Examples with PermissionDeniedException org.exist.security.PermissionDeniedException used on opensource projects

Example 46 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class XQueryServlet method process.

/**
 * Processes incoming HTTP requests for XQuery.
 *
 * @param request the http request
 * @param response the http response
 *
 * @throws ServletException if the servlet raises an exception
 * @throws IOException if an I/O error occurs
 */
protected void process(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    // first, adjust the path
    String path = request.getPathTranslated();
    if (path == null) {
        path = request.getRequestURI().substring(request.getContextPath().length());
        final int p = path.lastIndexOf(';');
        if (p != Constants.STRING_NOT_FOUND) {
            path = path.substring(0, p);
        }
        path = getServletContext().getRealPath(path);
    }
    // second, perform descriptor actions
    final Descriptor descriptor = Descriptor.getDescriptorSingleton();
    if (descriptor != null && !descriptor.requestsFiltered()) {
        // logs the request if specified in the descriptor
        descriptor.doLogRequestInReplayLog(request);
        // map's the path if a mapping is specified in the descriptor
        path = descriptor.mapPath(path);
    }
    // if (request.getCharacterEncoding() == null)
    // try {
    // request.setCharacterEncoding(formEncoding);
    // } catch (IllegalStateException e) {
    // }
    final ServletOutputStream sout = response.getOutputStream();
    final PrintWriter output = new PrintWriter(new OutputStreamWriter(sout, getFormEncoding()));
    // response.setContentType(contentType + "; charset=" + formEncoding);
    response.addHeader("pragma", "no-cache");
    response.addHeader("Cache-Control", "no-cache");
    String requestPath = request.getRequestURI();
    final int p = requestPath.lastIndexOf('/');
    if (p != Constants.STRING_NOT_FOUND) {
        requestPath = requestPath.substring(0, p);
    }
    String moduleLoadPath;
    final Object loadPathAttrib = request.getAttribute(ATTR_MODULE_LOAD_PATH);
    if (loadPathAttrib != null) {
        moduleLoadPath = getValue(loadPathAttrib);
    } else {
        moduleLoadPath = getServletContext().getRealPath(requestPath.substring(request.getContextPath().length()));
    }
    Subject user = getDefaultUser();
    // to determine the user, first check the request attribute "xquery.user", then
    // the current session attribute "user"
    final Object userAttrib = request.getAttribute(ATTR_XQUERY_USER);
    final HttpSession session = request.getSession(false);
    if (userAttrib != null || (session != null && request.isRequestedSessionIdValid())) {
        final Object passwdAttrib = request.getAttribute(ATTR_XQUERY_PASSWORD);
        String username;
        String password;
        if (userAttrib != null) {
            username = getValue(userAttrib);
            password = getValue(passwdAttrib);
        } else {
            username = getSessionAttribute(session, "user");
            password = getSessionAttribute(session, "password");
        }
        // TODO authentication should use super.authenticate(...) !!!
        try {
            if (username != null && password != null) {
                Subject newUser = getPool().getSecurityManager().authenticate(username, password);
                if (newUser != null && newUser.isAuthenticated()) {
                    user = newUser;
                }
            }
        } catch (final AuthenticationException e) {
            getLog().error("User can not be authenticated ({}).", username);
        }
    }
    if (user == getDefaultUser()) {
        Subject requestUser = HttpAccount.getUserFromServletRequest(request);
        if (requestUser != null) {
            user = requestUser;
        } else {
            requestUser = getAuthenticator().authenticate(request, response, false);
            if (requestUser != null) {
                user = requestUser;
            }
        }
    }
    Source source = null;
    final Object sourceAttrib = request.getAttribute(ATTR_XQUERY_SOURCE);
    final Object urlAttrib = request.getAttribute(ATTR_XQUERY_URL);
    if (sourceAttrib != null) {
        String s;
        if (sourceAttrib instanceof Item)
            try {
                s = ((Item) sourceAttrib).getStringValue();
            } catch (final XPathException e) {
                throw new ServletException("Failed to read XQuery source string from " + "request attribute '" + ATTR_XQUERY_SOURCE + "': " + e.getMessage(), e);
            }
        else {
            s = sourceAttrib.toString();
        }
        source = new StringSource(s);
    } else if (urlAttrib != null) {
        try (final DBBroker broker = getPool().get(Optional.ofNullable(user))) {
            source = SourceFactory.getSource(broker, moduleLoadPath, urlAttrib.toString(), true);
            if (source == null) {
                final String msg = "Could not read source: context=" + moduleLoadPath + ", location=" + urlAttrib.toString();
                getLog().error(msg);
                response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
                sendError(output, "Error", msg);
            }
        } catch (final Exception e) {
            getLog().error(e.getMessage(), e);
            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
            sendError(output, "Error", e.getMessage());
        }
    } else {
        final Path f = Paths.get(path);
        if (!Files.isReadable(f)) {
            response.setStatus(HttpServletResponse.SC_NOT_FOUND);
            sendError(output, "Cannot read source file", path);
            return;
        }
        source = new FileSource(f, Charset.forName(encoding), true);
    }
    if (source == null) {
        response.setStatus(HttpServletResponse.SC_NOT_FOUND);
        sendError(output, "Source not found", path);
    }
    boolean reportErrors = false;
    final String errorOpt = (String) request.getAttribute(ATTR_XQUERY_REPORT_ERRORS);
    if (errorOpt != null) {
        reportErrors = errorOpt.equalsIgnoreCase("YES");
    }
    // allow source viewing for GET?
    if ("GET".equals(request.getMethod().toUpperCase())) {
        String option;
        boolean allowSource = false;
        if ((option = request.getParameter("_source")) != null)
            allowSource = "yes".equals(option);
        // Should we display the source of the XQuery or execute it
        if (allowSource && descriptor != null) {
            // System.out.println("path="+path);
            if (descriptor.allowSource(path)) {
                if (source instanceof DBSource) {
