java로 web server만들기 과제(5트)

Question

안녕하세요. java로 web server만드는 과제로 며칠전에도 올렸었는데요.과제로 나온것 중에서 모르는게 있어서 질문드립니다. 3-1. 403 오류의 경우 아래와 같은 Case 에서 발생해야 합니다. 3-1-1. 설정된 HTTP_DOC_ROOT 외 다른 범위의 파일에 접근하려 할 경우.. ex) http://127.0.0.1/../../../etc/passwd요청 헤더에는 경로에 있는 "/../../../"가 안찍히는데 "/../../../"를 어떻게 처리할수 있을까요? 구글에 검색하려해도 특수문자(/../)라 검색이 안되네요.아래는 코드입니다.package org.webServer; import org.config.Config; import java.io.*; import java.net.ServerSocket; import java.net.Socket; import java.net.URL; import java.util.HashMap; import java.util.Properties; import java.util.concurrent.ExecutorService; import java.util.concurrent.Executors; import java.util.logging.Level; import java.util.logging.Logger; public class HttpServer { private static final Logger logger = Logger.getLogger(HttpServer.class.getCanonicalName()); private static final int NUM_THREADS = 50; private static final String INDEX_FILE = "index.html"; private final File rootDirectory; private final int port; private static HashMap configMap; public HttpServer(File rootDirectory, int port) throws IOException { if (!rootDirectory.isDirectory()) { throw new IOException(rootDirectory + " does not exist as a directory"); } this.rootDirectory = rootDirectory; this.port = port; } public void start() throws IOException { ExecutorService pool = Executors.newFixedThreadPool(NUM_THREADS); try (ServerSocket server = new ServerSocket(port)) { logger.info("Accepting connections on port : " + server.getLocalPort()); while (true) { try { Socket request = server.accept(); Runnable r = new RequestProcessor(rootDirectory, INDEX_FILE, request, configMap); pool.submit(r); } catch (IOException ex) { logger.log(Level.WARNING, "Error accepting connection", ex); } } } } public static void main(String[] args) throws IOException { Properties properties = new Properties(); Config config = new Config(); ClassLoader cl; // cl = Thread.currentThread().getContextClassLoader(); cl = HttpServer.class.getClassLoader(); if( cl == null ) cl = ClassLoader.getSystemClassLoader(); // URL url = cl.getResource( "info.properties" ); https://sthyun.tistory.com/entry/java%EC%97%90%EC%84%9C-property%ED%8C%8C%EC%9D%BC-%EC%89%BD%EA%B2%8C-%EC%B0%BE%EA%B8%B0-ClassLoader // filepath = url.getFile(); https://www.techiedelight.com/ko/read-properties-files-java/ logger.info("cl : " + cl); // logger.info("url : " + url); try (InputStream inputStream = cl.getResourceAsStream("info.properties"); Reader reader = new InputStreamReader(inputStream)) { properties.load(reader); } configMap = config.loopConvert(properties); logger.info("configMap.get(\"server.HTTP_DOC_ROOT.localhost\" ) : " + configMap.get("server.HTTP_DOC_ROOT.localhost" )); File docRoot = new File(configMap.get("server.HTTP_DOC_ROOT.localhost" )); int port = Integer.parseInt(configMap.get("server.port")); try { HttpServer webserver = new HttpServer(docRoot, port); webserver.start(); } catch (IOException ex) { logger.log(Level.SEVERE, "Server could not start", ex); } } }package org.webServer; import org.header.Header; import java.io.*; import java.net.Socket; import java.net.URLConnection; import java.nio.charset.StandardCharsets; import java.nio.file.Files; import java.nio.file.Paths; import java.util.*; //import java.util.Scanner; import java.util.logging.Level; import java.util.logging.Logger; public class RequestProcessor implements Runnable { private final static Logger logger = Logger.getLogger(RequestProcessor.class.getCanonicalName()); private File rootDirectory; private String indexFileName = "index.html"; private final Socket connection; private HashMap configMap; public RequestProcessor(Socket connection){ this.connection = connection; } public RequestProcessor(File rootDirectory, String indexFileName, Socket connection, HashMap configMap) { if (rootDirectory.isFile()) { throw new IllegalArgumentException( "rootDirectory must be a directory, not a file"); } try { rootDirectory = rootDirectory.getCanonicalFile(); } catch (IOException ex) { logger.severe( ex.getLocalizedMessage() ); } if (indexFileName != null) { this.indexFileName = indexFileName; } this.rootDirectory = rootDirectory; this.connection = connection; this.configMap = configMap; } @Override public void run() { // for security checks String root = rootDirectory.getPath(); logger.info("RequestProcessor Start!!!!!!!"); try (OutputStream raw = new BufferedOutputStream(connection.getOutputStream()); Writer out = new OutputStreamWriter(raw); InputStream inputStream = connection.getInputStream(); // getInputStream()는 한번만 호출 가능 BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream, StandardCharsets.UTF_8)); ) { StringBuilder builder = new StringBuilder(); String line = null; String host = ""; while (!(line = reader.readLine()).isEmpty()) { builder.append(line).append(" "); } String headers = builder.toString(); logger.info("headers : " + builder.toString()); String[] headerProperties = headers.split("\n"); Header header = new Header(headerProperties); host = header.getHost(); // logger.info("connection.getRemoteSocketAddress" + connection.getRemoteSocketAddress() + " " + get); String method = header.getMethod(); String version = header.getVersion(); try { if (method.equals("GET")) { String fileName = header.getAccessFile(); // 호스트별 경로 설정 if (fileName.endsWith("/")) { root = getHostRoot(host, configMap); fileName += "index.html"; } else { root = getHostRoot(host, configMap); } String contentType = URLConnection.getFileNameMap().getContentTypeFor(fileName); File theFile = new File(root, fileName.substring(1, fileName.length())); // 허용되지 않은 mime type String fileSubs = fileName.substring(fileName.indexOf(".") + 1, fileName.length()); String[] blockMimeType = configMap.get("blockMimeType").split("\,"); if (theFile.canRead() && theFile.getCanonicalPath().startsWith(root)) { logger.info("HTTP/1.0 200 OK!!!!"); byte[] theData = Files.readAllBytes(theFile.toPath()); if (version.startsWith("HTTP/")) { // send a MIME header sendHeader(out, "HTTP/1.0 200 OK", contentType, theData.length); } raw.write(theData); raw.flush(); } // 403 error // .properties에 저장한 허용되지 않은 mime type 확장자를 검사 // HTTP_DOC_ROOT인지 검사 else if (Arrays.asList(blockMimeType).contains(fileSubs) || !theFile.getCanonicalPath().startsWith(root) || fileName.indexOf("../") > -1) { // header에 안찍힘 logger.info("HTTP/1.0 403 forbidden!!!!"); String body = responseErrBody(host, configMap, ".403"); if (version.startsWith("HTTP/")) { sendHeader(out, "HTTP/1.0 403 Forbidden", "text/html; charset=utf-8", body.length()); } out.write(body); out.flush(); } // 404 error // HTTP_DOC_ROOT 상에 없는지 검사 else if (!theFile.exists() && theFile.getCanonicalPath().startsWith(root)) { logger.info("HTTP/1.0 404 file not found!!!!"); String body = responseErrBody(host, configMap, ".404"); if (version.startsWith("HTTP/")) { // send a MIME header sendHeader(out, "HTTP/1.0 404 File Not Found", "text/html; charset=utf-8", body.length()); } out.write(body); out.flush(); } else { throw new IOException(); } } else { // method does not equal "GET" String body = new StringBuilder(" ").append("Not Implemented ").append(" ") .append("") .append("

