Skip to content

Commit 8954bc9

Browse files
lmajanolmajano
committed
Merge branch 'development'
2 parents 9ea348e + e1c2969 commit 8954bc9

4 files changed

Lines changed: 70 additions & 52 deletions

File tree

‎handlers/Visualizer.cfc‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -19,24 +19,24 @@ component extends="coldbox.system.RestHandler" {
1919
return "Page Not Found";
2020
}
2121
// Settings the visualizer will visualize :)
22-
prc.settings = variables.settings;
23-
if( prc.settings.firewall.logs.enabled ){
24-
prc.logCounts = dbLogger.count();
25-
prc.actionsReport = dbLogger.getActionsReport();
26-
prc.blockTypesReport = dbLogger.getBlockTypesReport();
27-
prc.topOffendingPaths = dbLogger.getTopOffending( "path" );
28-
prc.topOffendingIps = dbLogger.getTopOffending( "ip" );
29-
prc.topOffendingHosts = dbLogger.getTopOffending( "host" );
30-
prc.topOffendingUserAgents = dbLogger.getTopOffending( "userAgent" );
31-
prc.topOffendingMethods = dbLogger.getTopOffending( "httpMethod" );
32-
prc.topOffendingUsers = dbLogger.getTopOffending( "userId" );
33-
prc.logs = dbLogger.getLatest(
34-
top : 50,
35-
action : rc.action ?: "",
36-
blockType: rc.blockType ?: "",
37-
userId : rc.userId ?: ""
38-
);
39-
}
22+
prc.settings = variables.settings;
23+
if ( prc.settings.firewall.logs.enabled ) {
24+
prc.logCounts = dbLogger.count();
25+
prc.actionsReport = dbLogger.getActionsReport();
26+
prc.blockTypesReport = dbLogger.getBlockTypesReport();
27+
prc.topOffendingPaths = dbLogger.getTopOffending( "path" );
28+
prc.topOffendingIps = dbLogger.getTopOffending( "ip" );
29+
prc.topOffendingHosts = dbLogger.getTopOffending( "host" );
30+
prc.topOffendingUserAgents = dbLogger.getTopOffending( "userAgent" );
31+
prc.topOffendingMethods = dbLogger.getTopOffending( "httpMethod" );
32+
prc.topOffendingUsers = dbLogger.getTopOffending( "userId" );
33+
prc.logs = dbLogger.getLatest(
34+
top : 50,
35+
action : rc.action ?: "",
36+
blockType: rc.blockType ?: "",
37+
userId : rc.userId ?: ""
38+
);
39+
}
4040
// Show the visualizer
4141
event.setView( "home/index" );
4242
}

‎interceptors/Security.cfc‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -200,11 +200,11 @@ component accessors="true" extends="coldbox.system.Interceptor" {
200200
/**
201201
* Listen to module loadings, so we can do module rule registrations
202202
*
203-
* @event
203+
* @event
204204
* @interceptData
205-
* @rc
206-
* @prc
207-
* @buffer
205+
* @rc
206+
* @prc
207+
* @buffer
208208
*/
209209
function postModuleLoad( event, interceptData, rc, prc, buffer ){
210210
// Is this a cbSecurity Module & not registered
@@ -223,11 +223,11 @@ component accessors="true" extends="coldbox.system.Interceptor" {
223223
/**
224224
* Listen to module unloadings, so we can do module rule cleanups
225225
*
226-
* @event
226+
* @event
227227
* @interceptData
228-
* @rc
229-
* @prc
230-
* @buffer
228+
* @rc
229+
* @prc
230+
* @buffer
231231
*/
232232
function postModuleUnload( event, interceptData, rc, prc, buffer ){
233233
// Is the module registered?
@@ -246,11 +246,11 @@ component accessors="true" extends="coldbox.system.Interceptor" {
246246
/**
247247
* Our firewall kicks in at preProcess
248248
*
249-
* @event
249+
* @event
250250
* @interceptData
251-
* @rc
252-
* @prc
253-
* @buffer
251+
* @rc
252+
* @prc
253+
* @buffer
254254
*/
255255
function preProcess( event, interceptData, rc, prc, buffer ){
256256
// Add SecureView() into the requestcontext
@@ -290,9 +290,9 @@ component accessors="true" extends="coldbox.system.Interceptor" {
290290
/**
291291
* Process handler annotation based security rules.
292292
*
293-
* @event
293+
* @event
294294
* @interceptData
295-
* @currentEvent
295+
* @currentEvent
296296
*/
297297
function processAnnotationRules(
298298
required event,
@@ -792,7 +792,10 @@ component accessors="true" extends="coldbox.system.Interceptor" {
792792
if ( log.canWarn() ) {
793793
log.warn(
794794
"Potential open redirect attempt detected. Invalid secured URL: #securedURL#. Using home page instead.",
795-
{ "ip" : variables.cbSecurity.getRealIp(), "url" : securedURL }
795+
{
796+
"ip" : variables.cbSecurity.getRealIp(),
797+
"url" : securedURL
798+
}
796799
);
797800
}
798801
// Use the application's base URL instead
@@ -808,8 +811,8 @@ component accessors="true" extends="coldbox.system.Interceptor" {
808811
* Validates that a redirect URL is safe by ensuring it belongs to the same host
809812
* as the current request. This prevents open redirect vulnerabilities.
810813
*
811-
* @targetUrl The URL to validate
812-
* @event The request context
814+
* @targetUrl The URL to validate
815+
* @event The request context
813816
*
814817
* @return True if the URL is safe to redirect to, false otherwise
815818
*/
@@ -830,10 +833,7 @@ component accessors="true" extends="coldbox.system.Interceptor" {
830833
return compareNoCase( urlToValidate.getHost(), currentHost ) == 0;
831834
} catch ( any e ) {
832835
// If URL parsing fails, consider it unsafe
833-
log.warn(
834-
"Error parsing URL for redirect validation: #arguments.targetUrl# : #e.message#",
835-
e.detail
836-
);
836+
log.warn( "Error parsing URL for redirect validation: #arguments.targetUrl# : #e.message#", e.detail );
837837
return false;
838838
}
839839
}

