!-- ELLIPSIS is EOL until https://github.com/google/styleguide/issues/258 -->
91+
<property name="id" value="SeparatorWrapEllipsis"/>
92+
<property name="tokens" value="ELLIPSIS"/>
93+
<property name="option" value="EOL"/>
94+
</module>
95+
<module name="SeparatorWrap">
96+
<!-- ARRAY_DECLARATOR is EOL until https://github.com/google/styleguide/issues/259 -->
97+
<property name="id" value="SeparatorWrapArrayDeclarator"/>
98+
<property name="tokens" value="ARRAY_DECLARATOR"/>
99+
<property name="option" value="EOL"/>
100+
</module>
101+
<module name="SeparatorWrap">
102+
<property name="id" value="SeparatorWrapMethodRef"/>
103+
<property name="tokens" value="METHOD_REF"/>
104+
<property name="option" value="nl"/>
105+
</module>
106+
<module name="PackageName">
107+
<property name="format" value="^[a-z]+(\.[a-z][a-z0-9]*)*$"/>
108+
<message key="name.invalidPattern"
109+
value="Package name ''{0}'' must match pattern ''{1}''."/>
110+
</module>
111+
<module name="TypeName">
112+
<message key="name.invalidPattern"
113+
value="Type name ''{0}'' must match pattern ''{1}''."/>
114+
</module>
115+
<module name="MemberName">
116+
<property name="format" value="^[a-z][a-z0-9][a-zA-Z0-9]*$"/>
117+
<message key="name.invalidPattern"
118+
value="Member name ''{0}'' must match pattern ''{1}''."/>
119+
</module>
120+
<module name="ParameterName">
121+
<property name="format" value="^[a-z]([a-z0-9][a-zA-Z0-9]*)?$"/>
122+
<message key="name.invalidPattern"
123+
value="Parameter name ''{0}'' must match pattern ''{1}''."/>
124+
</module>
125+
<module name="ParameterNumber"/>
126+
<module name="LambdaParameterName">
127+
<property name="format" value="^[a-z]([a-z0-9][a-zA-Z0-9]*)?$"/>
128+
<message key="name.invalidPattern"
129+
value="Lambda parameter name ''{0}'' must match pattern ''{1}''."/>
130+
</module>
131+
<module name="CatchParameterName">
132+
<property name="format" value="^[a-z]([a-z0-9][a-zA-Z0-9]*)?$"/>
133+
<message key="name.invalidPattern"
134+
value="Catch parameter name ''{0}'' must match pattern ''{1}''."/>
135+
</module>
136+
<module name="LocalVariableName">
137+
<property name="tokens" value="VARIABLE_DEF"/>
138+
<property name="format" value="^[a-z]([a-z0-9][a-zA-Z0-9]*)?$"/>
139+
<message key="name.invalidPattern"
140+
value="Local variable name ''{0}'' must match pattern ''{1}''."/>
141+
</module>
142+
<module name="ClassTypeParameterName">
143+
<property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
144+
<message key="name.invalidPattern"
145+
value="Class type name ''{0}'' must match pattern ''{1}''."/>
146+
</module>
147+
<module name="MethodTypeParameterName">
148+
<property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
149+
<message key="name.invalidPattern"
150+
value="Method type name ''{0}'' must match pattern ''{1}''."/>
151+
</module>
152+
<module name="InterfaceTypeParameterName">
153+
<property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
154+
<message key="name.invalidPattern"
155+
value="Interface type name ''{0}'' must match pattern ''{1}''."/>
156+
</module>
157+
<module name="NoFinalizer"/>
158+
<module name="GenericWhitespace">
159+
<message key="ws.followed"
160+
value="GenericWhitespace ''{0}'' is followed by whitespace."/>
161+
<message key="ws.preceded"
162+
value="GenericWhitespace ''{0}'' is preceded with whitespace."/>
163+
<message key="ws.illegalFollow"
164+
value="GenericWhitespace ''{0}'' should followed by whitespace."/>
165+
<message key="ws.notPreceded"
166+
value="GenericWhitespace ''{0}'' is not preceded with whitespace."/>
