Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Skip validating the stacks token on SulWowza #53

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Skip validating the stacks token on SulWowza #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 3 additions & 19 deletions src/edu/stanford/dlss/wowza/SulWowza.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ void authorizeSession(IHTTPStreamerSession httpSession)
getLogger().debug(this.getClass().getSimpleName() + " userIp: " + userIp);
String streamName = httpSession.getStreamName();
getLogger().debug(this.getClass().getSimpleName() + " streamName: " + streamName);
if (validateStacksToken(stacksToken) && validateUserIp(userIp) && validateStreamName(streamName))
if (validateUserIp(userIp) && validateStreamName(streamName))
{
String druid = getDruid(streamName);
String filename = getFilename(streamName);
Expand All @@ -293,7 +293,7 @@ void authorizeSession(IHTTPStreamerSession httpSession)
boolean authorizePlay(String queryStr, String userIp, String streamName)
{
String stacksToken = getStacksToken(queryStr);
if (validateStacksToken(stacksToken) && validateUserIp(userIp) && validateStreamName(streamName))
if (validateUserIp(userIp) && validateStreamName(streamName))
{
String druid = getDruid(streamName);
String filename = getFilename(streamName);
Expand Down Expand Up @@ -333,22 +333,6 @@ String getStacksToken(String queryStr)
return null;
}

/** stacksToken is created by rails encryption in digital_stacks_rails app;
* we have chosen a min length of 10 here as a "safe" minimum length */
private static final int MIN_STACKS_TOKEN_LENGTH = 10;

boolean validateStacksToken(String stacksToken)
{
if (stacksToken != null && stacksToken.length() > MIN_STACKS_TOKEN_LENGTH)
return true;
else
{
getLogger().error(this.getClass().getSimpleName() + ": stacksToken missing or implausibly short" +
(stacksToken == null ? "" : ": " + stacksToken));
return false;
}
}

boolean isValidInetAddr(String inetAddress)
{
return InetAddressValidator.getInstance().isValid(inetAddress);
Expand Down Expand Up @@ -447,7 +431,7 @@ String getFilename(String streamName)
/** Assumption: stacksToken, druid, userIp and filename are all reasonable values (non-null, not empty, etc.) */
URL getVerifyStacksTokenUrl(String stacksToken, String druid, String filename, String userIp)
{
String queryStr = "stacks_token=" + escapeFormParam(stacksToken) + "&user_ip=" + escapeFormParam(userIp);
String queryStr = "stacks_token=" + escapeFormParam(stacksToken == null ? "" : stacksToken) + "&user_ip=" + escapeFormParam(userIp);
String fullUrl = stacksTokenVerificationBaseUrl + "/media/" +
escapePathSegment(druid) + "/" + escapePathSegment(filename) +
"/verify_token?" + queryStr;
Expand Down
35 changes: 0 additions & 35 deletions test/edu/stanford/dlss/wowza/TestSulWowza.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -561,17 +561,6 @@ public void authorizeSession_getsStacksToken()
verify(spyModule).getStacksToken(anyString());
}

@Test
public void authorizeSession_validatesStacksToken()
{
IHTTPStreamerSession sessionMock = mock(IHTTPStreamerSession.class);
when(sessionMock.getQueryStr()).thenReturn(queryStr);
SulWowza spyModule = spy(testModule);

spyModule.authorizeSession(sessionMock);
verify(spyModule).validateStacksToken(stacksToken);
}

@Test
public void authorizeSession_getsUserIp()
{
Expand Down Expand Up @@ -697,7 +686,6 @@ public void authorizePlay_trueIfAuthorized()
SulWowza spyModule = spy(testModule);

when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);
when(spyModule.validateUserIp(userIp)).thenReturn(true);
when(spyModule.validateStreamName(streamName)).thenReturn(true);
when(spyModule.getDruid(streamName)).thenReturn(druid);
Expand All @@ -719,7 +707,6 @@ public void authorizePlay_falseIfNotAuthorized()
SulWowza spyModule = spy(testModule);

when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);
when(spyModule.validateUserIp(userIp)).thenReturn(true);
when(spyModule.validateStreamName(streamName)).thenReturn(true);
when(spyModule.getDruid(streamName)).thenReturn(druid);
Expand All @@ -729,22 +716,6 @@ public void authorizePlay_falseIfNotAuthorized()
assertEquals(false, spyModule.authorizePlay(queryString, userIp, streamName));
}

