|
| 1 | +package org.opensearch.dataprepper.plugins.source.confluence.utils; |
| 2 | + |
| 3 | +import java.net.MalformedURLException; |
| 4 | +import java.net.URL; |
| 5 | +import java.net.URLDecoder; |
| 6 | +import java.net.URLEncoder; |
| 7 | +import java.nio.charset.StandardCharsets; |
| 8 | +import java.util.HashMap; |
| 9 | +import java.util.Map; |
| 10 | +import java.util.regex.Pattern; |
| 11 | +import java.util.stream.Collectors; |
| 12 | + |
| 13 | +public class ConfluenceNextLinkValidator { |
| 14 | + // Define allowed parameters and their patterns |
| 15 | + private static final Map<String, Pattern> ALLOWED_PARAMS = Map.of( |
| 16 | + "next", Pattern.compile("^(true|false)$"), |
| 17 | + "cursor", Pattern.compile("^[A-Za-z0-9+/=_%\\-]+$"), |
| 18 | + "expand", Pattern.compile("^[A-Za-z0-9+/=_%\\-.,]+$"), |
| 19 | + "limit", Pattern.compile("^\\d{1,3}$"), |
| 20 | + "start", Pattern.compile("^\\d+$"), |
| 21 | + "startAt", Pattern.compile("^\\d+$"), |
| 22 | + "maxResults", Pattern.compile("^\\d+$"), |
| 23 | + "cql", Pattern.compile("^[\\w\\s=\"()><%\\-.:]+$") |
| 24 | + ); |
| 25 | + |
| 26 | + public static String validateAndSanitizeURL(String urlString) throws MalformedURLException { |
| 27 | + URL url = new URL(urlString); |
| 28 | + String query = url.getQuery(); |
| 29 | + |
| 30 | + if (query == null || query.isEmpty()) { |
| 31 | + return urlString; |
| 32 | + } |
| 33 | + |
| 34 | + // Parse and validate parameters |
| 35 | + Map<String, String> validatedParams = new HashMap<>(); |
| 36 | + String[] pairs = query.split("&"); |
| 37 | + |
| 38 | + for (String pair : pairs) { |
| 39 | + |
| 40 | + String key = URLDecoder.decode(pair.substring(0, pair.indexOf("=")), StandardCharsets.UTF_8); |
| 41 | + String value = URLDecoder.decode(pair.substring(pair.indexOf("=") + 1), StandardCharsets.UTF_8); |
| 42 | + |
| 43 | + // Check if parameter is allowed and matches pattern |
| 44 | + if (ALLOWED_PARAMS.containsKey(key) && |
| 45 | + ALLOWED_PARAMS.get(key).matcher(value).matches()) { |
| 46 | + validatedParams.put(key, value); |
| 47 | + } |
| 48 | + } |
| 49 | + |
| 50 | + // Rebuild URL with validated parameters |
| 51 | + StringBuilder sanitizedURL = new StringBuilder(); |
| 52 | + sanitizedURL.append(url.getProtocol()).append("://") |
| 53 | + .append(url.getHost()) |
| 54 | + .append(url.getPath()) |
| 55 | + .append("?"); |
| 56 | + |
| 57 | + // Add validated parameters |
| 58 | + String params = validatedParams.entrySet().stream() |
| 59 | + .map(e -> URLEncoder.encode(e.getKey(), StandardCharsets.UTF_8) + "=" + |
| 60 | + URLEncoder.encode(e.getValue(), StandardCharsets.UTF_8)) |
| 61 | + .collect(Collectors.joining("&")); |
| 62 | + |
| 63 | + sanitizedURL.append(params); |
| 64 | + |
| 65 | + return sanitizedURL.toString(); |
| 66 | + } |
| 67 | +} |
| 68 | + |
0 commit comments