aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/zen/cmds/projectstore_cmd.cpp4
-rw-r--r--src/zenserver-test/projectstore-tests.cpp8
-rw-r--r--src/zenserver/storage/projectstore/httpprojectstore.cpp30
-rw-r--r--src/zenserver/storage/projectstore/httpprojectstore.h4
-rw-r--r--src/zenserver/storage/storageconfig.cpp7
-rw-r--r--src/zenserver/storage/storageconfig.h1
-rw-r--r--src/zenserver/storage/zenstorageserver.cpp10
7 files changed, 54 insertions, 10 deletions
diff --git a/src/zen/cmds/projectstore_cmd.cpp b/src/zen/cmds/projectstore_cmd.cpp
index 5ff591b54..db931e49a 100644
--- a/src/zen/cmds/projectstore_cmd.cpp
+++ b/src/zen/cmds/projectstore_cmd.cpp
@@ -811,6 +811,7 @@ CreateOplogCommand::Run(const ZenCliOptions& GlobalOptions, int argc, char** arg
}
IoBuffer OplogPayload;
+ OplogPayload.SetContentType(ZenContentType::kCbObject);
if (!m_GcPath.empty())
{
OplogPayload = MakeCbObjectPayload([&](CbObjectWriter& Writer) { Writer.AddString("gcpath"sv, m_GcPath); });
@@ -1144,7 +1145,7 @@ ExportOplogCommand::Run(const ZenCliOptions& GlobalOptions, int argc, char** arg
if (CreateOplog)
{
ZEN_CONSOLE_WARN("Creating zen remote oplog '{}/{}'", m_ZenProjectName, m_ZenOplogName);
- if (HttpClient::Response Result = TargetHttp.Post(Url); !Result)
+ if (HttpClient::Response Result = TargetHttp.Post(Url, IoBuffer(), ZenContentType::kCbObject); !Result)
{
Result.ThrowError("failed creating zen remote oplog"sv);
}
@@ -1633,6 +1634,7 @@ ImportOplogCommand::Run(const ZenCliOptions& GlobalOptions, int argc, char** arg
if (CreateOplog)
{
IoBuffer OplogPayload;
+ OplogPayload.SetContentType(ZenContentType::kCbObject);
if (!m_GcPath.empty())
{
OplogPayload = MakeCbObjectPayload([&](CbObjectWriter& Writer) { Writer.AddString("gcpath"sv, m_GcPath); });
diff --git a/src/zenserver-test/projectstore-tests.cpp b/src/zenserver-test/projectstore-tests.cpp
index c73910aaa..eb2e187d7 100644
--- a/src/zenserver-test/projectstore-tests.cpp
+++ b/src/zenserver-test/projectstore-tests.cpp
@@ -88,7 +88,7 @@ TEST_CASE("project.basic")
HttpClient Http{BaseUri};
{
- auto Response = Http.Post(""sv);
+ auto Response = Http.Post(""sv, IoBuffer{}, ZenContentType::kCbObject);
CHECK(Response.StatusCode == HttpResponseCode::Created);
}
@@ -443,7 +443,8 @@ TEST_CASE("project.remote")
auto MakeOplog = [](std::string_view UrlBase, std::string_view ProjectName, std::string_view OplogName) {
HttpClient Http{UrlBase};
- HttpClient::Response Response = Http.Post(fmt::format("/prj/{}/oplog/{}", ProjectName, OplogName), IoBuffer{});
+ HttpClient::Response Response =
+ Http.Post(fmt::format("/prj/{}/oplog/{}", ProjectName, OplogName), IoBuffer{}, ZenContentType::kCbObject);
REQUIRE(Response);
};
@@ -893,7 +894,8 @@ TEST_CASE("project.rpcappendop")
};
auto MakeOplog = [](HttpClient& Client, std::string_view ProjectName, std::string_view OplogName) {
- HttpClient::Response Response = Client.Post(fmt::format("/prj/{}/oplog/{}", ProjectName, OplogName));
+ HttpClient::Response Response =
+ Client.Post(fmt::format("/prj/{}/oplog/{}", ProjectName, OplogName), IoBuffer{}, ZenContentType::kCbObject);
REQUIRE_MESSAGE(Response.IsSuccess(), Response.ErrorMessage(""));
};
auto GetOplog = [](HttpClient& Client, std::string_view ProjectName, std::string_view OplogName) {
