Xinwen Deng / aem-src

/*
 * Decompiled with CFR 0_118.
 * 
 * Could not load the following classes:
 *  com.adobe.granite.xss.XSSAPI
 *  javax.servlet.http.HttpServletRequest
 *  javax.servlet.http.HttpServletResponse
 *  org.apache.commons.codec.binary.Base64
 *  org.apache.felix.scr.annotations.Activate
 *  org.apache.felix.scr.annotations.Component
 *  org.apache.felix.scr.annotations.ConfigurationPolicy
 *  org.apache.felix.scr.annotations.Deactivate
 *  org.apache.felix.scr.annotations.Property
 *  org.apache.felix.scr.annotations.PropertyUnbounded
 *  org.apache.felix.scr.annotations.Reference
 *  org.apache.sling.api.resource.LoginException
 *  org.apache.sling.api.resource.Resource
 *  org.apache.sling.api.resource.ResourceResolver
 *  org.apache.sling.api.resource.ResourceResolverFactory
 *  org.apache.sling.api.resource.ResourceUtil
 *  org.apache.sling.auth.core.spi.AbstractAuthenticationHandler
 *  org.apache.sling.commons.auth.spi.AuthenticationHandler
 *  org.apache.sling.commons.auth.spi.AuthenticationInfo
 *  org.apache.sling.jcr.api.SlingRepository
 *  org.osgi.framework.BundleContext
 *  org.osgi.framework.ServiceRegistration
 *  org.osgi.service.component.ComponentContext
 *  org.slf4j.Logger
 *  org.slf4j.LoggerFactory
 */
package com.day.cq.auth.impl;

import com.adobe.granite.xss.XSSAPI;
import com.day.cq.auth.impl.CugSupport;
import java.io.IOException;
import java.io.PrintWriter;
import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Dictionary;
import java.util.Enumeration;
import java.util.HashSet;
import java.util.Hashtable;
import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.codec.binary.Base64;
import org.apache.felix.scr.annotations.Activate;
import org.apache.felix.scr.annotations.Component;
import org.apache.felix.scr.annotations.ConfigurationPolicy;
import org.apache.felix.scr.annotations.Deactivate;
import org.apache.felix.scr.annotations.Property;
import org.apache.felix.scr.annotations.PropertyUnbounded;
import org.apache.felix.scr.annotations.Reference;
import org.apache.sling.api.resource.LoginException;
import org.apache.sling.api.resource.Resource;
import org.apache.sling.api.resource.ResourceResolver;
import org.apache.sling.api.resource.ResourceResolverFactory;
import org.apache.sling.api.resource.ResourceUtil;
import org.apache.sling.auth.core.spi.AbstractAuthenticationHandler;
import org.apache.sling.commons.auth.spi.AuthenticationHandler;
import org.apache.sling.commons.auth.spi.AuthenticationInfo;
import org.apache.sling.commons.osgi.OsgiUtil;
import org.apache.sling.jcr.api.SlingRepository;
import org.osgi.framework.BundleContext;
import org.osgi.framework.ServiceRegistration;
import org.osgi.service.component.ComponentContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/*
 * This class specifies class file version 49.0 but uses Java 6 signatures.  Assumed Java 6.
 */
@Component(metatype=1, label="%auth.http.name", description="%auth.http.description", name="com.day.cq.wcm.foundation.impl.HTTPAuthHandler", policy=ConfigurationPolicy.REQUIRE)
@Property(name="path", value={"/"})
public class HTTPAuthHandler
implements AuthenticationHandler {
    private final Logger log;
    private static final boolean DEFAULT_NO_LOGIN_FORM = false;
    @Property(boolValue={0})
    private static final String NO_LOGIN_FORM = "auth.http.nologin";
    private static final String DEFAULT_REALM = "Day Communique 5";
    @Property(value={"Day Communique 5"})
    private static final String REALM = "auth.http.realm";
    static final String REQUEST_LOGIN_PARAMETER = "sling:authRequestLogin";
    private static final String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate";
    private static final String HEADER_AUTHORIZATION = "Authorization";
    private static final String AUTHENTICATION_SCHEME_BASIC = "Basic";
    private static final String DEFAULT_DEFAULT_LOGIN_PAGE = "/libs/cq/core/content/login.html";
    @Property(value={"/libs/cq/core/content/login.html"})
    private static final String PROP_DEFAULT_LOGIN_PAGE = "auth.default.loginpage";
    private static final String PROP_FORM_LOGIN = "auth.cred.form";
    @Property(name="auth.cred.form", unbounded=PropertyUnbounded.ARRAY)
    private static final String[] DEFAULT_FORM_LOGIN = new String[]{"Firefox", "Shiretoko", "MSIE 7", "MSIE 6"};
    private static final String PROP_UTF8_CREDENTIALS = "auth.cred.utf8";
    @Property(name="auth.cred.utf8", unbounded=PropertyUnbounded.ARRAY)
    private static final String[] DEFAULT_UTF8_CREDENTIALS = new String[]{"Firefox", "Shiretoko", "Chrome", "Opera", "curl", "Wget"};
    static final String LOGIN_FORCED_FLAG = "cq.authhandler.dologin";
    @Property(name="service.description", propertyPrivate=1)
    private static final String DESCRIPTION = "HTTP Basic Authentication Handler";
    @Reference
    private SlingRepository repository;
    @Reference
    private ResourceResolverFactory resolverFactory;
    @Reference
    private CugSupport cugSupport;
    @Reference
    private XSSAPI xssAPI;
    private boolean noLoginForm;
    private String realm;
    private String defaultLoginPage;
    private String[] formSupportingUserAgents;
    private String[] utf8EncodingUserAgents;
    private ServiceRegistration registration;
    private Dictionary<?, ?> props;