                    try {
                        ((DBSource) source).validate(user, Permission.READ);
                    } catch (final PermissionDeniedException e) {
                        if (getDefaultUser().equals(user)) {
                            getAuthenticator().sendChallenge(request, response);
                        } else {
                            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Permission to view XQuery source for: " + path + " denied. (no read access)");
                        }
                        return;
                    }
                }
                // Show the source of the XQuery
                // writeResourceAs(resource, broker, stylesheet, encoding, "text/plain", outputProperties, response);
                response.setContentType("text/plain; charset=" + getFormEncoding());
                output.write(source.getContent());
                output.flush();
                return;
            } else {
                response.sendError(HttpServletResponse.SC_FORBIDDEN, "Permission to view XQuery source for: " + path + " denied. Must be explicitly defined in descriptor.xml");
                return;
            }
        }
    }
    // -------------------------------
    // URI baseUri;
    // try {
    // baseUri = new URI(request.getScheme(),
    // null/*user info?*/, request.getLocalPart(), request.getLocalPort(),
    // request.getRequestURI(), null, null);
    // } catch(URISyntaxException e) {
    // baseUri = null;
    // }
    final String requestAttr = (String) request.getAttribute(ATTR_XQUERY_ATTRIBUTE);
    try (final DBBroker broker = getPool().get(Optional.ofNullable(user))) {
        final XQuery xquery = broker.getBrokerPool().getXQueryService();
        CompiledXQuery query = getPool().getXQueryPool().borrowCompiledXQuery(broker, source);
        XQueryContext context;
        if (query == null) {
            context = new XQueryContext(getPool());
            context.setModuleLoadPath(moduleLoadPath);
            try {
                query = xquery.compile(context, source);
            } catch (final XPathException ex) {
                throw new EXistException("Cannot compile xquery: " + ex.getMessage(), ex);
            } catch (final IOException ex) {
                throw new EXistException("I/O exception while compiling xquery: " + ex.getMessage(), ex);
            }
        } else {
            context = query.getContext();
            context.setModuleLoadPath(moduleLoadPath);
            context.prepareForReuse();
        }
        final Properties outputProperties = new Properties();
        outputProperties.put("base-uri", collectionURI.toString());
        final HttpRequestWrapper reqw = new HttpRequestWrapper(request, getFormEncoding(), getContainerEncoding());
        final ResponseWrapper respw = new HttpResponseWrapper(response);
        context.setHttpContext(new XQueryContext.HttpContext(reqw, respw, session != null ? new HttpSessionWrapper(session) : null));
        final String timeoutOpt = (String) request.getAttribute(ATTR_TIMEOUT);
        if (timeoutOpt != null) {
            try {
                final long timeout = Long.parseLong(timeoutOpt);
                context.getWatchDog().setTimeout(timeout);
            } catch (final NumberFormatException e) {
                throw new EXistException("Bad timeout option: " + timeoutOpt);
            }
        }
        final String maxNodesOpt = (String) request.getAttribute(ATTR_MAX_NODES);
        if (maxNodesOpt != null) {
            try {
                final int maxNodes = Integer.parseInt(maxNodesOpt);
                context.getWatchDog().setMaxNodes(maxNodes);
            } catch (final NumberFormatException e) {
                throw new EXistException("Bad max-nodes option: " + maxNodesOpt);
            }
        }
        DebuggeeFactory.checkForDebugRequest(request, context);
        Sequence resultSequence;
        try {
            resultSequence = xquery.execute(broker, query, null, outputProperties);
        } finally {
            context.runCleanupTasks();
            getPool().getXQueryPool().returnCompiledXQuery(source, query);
        }
        final String mediaType = outputProperties.getProperty(OutputKeys.MEDIA_TYPE);
        if (mediaType != null) {
            if (!response.isCommitted()) {
                if (MimeTable.getInstance().isTextContent(mediaType)) {
                    response.setContentType(mediaType + "; charset=" + getFormEncoding());
                    response.setCharacterEncoding(getFormEncoding());
                } else
                    response.setContentType(mediaType);
            }
        } else {
            String contentType = this.contentType;
            try {
                contentType = getServletContext().getMimeType(path);
                if (contentType == null) {
                    contentType = this.contentType;
                }
            } catch (final Throwable e) {
                contentType = this.contentType;
            } finally {
                if (MimeTable.getInstance().isTextContent(contentType)) {
                    contentType += "; charset=" + getFormEncoding();
                }
                response.setContentType(contentType);
            }
        }
        if (requestAttr != null && (XmldbURI.API_LOCAL.equals(collectionURI.getApiName()))) {
            request.setAttribute(requestAttr, resultSequence);
        } else {
            XQuerySerializer serializer = new XQuerySerializer(broker, outputProperties, output);
            serializer.serialize(resultSequence);
        }
    } catch (final PermissionDeniedException e) {
        if (getDefaultUser().equals(user)) {
            getAuthenticator().sendChallenge(request, response);
        } else {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "No permission to execute XQuery for: " + path + " denied.");
        }
        return;
    } catch (final XPathException e) {
        final Logger logger = getLog();
        if (logger.isDebugEnabled()) {
            logger.debug(e.getMessage(), e);
        }
        if (reportErrors) {
            writeError(output, e);
        } else {
            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
            sendError(output, "Error", e.getMessage());
        }
    } catch (final Throwable e) {
        getLog().error(e.getMessage(), e);
        if (reportErrors) {
            writeError(output, e);
        } else {
            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
            sendError(output, "Error", e.getMessage());
        }
    }
    output.flush();
    output.close();
}