diff --git a/src/zenserver/storage/projectstore/httpprojectstore.cpp b/src/zenserver/storage/projectstore/httpprojectstore.cpp
index 9bf00b825..836d84292 100644
--- a/src/zenserver/storage/projectstore/httpprojectstore.cpp
+++ b/src/zenserver/storage/projectstore/httpprojectstore.cpp
@@ -653,7 +653,8 @@ HttpProjectService::HttpProjectService(CidStore& Store,
HttpStatsService& StatsService,
AuthMgr& AuthMgr,
OpenProcessCache& InOpenProcessCache,
- JobQueue& InJobQueue)
+ JobQueue& InJobQueue,
+ bool InRestrictContentTypes)
: m_Log(logging::Get("project"))
, m_CidStore(Store)
, m_ProjectStore(Projects)
@@ -662,6 +663,7 @@ HttpProjectService::HttpProjectService(CidStore& Store,
, m_AuthMgr(AuthMgr)
, m_OpenProcessCache(InOpenProcessCache)
, m_JobQueue(InJobQueue)
+, m_RestrictContentTypes(InRestrictContentTypes)
{
ZEN_MEMSCOPE(GetProjectHttpTag());
@@ -1990,6 +1992,14 @@ HttpProjectService::HandleOpLogRequest(HttpRouterRequest& Req)
{
return HttpReq.WriteResponse(HttpResponseCode::InsufficientStorage);
}
+
+ if (m_RestrictContentTypes && (HttpReq.RequestContentType() == HttpContentType::kText ||
+ HttpReq.RequestContentType() == HttpContentType::kUnknownContentType))
+ {
+ m_ProjectStats.BadRequestCount++;
+ return HttpReq.WriteResponse(HttpResponseCode::BadRequest, HttpContentType::kText, "Invalid request content type");
+ }
+
std::filesystem::path OplogMarkerPath;
if (CbObject Params = HttpReq.ReadPayloadObject())
{
@@ -2280,6 +2290,13 @@ HttpProjectService::HandleProjectRequest(HttpRouterRequest& Req)
return HttpReq.WriteResponse(HttpResponseCode::InsufficientStorage);
}
+ if (m_RestrictContentTypes && (HttpReq.RequestContentType() == HttpContentType::kText ||
+ HttpReq.RequestContentType() == HttpContentType::kUnknownContentType))
+ {
+ m_ProjectStats.BadRequestCount++;
+ return HttpReq.WriteResponse(HttpResponseCode::BadRequest, HttpContentType::kText, "Invalid request content type");
+ }
+
CbValidateError ValidateResult;
if (CbObject Params = ValidateAndReadCompactBinaryObject(HttpReq.ReadPayload(), ValidateResult);
ValidateResult == CbValidateError::None)
@@ -2695,10 +2712,17 @@ HttpProjectService::HandleRpcRequest(HttpRouterRequest& Req)
CbObject Cb;
switch (PayloadContentType)
{
- case HttpContentType::kJSON:
- case HttpContentType::kUnknownContentType:
case HttpContentType::kText:
+ case HttpContentType::kUnknownContentType:
+ case HttpContentType::kJSON:
{
+ if (m_RestrictContentTypes &&
+ (PayloadContentType == HttpContentType::kText || PayloadContentType == HttpContentType::kUnknownContentType))
+ {
+ m_ProjectStats.BadRequestCount++;
+ return HttpReq.WriteResponse(HttpResponseCode::BadRequest, HttpContentType::kText, "Invalid request content type");
+ }
+
std::string JsonText(reinterpret_cast<const char*>(Payload.GetData()), Payload.GetSize());
Cb = LoadCompactBinaryFromJson(JsonText).AsObject();
if (!Cb)
diff --git a/src/zenserver/storage/projectstore/httpprojectstore.h b/src/zenserver/storage/projectstore/httpprojectstore.h
index 026ac32fa..a1f649ed6 100644
--- a/src/zenserver/storage/projectstore/httpprojectstore.h
+++ b/src/zenserver/storage/projectstore/httpprojectstore.h
@@ -44,7 +44,8 @@ public:
HttpStatsService& StatsService,
AuthMgr& AuthMgr,
OpenProcessCache& InOpenProcessCache,
- JobQueue& InJobQueue);
+ JobQueue& InJobQueue,
