fix(#2971): Improve token generation and URL-enode tokens (#2972)

apache · Jun 28, 2024 · 4b1d9e7 · 4b1d9e7
1 parent a38a06e
commit 4b1d9e7
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 2 deletions.
diff --git a/...ampipes-mail/src/main/java/org/apache/streampipes/mail/template/AbstractMailTemplate.java b/...ampipes-mail/src/main/java/org/apache/streampipes/mail/template/AbstractMailTemplate.java
@@ -23,7 +23,10 @@
 import org.apache.streampipes.mail.template.part.LogoPart;
 import org.apache.streampipes.storage.management.StorageDispatcher;
 
+import com.google.common.base.Charsets;
+
 import java.io.IOException;
+import java.net.URLEncoder;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -58,4 +61,8 @@ public String generateTemplate() throws IOException {
     configureTemplate(builder);
     return builder.generateHtmlTemplate();
   }
+
+  protected String encodeUrlPart(String content) {
+    return URLEncoder.encode(content, Charsets.UTF_8);
+  }
 }
diff --git a/...il/src/main/java/org/apache/streampipes/mail/template/AccountActiviationMailTemplate.java b/...il/src/main/java/org/apache/streampipes/mail/template/AccountActiviationMailTemplate.java
@@ -60,6 +60,6 @@ protected void configureTemplate(MailTemplateBuilder builder) {
   }
 
   private String makeLink() {
-    return new LinkPart("/#/activate-account?activationCode=" + this.activationCode).generate();
+    return new LinkPart("/#/activate-account?activationCode=" + encodeUrlPart(this.activationCode)).generate();
   }
 }
diff --git a/...mail/src/main/java/org/apache/streampipes/mail/template/PasswordRecoveryMailTemplate.java b/...mail/src/main/java/org/apache/streampipes/mail/template/PasswordRecoveryMailTemplate.java
@@ -60,6 +60,6 @@ protected void configureTemplate(MailTemplateBuilder builder) {
   }
 
   private String makeLink() {
-    return new LinkPart("/#/set-new-password?recoveryCode=" + this.recoveryCode).generate();
+    return new LinkPart("/#/set-new-password?recoveryCode=" + encodeUrlPart(this.recoveryCode)).generate();
   }
 }
diff --git a/...ment/src/main/java/org/apache/streampipes/user/management/util/SecureStringGenerator.java b/...ment/src/main/java/org/apache/streampipes/user/management/util/SecureStringGenerator.java
@@ -18,16 +18,28 @@
 
 package org.apache.streampipes.user.management.util;
 
+import org.apache.commons.text.CharacterPredicate;
 import org.apache.commons.text.RandomStringGenerator;
 
 import java.security.SecureRandom;
 
 public class SecureStringGenerator {
   public String generateSecureString(int length) {
+    // filter for characters allowed in URLs
+    CharacterPredicate includeChars = ch -> (
+        (ch >= 'a' && ch <= 'z')
+            || (ch >= 'A' && ch <= 'Z')
+            || (ch >= '0' && ch <= '9')
+            || ch == '-' || ch == '_' || ch == '.'
+            || ch == '!' || ch == '*' || ch == '(' || ch == ')'
+            || ch == ':' || ch == '@' || ch == '='
+            || ch == '+' || ch == '$' || ch == ','
+    );
     // allowing all ASCII-characters from decimal id 33 to 125
     // see https://www.cs.cmu.edu/~pattis/15-1XX/common/handouts/ascii.html for full list
     var pwdGenerator = new RandomStringGenerator.Builder().usingRandom(new SecureRandom()::nextInt)
         .withinRange(33, 125)
+        .filteredBy(includeChars)
         .build();
     return pwdGenerator.generate(length);
   }