‎test-harness/tests/specs/integration/SecuritySpec.cfc‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,6 @@ component extends="coldbox.system.testing.BaseTestCase" appMapping="/root" {
195195
} );
196196
} );
197197
} );
198-
199198
} );
200199
}
201200

‎test-harness/tests/specs/unit/SecurityTest.cfc‎

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,6 @@ component extends="coldbox.system.testing.BaseInterceptorTest" interceptor="cbse
277277
} );
278278

279279
describe( "URL validation for open redirect prevention", () => {
280-
281280
beforeEach( ( currentSpec ) => {
282281
mockValidator = mockWireBox.getInstance( settings.firewall.validator );
283282
security
@@ -291,39 +290,55 @@ component extends="coldbox.system.testing.BaseInterceptorTest" interceptor="cbse
291290
mockEvent = createMock( "coldbox.system.web.context.RequestContext" )
292291
.$( "getCurrentRoutedURL", "/account" )
293292
.$( "buildLink" )
294-
.$args( to = "/account", queryString = "", translate = false )
293+
.$args(
294+
to = "/account",
295+
queryString = "",
296+
translate = false
297+
)
295298
.$results( "/account" )
296299
.$( "setValue" );
297300

298301
mockFlash = createStub().$( "put" );
299302
security.$property( "flash", "variables", mockFlash );
300303

301-
makePublic( security, "isSafeRedirectUrl" );
302-
makePublic( security, "saveSecuredUrl" );
304+
makePublic( security, "isSafeRedirectUrl" );
305+
makePublic( security, "saveSecuredUrl" );
303306
} );
304307

305308
it( "allows relative URLs without a host", () => {
306-
var result = security.isSafeRedirectUrl( targetUrl = "/account", event = mockEvent );
309+
var result = security.isSafeRedirectUrl( targetUrl = "/account", event = mockEvent );
307310
expect( result ).toBeTrue();
308311
} );
309312

310313
it( "allows URLs with the same host", () => {
311-
var result = security.isSafeRedirectUrl( targetUrl = "https://mysite.com/account", event = mockEvent );
314+
var result = security.isSafeRedirectUrl(
315+
targetUrl = "https://mysite.com/account",
316+
event = mockEvent
317+
);
312318
expect( result ).toBeTrue();
313319
} );
314320

315321
it( "blocks URLs with different hosts", () => {
316-
var result = security.isSafeRedirectUrl( targetUrl = "https://malicioussite.com/phishing", event = mockEvent );
322+
var result = security.isSafeRedirectUrl(
323+
targetUrl = "https://malicioussite.com/phishing",
324+
event = mockEvent
325+
);
317326
expect( result ).toBeFalse();
318327
} );
319328

320329
it( "blocks URLs with subdomain differences", () => {
321-
var result = security.isSafeRedirectUrl( targetUrl = "https://evil.mysite.com/account", event = mockEvent );
330+
var result = security.isSafeRedirectUrl(
331+
targetUrl = "https://evil.mysite.com/account",
332+
event = mockEvent
333+
);
322334
expect( result ).toBeFalse();
323335
} );
324336

325337
it( "is case-insensitive when comparing hosts", () => {
326-
var result = security.isSafeRedirectUrl( targetUrl = "https://MySite.COM/account", event = mockEvent );
338+
var result = security.isSafeRedirectUrl(
339+
targetUrl = "https://MySite.COM/account",
340+
event = mockEvent
341+
);
327342
expect( result ).toBeTrue();
328343
} );
329344

@@ -333,10 +348,14 @@ component extends="coldbox.system.testing.BaseInterceptorTest" interceptor="cbse
333348
} );
334349

335350
it( "saves secured URL when it is safe", () => {
336-
mockEvent.$( "getCurrentRoutedURL", "/account" );
351+
mockEvent.$( "getCurrentRoutedURL", "/account" );
337352
mockEvent
338-
.$( "buildLink" )
339-
.$args( to = "/account", queryString = cgi.QUERY_STRING, translate = false )
353+
.$( "buildLink" )
354+
.$args(
355+
to = "/account",
356+
queryString = cgi.QUERY_STRING,
357+
translate = false
358+
)
340359
.$results( "/account" );
341360

342361
security.saveSecuredUrl( mockEvent );

0 commit comments

Comments
 (0)