-
Notifications
You must be signed in to change notification settings - Fork 525
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'v1' into Converting_Yes_No_On_Off_enum_values_without_q…
…uotes_to_booleans_problem
- Loading branch information
Showing
31 changed files
with
1,349 additions
and
106 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -25,3 +25,4 @@ def main(tag): | |
|
|
||
| # here start main | ||
| main(sys.argv[1]) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| # Swagger Parser Safe URL Resolver | ||
|
|
||
| The `swagger-parser-safe-url-resolver` is a library used for verifying that the hostname of URLs does not resolve to a private/restricted IPv4/IPv6 address range. | ||
| This library can be used in services that deal with user-submitted URLs that get fetched (like in swagger-parser when resolving external URL $refs) to protect against Server-Side Request Forgery and DNS rebinding attacks. | ||
|
|
||
| ## How does it work? | ||
| The main class of the package is the `PermittedUrlsChecker` which has one method: `verify(String url)`. | ||
| This method takes in a string URL and performs the following steps: | ||
|
|
||
| 1. Gets the hostname portion from the URL | ||
| 2. Resolves the hostname to an IP address | ||
| 3. Checks if that IP address is in a private/restricted IP address range (and throws an exception if it is) | ||
| 4. Returns a `ResolvedUrl` object which contains | ||
| 4.1. `String url` where the original URL has the hostname replaced with the IP address | ||
| 4.2. A `String hostHeader` which contains the hostname from the original URL to be added as a host header | ||
|
|
||
| This behavior can also be customized with the allowlist and denylist in the constructor, whereby: | ||
|
|
||
| - An entry in the allowlist will allow the URL to pass even if it resolves to a private/restricted IP address | ||
| - An entry in the denylist will throw an exception even when the URL resolves to a public IP address | ||
|
|
||
| ## Installation | ||
| Add the following to you `pom.xml` file under `dependencies` | ||
| ```xml | ||
| <dependency> | ||
| <groupId>io.swagger.parser.v3</groupId> | ||
| <artifactId>swagger-parser-safe-url-resolver</artifactId> | ||
| // version of swagger-parser being used | ||
| <version>2.1.14</version> | ||
| </dependency> | ||
| ``` | ||
|
|
||
| ## Example usage | ||
|
|
||
| ```java | ||
| import io.swagger.v3.parser.urlresolver.PermittedUrlsChecker; | ||
| import io.swagger.v3.parser.urlresolver.exceptions.HostDeniedException; | ||
| import io.swagger.v3.parser.urlresolver.models.ResolvedUrl; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| public class Main { | ||
| public static void main() { | ||
| List<String> allowlist = List.of("mysite.local"); | ||
| List<String> denylist = List.of("*.example.com:443"); | ||
| var checker = new PermittedUrlsChecker(allowlist, denylist); | ||
|
|
||
| try { | ||
| // Will throw a HostDeniedException as `localhost` | ||
| // resolves to local IP and is not in allowlist | ||
| checker.verify("http://localhost/example"); | ||
|
|
||
| // Will return a ResolvedUrl if `github.com` | ||
| // resolves to a public IP | ||
| checker.verify("https://github.com/swagger-api/swagger-parser"); | ||
|
|
||
| // Will throw a HostDeniedException as `*.example.com` is | ||
| // explicitly deny listed, even if it resolves to public IP | ||
| checker.verify("https://subdomain.example.com/somepage"); | ||
|
|
||
| // Will return a `ResolvedUrl` as `mysite.local` | ||
| // is explicitly allowlisted | ||
| ResolvedUrl resolvedUrl = checker.verify("http://mysite.local/example"); | ||
| System.out.println(resolvedUrl.getUrl()); // "http://127.0.0.1/example" | ||
| System.out.println(resolvedUrl.getHostHeader()); // "mysite.local" | ||
| } catch (HostDeniedException e) { | ||
| e.printStackTrace(); | ||
| } | ||
| } | ||
| } | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" | ||
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
| xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <parent> | ||
| <groupId>io.swagger</groupId> | ||
| <artifactId>swagger-parser-project</artifactId> | ||
| <version>1.0.70-SNAPSHOT</version> | ||
| <relativePath>../..</relativePath> | ||
| </parent> | ||
| <modelVersion>4.0.0</modelVersion> | ||
| <artifactId>swagger-parser-safe-url-resolver</artifactId> | ||
| <packaging>jar</packaging> | ||
| <name>swagger-parser-safe-url-resolver</name> | ||
| <dependencies> | ||
| <dependency> | ||
| <groupId>commons-io</groupId> | ||
| <artifactId>commons-io</artifactId> | ||
| <version>${commons-io-version}</version> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.slf4j</groupId> | ||
| <artifactId>slf4j-simple</artifactId> | ||
| <version>${slf4j-version}</version> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.testng</groupId> | ||
| <artifactId>testng</artifactId> | ||
| <version>${testng-version}</version> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>junit</groupId> | ||
| <artifactId>junit</artifactId> | ||
| <version>${junit-version}</version> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.jmockit</groupId> | ||
| <artifactId>jmockit</artifactId> | ||
| <version>${jmockit-version}</version> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| </dependencies> | ||
| </project> |
Oops, something went wrong.