Example 47 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class EXistServlet method doPatch.

protected void doPatch(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException {
    // first, adjust the path
    String path = adjustPath(request);
    // second, perform descriptor actions
    final Descriptor descriptor = Descriptor.getDescriptorSingleton();
    if (descriptor != null) {
        // TODO: figure out a way to log PATCH requests with
        // HttpServletRequestWrapper and
        // Descriptor.doLogRequestInReplayLog()
        // map's the path if a mapping is specified in the descriptor
        path = descriptor.mapPath(path);
    }
    // third, authenticate the user
    final Subject user = authenticate(request, response);
    if (user == null) {
        // You now get a HTTP Authentication challenge if there is no user
        return;
    }
    // fourth, process the request
    try (final DBBroker broker = getPool().get(Optional.of(user));
        final Txn transaction = getPool().getTransactionManager().beginTransaction()) {
        final XmldbURI dbpath = XmldbURI.createInternal(path);
        try (final Collection collection = broker.getCollection(dbpath)) {
            if (collection != null) {
                transaction.abort();
                response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, "A PATCH request is not allowed against a plain collection path.");
                return;
            }
        }
        try {
            srvREST.doPatch(broker, transaction, dbpath, request, response);
            transaction.commit();
        } catch (final Throwable t) {
            transaction.abort();
            throw t;
        }
    } catch (final MethodNotAllowedException e) {
        response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, e.getMessage());
    } catch (final BadRequestException e) {
        if (response.isCommitted()) {
            throw new ServletException(e.getMessage(), e);
        }
        response.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
    } catch (final PermissionDeniedException e) {
        // Else return a FORBIDDEN Error
        if (user.equals(getDefaultUser())) {
            getAuthenticator().sendChallenge(request, response);
        } else {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());
        }
    } catch (final EXistException e) {
        if (response.isCommitted()) {
            throw new ServletException(e.getMessage(), e);
        }
        response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
    } catch (final Throwable e) {
        LOG.error(e);
        throw new ServletException("An unknown error occurred: " + e.getMessage(), e);
    }
}

Example 48 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class RedirectorServlet method service.