HTTP Error 501: Not Implemented

") .append(" ").toString(); if (version.startsWith("HTTP/")) { // send a MIME header sendHeader(out, "HTTP/1.0 501 Not Implemented", "text/html; charset=utf-8", body.length()); } out.write(body); out.flush(); } } // 500 error // 내부 로직 오류 발생시 catch (IOException e){ String body = responseErrBody(host, configMap, ".500"); sendHeader(out, "HTTP/1.0 500 Internal Server Error", "text/html; charset=utf-8", body.length()); out.write(body); out.flush(); } } catch (IOException ex) { logger.log(Level.WARNING, "Error talking to " + connection.getRemoteSocketAddress(), ex); } finally { try { connection.close(); } catch (IOException ex) { } } } private void sendHeader(Writer out, String responseCode, String contentType, int length) throws IOException { out.write(responseCode + " "); Date now = new Date(); out.write("Date: " + now + " "); out.write("Server: JHTTP 2.0 "); out.write("Content-length: " + length + " "); out.write("Content-type: " + contentType + " "); out.flush(); } public String getHostRoot(String host, HashMap configMap){ String root; if(host.indexOf(".") > -1){ root = configMap.get("server.HTTP_DOC_ROOT." + host.substring(0, host.indexOf("."))); } else { root = configMap.get("server.HTTP_DOC_ROOT.localhost"); } return root; } public String responseErrBody(String host, HashMap configMap, String errCode) throws IOException { String subhost = host.substring(0, host.indexOf(".") > -1 ? host.indexOf(".") : host.length()); String hostDocRoot = "server.HTTP_DOC_ROOT." + subhost; byte[] theData = Files.readAllBytes(Paths.get(configMap.get(hostDocRoot) + configMap.get("server.HTTP_DOC_ROOT" + errCode))); String body = new String(theData, StandardCharsets.UTF_8); return body; } }

java로 web server만들기 과제(5트)

0개의 답변

#socketprogramming 목록