1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52 package org.vectomatic.svg.edit.server;
53
54 import java.io.IOException;
55 import java.io.InputStream;
56 import java.io.OutputStream;
57 import java.net.InetAddress;
58 import java.net.URL;
59 import java.net.UnknownHostException;
60
61 import javax.servlet.ServletConfig;
62 import javax.servlet.ServletException;
63 import javax.servlet.http.HttpServlet;
64 import javax.servlet.http.HttpServletRequest;
65 import javax.servlet.http.HttpServletResponse;
66
67 import org.apache.log4j.Logger;
68 import org.vectomatic.svg.edit.client.load.FetchUtils;
69
70
71
72
73
74 public class FetchServlet extends HttpServlet {
75 private static Logger logger = Logger.getLogger(FetchServlet.class);
76 private static final long serialVersionUID = 1L;
77 private static final int MAX_SIZE = 5 * 1024 * 1024;
78 private static final String HTTP_PROTOCOL = "http";
79 private String hostname;
80
81
82
83
84 public FetchServlet() {
85 }
86
87 @Override
88 public void init(ServletConfig config) throws ServletException {
89 try {
90 InetAddress addr = InetAddress.getLocalHost();
91 hostname = addr.getHostName();
92 } catch (UnknownHostException e) {
93 logger.error("Cannot get host name", e);
94 }
95 }
96
97
98
99
100 @Override
101 protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
102 URL url = new URL(request.getParameter(FetchUtils.FETCH_URL_PARAM));
103 String contentType = request.getParameter(FetchUtils.FETCH_TYPE_PARAM);
104 logger.info("Fetching: " + url.toExternalForm() + " contentType: " + contentType);
105
106 if (!HTTP_PROTOCOL.equals(url.getProtocol())) {
107 logger.error("Unsupported protocol: " + url.toExternalForm());
108 response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Unsupported protocol: " + url.getProtocol());
109 return;
110 } else {
111 String host = url.getHost();
112 if (host.startsWith("localhost") || host.startsWith(hostname) || host.startsWith("127.0.0.1")) {
113 logger.error("Access not permitted: " + url.toExternalForm());
114 response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access not permitted: " + url);
115 return;
116 }
117 InputStream istream = null;
118 OutputStream ostream = null;
119 try {
120
121 istream = url.openStream();
122 } catch(IOException e) {
123 logger.error("Not found: " + url.toExternalForm());
124 response.sendError(HttpServletResponse.SC_NOT_FOUND, "Not found: " + url.getProtocol());
125 return;
126 }
127 try {
128 if (contentType != null) {
129 response.setContentType(contentType);
130 }
131 ostream = response.getOutputStream();
132
133 byte[] buffer = new byte[4096];
134 int length, totalLength = 0;
135 while ((totalLength <= MAX_SIZE) && ((length = istream.read(buffer)) != -1)) {
136 ostream.write(buffer, 0, length);
137 totalLength += length;
138 }
139 if (totalLength > MAX_SIZE) {
140 logger.error("Size limit exceeded: " + url.toExternalForm());
141 return;
142 }
143 } catch(Throwable t) {
144 logger.error("Load error: " + url.toExternalForm() + " " + t.getMessage());
145 } finally {
146 if (istream != null) {
147 istream.close();
148 }
149 if (ostream != null) {
150 ostream.close();
151 }
152 }
153 }
154 }
155 }