+ bool InRestrictContentTypes);
~HttpProjectService();
virtual const char* BaseUri() const override;
@@ -110,6 +111,7 @@ private:
metrics::OperationTiming m_HttpRequests;
RwLock m_ThreadWorkersLock;
Ref<TransferThreadWorkers> m_ThreadWorkers;
+ bool m_RestrictContentTypes;
Ref<TransferThreadWorkers> GetThreadWorkers(bool BoostWorkers, bool SingleThreaded);
};
diff --git a/src/zenserver/storage/storageconfig.cpp b/src/zenserver/storage/storageconfig.cpp
index 089b6b572..ad1fb88ea 100644
--- a/src/zenserver/storage/storageconfig.cpp
+++ b/src/zenserver/storage/storageconfig.cpp
@@ -496,6 +496,7 @@ ZenStorageServerConfigurator::AddConfigOptions(LuaConfig::Options& LuaOptions)
LuaOptions.AddOption("security.encryptionaeskey"sv, ServerOptions.EncryptionKey, "encryption-aes-key"sv);
LuaOptions.AddOption("security.encryptionaesiv"sv, ServerOptions.EncryptionIV, "encryption-aes-iv"sv);
LuaOptions.AddOption("security.openidproviders"sv, ServerOptions.AuthConfig);
+ LuaOptions.AddOption("security.restrictcontenttypes"sv, ServerOptions.RestrictContentTypes, "restrict-content-types"sv);
////// workspaces
LuaOptions.AddOption("workspaces.enabled"sv, ServerOptions.WorksSpacesConfig.Enabled, "workspaces-enabled"sv);
@@ -649,6 +650,12 @@ ZenStorageServerCmdLineOptions::AddSecurityOptions(cxxopts::Options& options, Ze
options.add_option("security", "", "openid-provider-url", "Open ID provider URL", cxxopts::value<std::string>(OpenIdProviderUrl), "");
options.add_option("security", "", "openid-client-id", "Open ID client ID", cxxopts::value<std::string>(OpenIdClientId), "");
+ options.add_option("security",
+ "",
+ "restrict-content-types",
+ "Restrict content-type in requests to content-types that are not allowed in CORS simple requests",
+ cxxopts::value<bool>(ServerOptions.RestrictContentTypes),
+ "");
}
void
diff --git a/src/zenserver/storage/storageconfig.h b/src/zenserver/storage/storageconfig.h
index 6124cae14..d935ed8b3 100644
--- a/src/zenserver/storage/storageconfig.h
+++ b/src/zenserver/storage/storageconfig.h
@@ -159,6 +159,7 @@ struct ZenStorageServerConfig : public ZenServerConfig
bool ObjectStoreEnabled = false;
bool ComputeEnabled = true;
std::string ScrubOptions;
+ bool RestrictContentTypes = false;
};
struct ZenStorageServerCmdLineOptions
diff --git a/src/zenserver/storage/zenstorageserver.cpp b/src/zenserver/storage/zenstorageserver.cpp
index af2c0dc81..f43bb9987 100644
--- a/src/zenserver/storage/zenstorageserver.cpp
+++ b/src/zenserver/storage/zenstorageserver.cpp
@@ -222,8 +222,14 @@ ZenStorageServer::InitializeServices(const ZenStorageServerConfig& ServerOptions
m_OpenProcessCache = std::make_unique<OpenProcessCache>();
m_ProjectStore = new ProjectStore(*m_CidStore, m_DataRoot / "projects", m_GcManager, ProjectStore::Configuration{});
- m_HttpProjectService.reset(
- new HttpProjectService{*m_CidStore, m_ProjectStore, m_StatusService, m_StatsService, *m_AuthMgr, *m_OpenProcessCache, *m_JobQueue});
+ m_HttpProjectService.reset(new HttpProjectService{*m_CidStore,
+ m_ProjectStore,
+ m_StatusService,
+ m_StatsService,
+ *m_AuthMgr,
+ *m_OpenProcessCache,
+ *m_JobQueue,
+ ServerOptions.RestrictContentTypes});
if (ServerOptions.WorksSpacesConfig.Enabled)
{
generated by cgit v1.2.3 (git 2.25.1) at 2026-04-27 04:04:59 +0000