167+
</module>
168+
<module name="Indentation">
169+
<property name="basicOffset" value="4"/>
170+
<property name="braceAdjustment" value="0"/>
171+
<property name="caseIndent" value="4"/>
172+
<property name="throwsIndent" value="8"/>
173+
<property name="lineWrappingIndentation" value="8"/>
174+
<property name="arrayInitIndent" value="4"/>
175+
</module>
176+
<module name="AbbreviationAsWordInName">
177+
<property name="ignoreFinal" value="false"/>
178+
<property name="allowedAbbreviationLength" value="1"/>
179+
</module>
180+
<module name="OverloadMethodsDeclarationOrder"/>
181+
<module name="VariableDeclarationUsageDistance"/>
182+
<module name="CustomImportOrder">
183+
<property name="customImportOrderRules"
184+
value="THIRD_PARTY_PACKAGE###SPECIAL_IMPORTS###STANDARD_JAVA_PACKAGE###STATIC"/>
185+
<property name="specialImportsRegExp" value="^javax\."/>
186+
<property name="standardPackageRegExp" value="^java\."/>
187+
<property name="sortImportsInGroupAlphabetically" value="true"/>
188+
<property name="separateLineBetweenGroups" value="false"/>
189+
</module>
190+
<module name="MethodParamPad"/>
191+
<module name="NoWhitespaceBefore">
192+
<property name="tokens"
193+
value="COMMA, SEMI, POST_INC, POST_DEC, DOT, ELLIPSIS, METHOD_REF"/>
194+
<property name="allowLineBreaks" value="true"/>
195+
</module>
196+
<module name="ParenPad"/>
197+
<module name="OperatorWrap">
198+
<property name="option" value="eol"/>
199+
<property name="tokens"
200+
value="BAND, BOR, BSR, BXOR, DIV, EQUAL, GE, GT, LAND, LE, LITERAL_INSTANCEOF, LOR,
201+
LT, MINUS, MOD, NOT_EQUAL, PLUS, QUESTION, SL, SR, STAR, METHOD_REF "/>
202+
</module>
203+
<module name="AnnotationLocation">
204+
<property name="id" value="AnnotationLocationMostCases"/>
205+
<property name="tokens"
206+
value="CLASS_DEF, INTERFACE_DEF, ENUM_DEF, METHOD_DEF, CTOR_DEF"/>
207+
</module>
208+
<module name="AnnotationLocation">
209+
<property name="id" value="AnnotationLocationVariables"/>
210+
<property name="tokens" value="VARIABLE_DEF"/>
211+
<property name="allowSamelineMultipleAnnotations" value="true"/>
212+
</module>
213+
<module name="NonEmptyAtclauseDescription"/>
214+
<module name="JavadocTagContinuationIndentation"/>
215+
<module name="SummaryJavadoc">
216+
<property name="forbiddenSummaryFragments"
217+
value="^@return the *|^This method returns |^A [{]@code [a-zA-Z0-9]+[}]( is a )"/>
218+
</module>
219+
<module name="JavadocParagraph"/>
220+
<module name="AtclauseOrder">
221+
<property name="tagOrder" value="@param, @return, @throws, @deprecated"/>
222+
<property name="target"
223+
value="CLASS_DEF, INTERFACE_DEF, ENUM_DEF, METHOD_DEF, CTOR_DEF, VARIABLE_DEF"/>
224+
</module>
225+
<module name="JavadocMethod">
226+
<property name="scope" value="public"/>
227+
<property name="allowedAnnotations" value="Override, Test"/>
228+
</module>
229+
<module name="MethodName">
230+
<property name="format" value="^[a-z][a-z0-9][a-zA-Z0-9_]*$"/>
231+
<message key="name.invalidPattern"
232+
value="Method name ''{0}'' must match pattern ''{1}''."/>
233+
</module>
234+
<module name="SingleLineJavadoc">
235+
<property name="ignoreInlineTags" value="false"/>
236+
</module>
237+
<module name="EmptyCatchBlock">
238+
<property name="exceptionVariableName" value="expected"/>
239+
</module>
240+
<module name="CommentsIndentation"/>
241+
<module name="AvoidNestedBlocks"/>
242+
<module name="AbstractClassName"/>
243+
<module name="CyclomaticComplexity"/>
244+
<module name="EmptyStatement"/>
245+
</module>
246+
</module>

0 commit comments

Comments
 (0)