@Test
public void authorizePlay_validatesStacksToken()
{
String queryString = "query";
String userIp = "1.1.1.1";
String streamName = "stream.mp4";
String token = "abcd";

SulWowza spyModule = spy(testModule);
when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateUserIp("1")).thenReturn(true);

spyModule.authorizePlay(queryString, userIp, streamName);
verify(spyModule).validateStacksToken(token);
}

@Test
public void authorizePlay_validatesUserIp()
{
Expand All @@ -755,7 +726,6 @@ public void authorizePlay_validatesUserIp()

SulWowza spyModule = spy(testModule);
when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);

spyModule.authorizePlay(queryString, userIp, streamName);
verify(spyModule).validateUserIp(userIp);
Expand All @@ -771,7 +741,6 @@ public void authorizePlay_validatesStreamName()

SulWowza spyModule = spy(testModule);
when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);
when(spyModule.validateUserIp(userIp)).thenReturn(true);

spyModule.authorizePlay(queryString, userIp, streamName);
Expand All @@ -788,7 +757,6 @@ public void authorizePlay_falseIfNullDruid()

SulWowza spyModule = spy(testModule);
when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);
when(spyModule.validateUserIp(userIp)).thenReturn(true);
when(spyModule.validateStreamName(streamName)).thenReturn(true);
when(spyModule.getDruid(streamName)).thenReturn(null);
Expand All @@ -807,7 +775,6 @@ public void authorizePlay_falseIfNullFilename()

SulWowza spyModule = spy(testModule);
when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);
when(spyModule.validateUserIp(userIp)).thenReturn(true);
when(spyModule.validateStreamName(streamName)).thenReturn(true);
when(spyModule.getFilename(streamName)).thenReturn(null);
Expand Down Expand Up @@ -837,7 +804,6 @@ public void authorizePlay_getsFilenameFromStreamName()
String token = "abcd";
SulWowza spyModule = spy(testModule);
when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);
when(spyModule.validateUserIp(userIp)).thenReturn(true);
when(spyModule.validateStreamName(streamName)).thenReturn(true);

Expand All @@ -854,7 +820,6 @@ public void authorizePlay_getsDruidFromStreamName()
String token = "abcd";
SulWowza spyModule = spy(testModule);
when(spyModule.getStacksToken(queryString)).thenReturn(token);
when(spyModule.validateStacksToken(token)).thenReturn(true);
when(spyModule.validateUserIp(userIp)).thenReturn(true);
when(spyModule.validateStreamName(streamName)).thenReturn(true);

Expand Down
21 changes: 21 additions & 0 deletions test/edu/stanford/dlss/wowza/TestVerifyStacksToken.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,27 @@ public void verifyTokenAgainstStacksService_stacksTokenNeedsEncoding()
assertEquals(expUrlStr, resultUrl.toString());
}

@Test
public void verifyTokenAgainstStacksService_missingStacksToken()
{
WMSProperties mockProperties = mock(WMSProperties.class);
when(mockProperties.getPropertyStr(anyString(), anyString())).thenReturn(SulWowza.DEFAULT_STACKS_TOKEN_VERIFICATION_BASEURL);
IApplicationInstance appInstanceMock = mock(IApplicationInstance.class);
when(appInstanceMock.getProperties()).thenReturn(mockProperties);
testModule.onAppStart(appInstanceMock);
String druid = "oo000oo0000";
String filename = "filename.ext";
String userIp = "0.0.0.0";
String expPath = "/media/" + druid + "/" + filename + "/verify_token";
String stacksToken = null;
// specifically list the expected encodings, as we've run into trouble with encoding methods that were encoding in unexpected ways
String expQueryStr = "?stacks_token=&user_ip=" + userIp;
String expUrlStr = SulWowza.DEFAULT_STACKS_TOKEN_VERIFICATION_BASEURL + expPath + expQueryStr;

URL resultUrl = testModule.getVerifyStacksTokenUrl(stacksToken, druid, filename, userIp);
assertEquals(expUrlStr, resultUrl.toString());
}

@Test
/** expect it to return null and log an error message */
public void getVerifyStacksTokenUrl_malformedUrl()
Expand Down