Enforce POST requests to only contain POST data.

[gigi.git] / src / org / cacert / gigi / Gigi.java

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 2741b7329ca6eb491f72cd524891ae1b820fde70..9d1bb1b9afb4b84f56bae564ec02e7dc3fa47721 100644 (file)
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -1,7 +1,6 @@
 package org.cacert.gigi;
 
 import java.io.IOException;
-import java.io.InputStreamReader;
 import java.io.PrintWriter;
 import java.util.Calendar;
 import java.util.HashMap;
@@ -19,7 +18,8 @@ import org.cacert.gigi.email.EmailProvider;
 import org.cacert.gigi.output.Menu;
 import org.cacert.gigi.output.MenuItem;
 import org.cacert.gigi.output.Outputable;
-import org.cacert.gigi.output.Template;
+import org.cacert.gigi.output.Form.CSRFException;
+import org.cacert.gigi.output.template.Template;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
@@ -30,6 +30,7 @@ import org.cacert.gigi.pages.account.MailCertificateAdd;
 import org.cacert.gigi.pages.account.MailCertificates;
 import org.cacert.gigi.pages.account.MailOverview;
 import org.cacert.gigi.pages.account.MyDetails;
+import org.cacert.gigi.pages.error.PageNotFound;
 import org.cacert.gigi.pages.main.RegisterPage;
 import org.cacert.gigi.pages.wot.AssurePage;
 import org.cacert.gigi.util.ServerConstants;
@@ -49,6 +50,7 @@ public class Gigi extends HttpServlet {
 
        @Override
        public void init() throws ServletException {
+               pages.put("/error", new PageNotFound());
                pages.put("/login", new LoginPage("CACert - Login"));
                pages.put("/", new MainPage("CACert - Home"));
                pages.put("/secure", new TestSecure());
@@ -60,16 +62,16 @@ public class Gigi extends HttpServlet {
                pages.put(RegisterPage.PATH, new RegisterPage());
                pages.put(MailCertificateAdd.PATH, new MailCertificateAdd());
                pages.put(MailOverview.DEFAULT_PATH, new MailOverview("My email addresses"));
-               baseTemplate = new Template(new InputStreamReader(Gigi.class.getResourceAsStream("Gigi.templ")));
+               baseTemplate = new Template(Gigi.class.getResource("Gigi.templ"));
                m = new Menu("Certificates", "cert", new MenuItem(MailOverview.DEFAULT_PATH, "Emails"), new MenuItem("",
-                               "Client Certificates"), new MenuItem("", "Domains"), new MenuItem("", "Server Certificates"));
+                       "Client Certificates"), new MenuItem("", "Domains"), new MenuItem("", "Server Certificates"));
                super.init();
 
        }
 
        @Override
        protected void service(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException,
-                       IOException {
+               IOException {
                addXSSHeaders(resp);
                // if (req.getHeader("Origin") != null) {
                // resp.getWriter().println("No cross domain access allowed.");
@@ -107,10 +109,19 @@ public class Gigi extends HttpServlet {
                                public void output(PrintWriter out, Language l, Map<String, Object> vars) {
                                        try {
                                                if (req.getMethod().equals("POST")) {
+                                                       if (req.getQueryString() != null) {
+                                                               return;
+                                                       }
                                                        p.doPost(req, resp);
                                                } else {
                                                        p.doGet(req, resp);
                                                }
+                                       } catch (CSRFException err) {
+                                               try {
+                                                       resp.sendError(500, "CSRF invalid");
+                                               } catch (IOException e) {
+                                                       e.printStackTrace();
+                                               }
                                        } catch (IOException e) {
                                                e.printStackTrace();
                                        }
@@ -154,7 +165,7 @@ public class Gigi extends HttpServlet {
 
        public static void addXSSHeaders(HttpServletResponse hsr) {
                hsr.addHeader("Access-Control-Allow-Origin", "https://" + ServerConstants.getWwwHostNamePort() + " https://"
-                               + ServerConstants.getSecureHostNamePort());
+                       + ServerConstants.getSecureHostNamePort());
                hsr.addHeader("Access-Control-Max-Age", "60");
 
                hsr.addHeader("Content-Security-Policy", getDefaultCSP());
@@ -174,7 +185,7 @@ public class Gigi extends HttpServlet {
                        csp.append("script-src https://" + ServerConstants.getStaticHostNamePort());
                        csp.append(";style-src https://" + ServerConstants.getStaticHostNamePort());
                        csp.append(";form-action https://" + ServerConstants.getSecureHostNamePort() + " https://"
-                                       + ServerConstants.getWwwHostNamePort());
+                               + ServerConstants.getWwwHostNamePort());
                        csp.append("report-url https://api.cacert.org/security/csp/report");
                        defaultCSP = csp.toString();
                }