@Override
protected void service(final HttpServletRequest req, final HttpServletResponse res) throws ServletException, IOException {
    final RequestWrapper request = new HttpRequestWrapper(req);
    final ResponseWrapper response = new HttpResponseWrapper(res);
    if (request.getCharacterEncoding() == null)
        try {
            request.setCharacterEncoding("UTF-8");
        } catch (final IllegalStateException e) {
        }
    // Try to find the XQuery
    final String qpath = getServletContext().getRealPath(query);
    final Path p = Paths.get(qpath);
    if (!(Files.isReadable(p) && Files.isRegularFile(p))) {
        throw new ServletException("Cannot read XQuery source from " + p.toAbsolutePath());
    }
    final FileSource source = new FileSource(p, true);
    try {
        // Prepare and execute the XQuery
        final Sequence result = executeQuery(source, request, response);
        String redirectTo = null;
        String servletName = null;
        String path = null;
        ModifiableRequestWrapper modifiedRequest = null;
        // parse the query result element
        if (result != null && result.getItemCount() == 1) {
            Node node = (Node) result.itemAt(0);
            if (node.getNodeType() == Node.DOCUMENT_NODE) {
                node = ((Document) node).getDocumentElement();
            }
            if (node.getNodeType() != Node.ELEMENT_NODE) {
                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Redirect XQuery should return an XML element. Received: " + node);
                return;
            }
            Element elem = (Element) node;
            final String ns = elem.getNamespaceURI();
            if (ns == null || ((!Namespaces.EXIST_NS.equals(ns)) && "dispatch".equals(elem.getLocalName()))) {
                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Redirect XQuery should return an element <exist:dispatch>. Received: " + node);
                return;
            }
            if (elem.hasAttribute("path")) {
                path = elem.getAttribute("path");
            } else if (elem.hasAttribute("servlet-name")) {
                servletName = elem.getAttribute("servlet-name");
            } else if (elem.hasAttribute("redirect")) {
                redirectTo = elem.getAttribute("redirect");
            } else {
                response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Element <exist:dispatch> should either provide an attribute 'path' or 'servlet-name'. Received: " + node);
                return;
            }
            // Check for add-parameter elements etc.
            if (elem.hasChildNodes()) {
                node = elem.getFirstChild();
                while (node != null) {
                    final String nsUri = node.getNamespaceURI();
                    if (node.getNodeType() == Node.ELEMENT_NODE && nsUri != null && Namespaces.EXIST_NS.equals(nsUri)) {
                        elem = (Element) node;
                        if ("add-parameter".equals(elem.getLocalName())) {
                            if (modifiedRequest == null) {
                                modifiedRequest = new ModifiableRequestWrapper(req);
                            }
                            modifiedRequest.addParameter(elem.getAttribute("name"), elem.getAttribute("value"));
                        }
                    }
                    node = node.getNextSibling();
                }
            }
        }
        if (redirectTo != null) {
            // directly redirect to the specified URI
            response.sendRedirect(redirectTo);
            return;
        }
        // Get a RequestDispatcher, either from the servlet context or the request
        RequestDispatcher dispatcher;
        if (servletName != null && servletName.length() > 0) {
            dispatcher = getServletContext().getNamedDispatcher(servletName);
        } else {
            LOG.debug("Dispatching to {}", path);
            dispatcher = getServletContext().getRequestDispatcher(path);
            if (dispatcher == null) {
                dispatcher = request.getRequestDispatcher(path);
            }
        }
        if (dispatcher == null) {
            response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Could not create a request dispatcher. Giving up.");
            return;
        }
        if (modifiedRequest != null) {
            // store the original request URI to org.exist.forward.request-uri
            modifiedRequest.setAttribute("org.exist.forward.request-uri", modifiedRequest.getRequestURI());
            modifiedRequest.setAttribute("org.exist.forward.servlet-path", modifiedRequest.getServletPath());
            // finally, execute the forward
            dispatcher.forward(modifiedRequest, res);
        } else {
            // store the original request URI to org.exist.forward.request-uri
            request.setAttribute("org.exist.forward.request-uri", request.getRequestURI());
            request.setAttribute("org.exist.forward.servlet-path", request.getServletPath());
            // finally, execute the forward
            dispatcher.forward(req, res);
        }
    } catch (final XPathException | EXistException | PermissionDeniedException | IOException e) {
        throw new ServletException("An error occurred while executing the RedirectorServlet XQuery: " + e.getMessage(), e);
    }
}

Example 49 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class XMLTestRunner method run.

