001/** 002 * Licensed to the Apache Software Foundation (ASF) under one or more 003 * contributor license agreements. See the NOTICE file distributed with 004 * this work for additional information regarding copyright ownership. 005 * The ASF licenses this file to You under the Apache License, Version 2.0 006 * (the "License"); you may not use this file except in compliance with 007 * the License. You may obtain a copy of the License at 008 * 009 * http://www.apache.org/licenses/LICENSE-2.0 010 * 011 * Unless required by applicable law or agreed to in writing, software 012 * distributed under the License is distributed on an "AS IS" BASIS, 013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 014 * See the License for the specific language governing permissions and 015 * limitations under the License. 016 */ 017package org.apache.activemq.web.handler; 018 019import java.util.Arrays; 020 021import javax.servlet.http.HttpServletRequest; 022 023import org.apache.activemq.web.DestinationFacade; 024import org.slf4j.Logger; 025import org.slf4j.LoggerFactory; 026import org.springframework.web.bind.ServletRequestDataBinder; 027import org.springframework.web.servlet.HandlerExecutionChain; 028import org.springframework.web.servlet.handler.BeanNameUrlHandlerMapping; 029 030/** 031 * 032 */ 033public class BindingBeanNameUrlHandlerMapping extends BeanNameUrlHandlerMapping { 034 private static final transient Logger LOG = LoggerFactory.getLogger(BindingBeanNameUrlHandlerMapping.class); 035 036 @Override 037 protected Object getHandlerInternal(HttpServletRequest request) throws Exception { 038 Object object = super.getHandlerInternal(request); 039 040 if (object instanceof String) { 041 String handlerName = (String) object; 042 object = getApplicationContext().getBean(handlerName); 043 } 044 if (object instanceof HandlerExecutionChain) { 045 HandlerExecutionChain handlerExecutionChain = (HandlerExecutionChain) object; 046 object = handlerExecutionChain.getHandler(); 047 } 048 049 if (object != null) { 050 // prevent CSRF attacks 051 if (object instanceof DestinationFacade) { 052 // check supported methods 053 if (!Arrays.asList(((DestinationFacade)object).getSupportedHttpMethods()).contains(request.getMethod())) { 054 throw new UnsupportedOperationException("Unsupported method " + request.getMethod() + " for path " + request.getRequestURI()); 055 } 056 // check the 'secret' 057 if (request.getSession().getAttribute("secret") == null || 058 !request.getSession().getAttribute("secret").equals(request.getParameter("secret"))) { 059 throw new UnsupportedOperationException("Possible CSRF attack"); 060 } 061 } 062 063 ServletRequestDataBinder binder = new ServletRequestDataBinder(object, "request"); 064 try { 065 binder.bind(request); 066 binder.setIgnoreUnknownFields(true); 067 if (LOG.isDebugEnabled()) { 068 LOG.debug("Bound POJO is now: " + object); 069 } 070 } 071 catch (Exception e) { 072 LOG.warn("Caught: " + e, e); 073 throw e; 074 } 075 } 076 077 return object; 078 } 079}