From 83aaccae5021b9e6a8163d2dfd72ae3a12bc4ab0 Mon Sep 17 00:00:00 2001
From: senju <senju@users.sourceforge.jp>
Date: Sun, 23 Aug 2009 18:26:56 +0900
Subject: [PATCH] =?utf8?q?CSRF=E3=82=A4=E3=83=B3=E3=82=BF=E3=83=BC?=
 =?utf8?q?=E3=82=BB=E3=83=97=E3=82=BF=E3=83=BC=E3=82=92=E3=83=9E=E3=82=B7?=
 =?utf8?q?=E3=81=AB=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

期限チェックを実装し、タブブラウザ等に対応。
---
 .../rabbitBTS/interceptors/CSRFInterceptor.java    | 85 +++++++++++++++++-----
 war/WEB-INF/rabbitBTS-servlet.xml                  |  4 +-
 2 files changed, 71 insertions(+), 18 deletions(-)

diff --git a/src/jp/sourceforge/rabbitBTS/interceptors/CSRFInterceptor.java b/src/jp/sourceforge/rabbitBTS/interceptors/CSRFInterceptor.java
index 439ac03..42add8f 100644
--- a/src/jp/sourceforge/rabbitBTS/interceptors/CSRFInterceptor.java
+++ b/src/jp/sourceforge/rabbitBTS/interceptors/CSRFInterceptor.java
@@ -17,9 +17,11 @@
 
 package jp.sourceforge.rabbitBTS.interceptors;
 
+import java.util.ArrayList;
 import java.util.Date;
-import java.util.LinkedList;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -36,6 +38,7 @@ import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
  * CSRF対策用インターセプター
  */
 public class CSRFInterceptor extends HandlerInterceptorAdapter {
+	private int expireInSecond;
 
 	/**
 	 * POSTの場合チェック処理
@@ -84,17 +87,29 @@ public class CSRFInterceptor extends HandlerInterceptorAdapter {
 		}
 	}
 
+	/**
+	 * チェック用クラス
+	 */
 	class CsrfChecker {
 		private final HttpServletRequest req;
-		private List<Object> tokenList;
+		private Map<String, Date> tokens;
 
+		/**
+		 * コンストラクタ
+		 * 
+		 * <p>
+		 * セッションにトークンのリストが存在しない場合、新規に作成しセッションに保存する。
+		 * 
+		 * @param request
+		 */
+		@SuppressWarnings("unchecked")
 		public CsrfChecker(HttpServletRequest request) {
 			this.req = request;
-			this.tokenList = (List) request.getSession().getAttribute(
-					"tokenList");
-			if (this.tokenList == null) {
-				this.tokenList = new LinkedList<Object>();
-				request.getSession().setAttribute("tokenList", this.tokenList);
+			this.tokens = (Map<String, Date>) request.getSession()
+					.getAttribute("tokens");
+			if (this.tokens == null) {
+				this.tokens = new HashMap<String, Date>();
+				request.getSession().setAttribute("tokens", this.tokens);
 			}
 		}
 
@@ -105,26 +120,62 @@ public class CSRFInterceptor extends HandlerInterceptorAdapter {
 		 */
 		public String saveNewToken() {
 			final String token = RandomStringUtils.randomAlphanumeric(128);
-			this.tokenList.add(token);
-			this.tokenList.add(new Date());
-
+			this.tokens.put(token, new Date());
 			return token;
 		}
 
+		/**
+		 * チェックを行う
+		 * 
+		 * @return 正しいパラメータが送信された場合true
+		 */
 		public boolean checkTokenValid() {
 			final String reqToken = this.req.getParameter("secureToken");
+			final Date datenow = new Date();
+			// トークンチェック
 			boolean found = false;
-			for (int i = 0; i < this.tokenList.size(); i += 2) {
-				final String token = (String) this.tokenList.get(i);
-				if (token.equals(reqToken)) {
-					// TODO:期限チェック
-					found = true;
-					break;
+			if (this.tokens.containsKey(reqToken)) {
+				found = checkExpire(datenow, this.tokens.get(reqToken));
+			}
+
+			// 削除チェック
+			if (this.tokens.size() > 30) {
+				final List<String> removeList = new ArrayList<String>();
+				for (final String token : this.tokens.keySet()) {
+					final Date created = this.tokens.get(token);
+					if (!this.checkExpire(datenow, created)) {
+						// 期限切れの場合
+						removeList.add(token);
+						Sht.log(this).finer("delete token: " + token);
+					}
+				}
+				for (final String token : removeList) {
+					this.tokens.remove(token);
 				}
 			}
-			// TODO:期限切れ削除
+
 			return found;
 		}
+
+		/**
+		 * 期限切れかチェックする。
+		 * 
+		 * @param datenow
+		 * @param created
+		 * @return 期限以内の場合true
+		 */
+		private boolean checkExpire(Date datenow, Date created) {
+			final long ageInMils = datenow.getTime() - created.getTime();
+			return ageInMils / 1000 < CSRFInterceptor.this.expireInSecond;
+		}
+	}
+
+	/**
+	 * @param expireInSecond
+	 *            the expireInSecond to set
+	 */
+	public void setExpireInSecond(int expireInMinute) {
+		this.expireInSecond = expireInMinute;
 	}
 
 }
diff --git a/war/WEB-INF/rabbitBTS-servlet.xml b/war/WEB-INF/rabbitBTS-servlet.xml
index 2baa492..0bba5d5 100644
--- a/war/WEB-INF/rabbitBTS-servlet.xml
+++ b/war/WEB-INF/rabbitBTS-servlet.xml
@@ -35,7 +35,9 @@
 	<bean class="jp.sourceforge.rabbitBTS.interceptors.AuthenticationInterceptor"
 		id="authInterceptor" />
 	<bean class="jp.sourceforge.rabbitBTS.interceptors.CSRFInterceptor"
-		id="csrf" />
+		id="csrf">
+		<property name="expireInSecond" value="60" />
+	</bean>
 	<bean
 		class="org.springframework.orm.jdo.support.OpenPersistenceManagerInViewInterceptor"
 		id="openInView">
-- 
2.11.0