    public HTTPAuthHandler() {
        this.log = LoggerFactory.getLogger((String)this.getClass().getName());
    }

    public AuthenticationInfo extractCredentials(HttpServletRequest request, HttpServletResponse response) {
        AuthenticationInfo info = this.extractAuthentication(request);
        if (info != null) {
            return info;
        }
        if (this.forceAuthentication(request, response)) {
            return AuthenticationInfo.DOING_AUTH;
        }
        return null;
    }

    /*
     * Enabled aggressive block sorting
     */
    public boolean requestCredentials(HttpServletRequest request, HttpServletResponse response) throws IOException {
        String lpMessage;
        String rMessage;
        String resource;
        if (response.isCommitted()) {
            this.log.error("requestAuthentication: Response is committed, cannot request authentication");
            return true;
        }
        response.resetBuffer();
        if (request.getParameter("sling:authRequestLogin") != null) {
            response.sendError(403);
            response.flushBuffer();
            return true;
        }
        if (!this.doLoginForm(request)) {
            this.log.debug("requestAuthentication: Not authenticating here because login form is disabled and cq.authhandler.dologin request attribute is not set");
            return false;
        }
        if (!this.isLoginFormClient(request)) {
            this.sendUnauthorized(request, response);
            return true;
        }
        String loginPage = this.getLoginPage(request);
        if (loginPage == null) {
            loginPage = this.getDefaultLoginPage();
            lpMessage = "requestAuthentication: Using default login page ({})";
        } else {
            lpMessage = "requestAuthentication: Using login page: {}";
        }
        if (this.isLoginFormLoop(request, loginPage)) {
            this.log.warn("requestAuthentication: Authentication loop detected, sending 401/UNAUTHENICATED to force browser based authentication");
            this.log.warn("requestAuthentication: Authentication loop reason: Wrong login page configuration or credentials not accepted for login");
            this.sendUnauthorized(request, response);
            return true;
        }
        if (request.getContextPath() != null && !loginPage.startsWith(request.getContextPath())) {
            loginPage = request.getContextPath() + loginPage;
        }
        if ((resource = request.getParameter("resource")) == null) {
            resource = request.getRequestURI();
            rMessage = "requestAuthentication: Using current request as post-login target: {}";
        } else if (!AbstractAuthenticationHandler.isRedirectValid((HttpServletRequest)request, (String)resource)) {
            resource = "/";
            rMessage = "requestAuthentication: Post-login target {} is invalid; using '/'";
        } else {
            rMessage = "requestAuthentication: Reusing post-login target from request parameter: {}";
        }
        if (this.log.isDebugEnabled()) {
            this.log.debug(lpMessage, (Object)loginPage);
            this.log.debug(rMessage, (Object)resource);
        }
        response.setContentType("text/html");
        response.setCharacterEncoding("UTF-8");
        response.setHeader("Cache-control", "no-cache");
        response.addHeader("Cache-control", "no-store");
        response.setHeader("Dispatcher", "no-cache");
        response.setHeader("Pragma", "no-cache");
        response.setHeader("Expires", "0");
        PrintWriter w = response.getWriter();
        w.write("<html><head><script type=\"text/javascript\">");
        w.write("var u=\"");
        w.write(this.xssAPI.encodeForJSString(loginPage));
        w.write("?resource=");
        w.write(this.xssAPI.encodeForJSString(resource));
        w.write("\"; if ( window.location.hash) {");
        w.write("u = u + window.location.hash;");
        w.write("} document.location = u;");
        w.write("</script></head><body>");
        w.write("<!-- QUICKSTART_HOMEPAGE - (string used for readyness detection, do not remove) -->");
        w.write("</body></html>");
        response.flushBuffer();
        return true;
    }