@Override
public void run(final RunNotifier notifier) {
    try {
        final String pkgName = getClass().getPackage().getName().replace('.', '/');
        final Source query = new ClassLoaderSource(pkgName + "/xml-test-runner.xq");
        final List<java.util.function.Function<XQueryContext, Tuple2<String, Object>>> externalVariableDeclarations = Arrays.asList(context -> new Tuple2<>("doc", doc), context -> new Tuple2<>("id", Sequence.EMPTY_SEQUENCE), // set callback functions for notifying junit!
        context -> new Tuple2<>("test-ignored-function", new FunctionReference(new FunctionCall(context, new ExtTestIgnoredFunction(context, getSuiteName(), notifier)))), context -> new Tuple2<>("test-started-function", new FunctionReference(new FunctionCall(context, new ExtTestStartedFunction(context, getSuiteName(), notifier)))), context -> new Tuple2<>("test-failure-function", new FunctionReference(new FunctionCall(context, new ExtTestFailureFunction(context, getSuiteName(), notifier)))), context -> new Tuple2<>("test-assumption-failed-function", new FunctionReference(new FunctionCall(context, new ExtTestAssumptionFailedFunction(context, getSuiteName(), notifier)))), context -> new Tuple2<>("test-error-function", new FunctionReference(new FunctionCall(context, new ExtTestErrorFunction(context, getSuiteName(), notifier)))), context -> new Tuple2<>("test-finished-function", new FunctionReference(new FunctionCall(context, new ExtTestFinishedFunction(context, getSuiteName(), notifier)))));
        // NOTE: at this stage EXIST_EMBEDDED_SERVER_CLASS_INSTANCE in XSuite will be usable
        final BrokerPool brokerPool = XSuite.EXIST_EMBEDDED_SERVER_CLASS_INSTANCE.getBrokerPool();
        executeQuery(brokerPool, query, externalVariableDeclarations);
    } catch (final DatabaseConfigurationException | IOException | EXistException | PermissionDeniedException | XPathException e) {
        // TODO(AR) what to do here?
        throw new RuntimeException(e);
    }
}

Example 50 with PermissionDeniedException

use of org.exist.security.PermissionDeniedException in project exist by eXist-db.

the class XQueryTestRunner method run.

@Override
public void run(final RunNotifier notifier) {
    try {
        final String pkgName = getClass().getPackage().getName().replace('.', '/');
        final Source query = new ClassLoaderSource(pkgName + "/xquery-test-runner.xq");
        final URI testModuleUri = path.toAbsolutePath().toUri();
        final String suiteName = getSuiteName();
        final List<java.util.function.Function<XQueryContext, Tuple2<String, Object>>> externalVariableDeclarations = Arrays.asList(context -> new Tuple2<>("test-module-uri", new AnyURIValue(testModuleUri)), // set callback functions for notifying junit!
        context -> new Tuple2<>("test-ignored-function", new FunctionReference(new FunctionCall(context, new ExtTestIgnoredFunction(context, suiteName, notifier)))), context -> new Tuple2<>("test-started-function", new FunctionReference(new FunctionCall(context, new ExtTestStartedFunction(context, suiteName, notifier)))), context -> new Tuple2<>("test-failure-function", new FunctionReference(new FunctionCall(context, new ExtTestFailureFunction(context, suiteName, notifier)))), context -> new Tuple2<>("test-assumption-failed-function", new FunctionReference(new FunctionCall(context, new ExtTestAssumptionFailedFunction(context, suiteName, notifier)))), context -> new Tuple2<>("test-error-function", new FunctionReference(new FunctionCall(context, new ExtTestErrorFunction(context, suiteName, notifier)))), context -> new Tuple2<>("test-finished-function", new FunctionReference(new FunctionCall(context, new ExtTestFinishedFunction(context, suiteName, notifier)))));
        // NOTE: at this stage EXIST_EMBEDDED_SERVER_CLASS_INSTANCE in XSuite will be usable
        final BrokerPool brokerPool = XSuite.EXIST_EMBEDDED_SERVER_CLASS_INSTANCE.getBrokerPool();
        executeQuery(brokerPool, query, externalVariableDeclarations);
    } catch (final DatabaseConfigurationException | IOException | EXistException | PermissionDeniedException | XPathException e) {
        // TODO(AR) what to do here?
        throw new RuntimeException(e);
    }
}