Skip to content

Commit 92f8cda

Browse files
rafaelweingartnerrafaelweingartner
committed
Merge forward #2902 (Add checksum sanity validation on template registration)
2 parents 58b4e71 + 9003c7b commit 92f8cda

3 files changed

Lines changed: 58 additions & 2 deletions

File tree

‎server/src/main/java/com/cloud/template/HypervisorTemplateAdapter.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
4040
import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
4141
import org.apache.cloudstack.storage.command.TemplateOrVolumePostUploadCommand;
42+
import org.apache.cloudstack.utils.security.DigestHelper;
4243
import org.apache.log4j.Logger;
4344
import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao;
4445
import org.apache.cloudstack.api.command.user.iso.DeleteIsoCmd;
@@ -155,6 +156,7 @@ public TemplateProfile prepare(RegisterIsoCmd cmd) throws ResourceAllocationExce
155156
String url = profile.getUrl();
156157
UriUtils.validateUrl(ImageFormat.ISO.getFileExtension(), url);
157158
if (cmd.isDirectDownload()) {
159+
DigestHelper.validateChecksumString(cmd.getChecksum());
158160
Long templateSize = performDirectDownloadUrlValidation(url);
159161
profile.setSize(templateSize);
160162
}
@@ -170,6 +172,7 @@ public TemplateProfile prepare(RegisterTemplateCmd cmd) throws ResourceAllocatio
170172
String url = profile.getUrl();
171173
UriUtils.validateUrl(cmd.getFormat(), url);
172174
if (cmd.isDirectDownload()) {
175+
DigestHelper.validateChecksumString(cmd.getChecksum());
173176
Long templateSize = performDirectDownloadUrlValidation(url);
174177
profile.setSize(templateSize);
175178
}

‎utils/src/main/java/org/apache/cloudstack/utils/security/DigestHelper.java‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
// under the License.
1717
package org.apache.cloudstack.utils.security;
1818

19+
import org.apache.commons.lang.StringUtils;
20+
1921
import java.io.IOException;
2022
import java.io.InputStream;
2123
import java.math.BigInteger;
@@ -70,9 +72,9 @@ private static String getPaddedDigestString(MessageDigest digest, BigInteger pwI
7072
return checksum;
7173
}
7274

73-
static final Map<String, Integer> paddingLengths = creatPaddingLengths();
75+
static final Map<String, Integer> paddingLengths = getChecksumLengthsMap();
7476

75-
private static final Map<String, Integer> creatPaddingLengths() {
77+
private static final Map<String, Integer> getChecksumLengthsMap() {
7678
Map<String, Integer> map = new HashMap<>();
7779
map.put("MD5", 32);
7880
map.put("SHA-1", 40);
@@ -93,4 +95,25 @@ public static boolean isAlgorithmSupported(String checksum) {
9395
}
9496
return true;
9597
}
98+
99+
/**
100+
* Checksum sanity for not empty checksum. Expected format: {ALG}HASH
101+
* If ALG is missing, MD5 is assumed as default
102+
* Hash length is verified, depending on the algorithm.
103+
* IllegalArgumentException is thrown in case of malformed checksums
104+
*/
105+
public static void validateChecksumString(String checksum) {
106+
if(StringUtils.isNotEmpty(checksum)) {
107+
ChecksumValue checksumValue = new ChecksumValue(checksum);
108+
String digest = checksumValue.getChecksum();
109+
Map<String, Integer> map = getChecksumLengthsMap();
110+
if (!map.containsKey(checksumValue.getAlgorithm())) {
111+
throw new IllegalArgumentException("Algorithm " + checksumValue.getAlgorithm() + " was provided but it is not one of the supported algorithms");
112+
}
113+
Integer expectedLength = map.get(checksumValue.getAlgorithm());
114+
if (digest.length() != expectedLength) {
115+
throw new IllegalArgumentException("Checksum digest length should be " + expectedLength + " instead of " + digest.length());
116+
}
117+
}
118+
}
96119
}

‎utils/src/test/java/org/apache/cloudstack/utils/security/DigestHelperTest.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,10 @@ public class DigestHelperTest {
3232
private final static String INPUT_STRING_NO2 = "01234567890123456789012345678901234567890123456789012345678901234567890123456789b\n";
3333
private final static String INPUT_STRING_NO3 = "01234567890123456789012345678901234567890123456789012345678901234567890123456789h\n";
3434
private final static String SHA256_CHECKSUM = "{SHA-256}c6ab15af7842d23d3c06c138b53a7d09c5e351a79c4eb3c8ca8d65e5ce8900ab";
35+
private final static String SHA256_NO_PREFIX_CHECKSUM = "c6ab15af7842d23d3c06c138b53a7d09c5e351a79c4eb3c8ca8d65e5ce8900ab";
3536
private final static String SHA1_CHECKSUM = "{SHA-1}49e4b2f4292b63e88597c127d11bc2cc0f2ca0ff";
3637
private final static String MD5_CHECKSUM = "{MD5}d141a8eeaf6bba779d1d1dc5102a81c5";
38+
private final static String MD5_NO_PREFIX_CHECKSUM = "d141a8eeaf6bba779d1d1dc5102a81c5";
3739
private final static String ZERO_PADDED_MD5_CHECKSUM = "{MD5}0e51dfa74b87f19dd5e0124d6a2195e3";
3840
private final static String ZERO_PADDED_SHA256_CHECKSUM = "{SHA-256}08b5ae0c7d7d45d8ed406d7c3c7da695b81187903694314d97f8a37752a6b241";
3941
private static final String MD5 = "MD5";
@@ -97,6 +99,34 @@ public static void init() throws UnsupportedEncodingException {
9799
public void reset() throws IOException {
98100
inputStream.reset();
99101
}
102+
103+
@Test(expected = IllegalArgumentException.class)
104+
public void testChecksumSanityNoPrefixWrongAlgorithm() {
105+
DigestHelper.validateChecksumString(SHA256_NO_PREFIX_CHECKSUM);
106+
}
107+
108+
@Test
109+
public void testChecksumSanityNoPrefix() {
110+
DigestHelper.validateChecksumString(MD5_NO_PREFIX_CHECKSUM);
111+
}
112+
113+
@Test
114+
public void testChecksumSanityPrefixEmptyAlgorithm() {
115+
String checksum = "{}" + MD5_NO_PREFIX_CHECKSUM;
116+
DigestHelper.validateChecksumString(checksum);
117+
}
118+
119+
@Test(expected = IllegalArgumentException.class)
120+
public void testChecksumSanityPrefixWrongAlgorithm() {
121+
String checksum = "{MD5}" + SHA256_NO_PREFIX_CHECKSUM;
122+
DigestHelper.validateChecksumString(checksum);
123+
}
124+
125+
@Test(expected = IllegalArgumentException.class)
126+
public void testChecksumSanityPrefixWrongChecksumLength() {
127+
String checksum = SHA256_CHECKSUM + "XXXXX";
128+
DigestHelper.validateChecksumString(checksum);
129+
}
100130
}
101131

102132
//Generated with love by TestMe :) Please report issues and submit feature requests at: http://weirddev.com/forum#!/testme

0 commit comments

Comments
 (0)