AMBARI-4338 Proper error message required for CSRF protection error (mpapirkovskyy via dlysnichenko)

ambari-server/src/main/java/org/apache/ambari/server/api/AmbariCsrfProtectionFilter.java

@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.ambari.server.api;
+
+import com.sun.jersey.spi.container.ContainerRequest;
+import com.sun.jersey.spi.container.ContainerRequestFilter;
+import org.apache.ambari.server.api.services.ResultStatus;
+import org.apache.ambari.server.api.services.serializers.JsonSerializer;
+
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+public class AmbariCsrfProtectionFilter implements ContainerRequestFilter {
+  private static final Set<String> IGNORED_METHODS;
+  private static final String CSRF_HEADER = "X-Requested-By";
+  private static final String ERROR_MESSAGE = "CSRF protection is turned on. " + CSRF_HEADER + " HTTP header is required.";
+  private static final JsonSerializer JSON_SERIALIZER = new JsonSerializer();
+
+  static {
+    HashSet<String> methods = new HashSet<String>();
+    methods.add("GET");
+    methods.add("OPTIONS");
+    methods.add("HEAD");
+
+    IGNORED_METHODS = Collections.unmodifiableSet(methods);
+
+  }
+
+  @Override
+  public ContainerRequest filter(ContainerRequest containerRequest) {
+    if (!IGNORED_METHODS.contains(containerRequest.getMethod()) &&
+            !containerRequest.getRequestHeaders().containsKey(CSRF_HEADER)) {
+      throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST).entity(
+              JSON_SERIALIZER.serializeError(new ResultStatus(ResultStatus.STATUS.BAD_REQUEST, ERROR_MESSAGE))
+      ).type(MediaType.TEXT_PLAIN_TYPE).build());
+    }
+    return containerRequest;
+  }
+}

ambari-server/src/main/java/org/apache/ambari/server/controller/AmbariServer.java

@@ -346,9 +346,9 @@ public class AmbariServer {
 
       if (configs.csrfProtectionEnabled()) {
         sh.setInitParameter("com.sun.jersey.spi.container.ContainerRequestFilters",
-                    "com.sun.jersey.api.container.filter.CsrfProtectionFilter");
+                    "org.apache.ambari.server.api.AmbariCsrfProtectionFilter");
         proxy.setInitParameter("com.sun.jersey.spi.container.ContainerRequestFilters",
-                    "com.sun.jersey.api.container.filter.CsrfProtectionFilter");
+                    "com.sun.jersey.api.container.filter.AmbariCsrfProtectionFilter");
       }
 
       //Set jetty thread pool

ambari-server/src/test/java/org/apache/ambari/server/api/AmbariCsrfProtectionFilterTest.java

@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ambari.server.api;
+
+import com.sun.jersey.core.header.InBoundHeaders;
+import com.sun.jersey.spi.container.ContainerRequest;
+import org.junit.Test;
+
+import javax.ws.rs.WebApplicationException;
+
+import static org.easymock.EasyMock.createMock;
+import static org.easymock.EasyMock.expect;
+import static org.easymock.EasyMock.replay;
+import static org.junit.Assert.*;
+
+public class AmbariCsrfProtectionFilterTest {
+
+  @Test
+  public void testGetMethod() {
+    AmbariCsrfProtectionFilter filter = new AmbariCsrfProtectionFilter();
+    ContainerRequest containerRequest = createMock(ContainerRequest.class);
+    expect(containerRequest.getMethod()).andReturn("GET");
+    replay(containerRequest);
+    assertEquals(containerRequest, filter.filter(containerRequest));
+  }
+
+  @Test(expected = WebApplicationException.class)
+  public void testPostNoXRequestedBy() {
+    AmbariCsrfProtectionFilter filter = new AmbariCsrfProtectionFilter();
+    ContainerRequest containerRequest = createMock(ContainerRequest.class);
+    InBoundHeaders headers = new InBoundHeaders();
+    expect(containerRequest.getMethod()).andReturn("POST");
+    expect(containerRequest.getRequestHeaders()).andReturn(headers);
+    replay(containerRequest);
+    filter.filter(containerRequest);
+  }
+
+  @Test
+  public void testPostXRequestedBy() {
+    AmbariCsrfProtectionFilter filter = new AmbariCsrfProtectionFilter();
+    ContainerRequest containerRequest = createMock(ContainerRequest.class);
+    InBoundHeaders headers = new InBoundHeaders();
+    headers.add("X-Requested-By","anything");
+    expect(containerRequest.getMethod()).andReturn("GET");
+    expect(containerRequest.getRequestHeaders()).andReturn(headers);
+    replay(containerRequest);
+    assertEquals(containerRequest, filter.filter(containerRequest));
+  }
+
+}