    public void dropCredentials(HttpServletRequest request, HttpServletResponse response) throws IOException {
        if (request.getHeader("Authorization") != null) {
            this.requestCredentials(request, response);
        }
    }

    private String getDefaultLoginPage() {
        return this.defaultLoginPage;
    }

    private String getLoginPage(HttpServletRequest request) {
        return null;
    }

    private String getRealm(HttpServletRequest request) {
        String realm = this.cugSupport.getRealm(request);
        this.log.info("CUG realm: {}", (Object)realm);
        return realm;
    }

    public String toString() {
        return "HTTP Basic Authentication Handler";
    }

    /*
     * WARNING - Removed try catching itself - possible behaviour change.
     */
    @Activate
    protected void activate(ComponentContext componentContext) {
        this.configure(componentContext.getProperties());
        ResourceResolver unprivilegedResourceResolver = null;
        try {
            unprivilegedResourceResolver = this.resolverFactory.getResourceResolver(null);
            this.registration = componentContext.getBundleContext().registerService(AuthenticationHandler.class.getName(), (Object)this, this.getProperties(unprivilegedResourceResolver));
        }
        catch (LoginException re) {
            this.log.error("bindRepository: Failed logging in, cannot handle Closed User Groups", (Throwable)re);
        }
        finally {
            if (unprivilegedResourceResolver != null) {
                unprivilegedResourceResolver.close();
            }
        }
    }

    private void configure(Dictionary<?, ?> properties) {
        this.noLoginForm = OsgiUtil.toBoolean(properties.get("auth.http.nologin"), false);
        this.realm = OsgiUtil.toString(properties.get("auth.http.realm"), "Day Communique 5");
        this.defaultLoginPage = OsgiUtil.toString(properties.get("auth.default.loginpage"), "/libs/cq/core/content/login.html");
        this.formSupportingUserAgents = OsgiUtil.toStringArray(properties.get("auth.cred.form"), DEFAULT_FORM_LOGIN);
        this.utf8EncodingUserAgents = OsgiUtil.toStringArray(properties.get("auth.cred.utf8"), DEFAULT_UTF8_CREDENTIALS);
        this.log.debug("configure: realm='{}', loginPage='{}'", (Object)this.realm, (Object)this.defaultLoginPage);
        this.props = properties;
    }

    @Deactivate
    protected void deactivate(ComponentContext componentContext) {
        if (this.registration != null) {
            this.registration.unregister();
            this.registration = null;
        }
    }

    private Dictionary<String, Object> getProperties(ResourceResolver resourceResolver) {
        Hashtable<String, Object> newProps = new Hashtable<String, Object>();
        Enumeration ke = this.props.keys();
        while (ke.hasMoreElements()) {
            Object key = ke.nextElement();
            newProps.put(key.toString(), this.props.get(key));
        }
        ArrayList<String> merged = new ArrayList<String>();
        HashSet<String> authReqs = new HashSet<String>();
        authReqs.add("-" + HTTPAuthHandler.toRawPath(this.getDefaultLoginPage(), resourceResolver));
        String[] paths = OsgiUtil.toStringArray(this.props.get("path"));
        if (paths != null) {
            merged.addAll(Arrays.asList(paths));
        }
        newProps.put("sling.auth.requirements", authReqs.toArray(new String[authReqs.size()]));
        newProps.put("path", merged.toArray(new String[merged.size()]));
        return newProps;
    }

    private static String toRawPath(String path, ResourceResolver resourceResolver) {
        Resource loginPageResource;
        if (resourceResolver != null && !ResourceUtil.isNonExistingResource((Resource)(loginPageResource = resourceResolver.resolve(path)))) {
            return resourceResolver.map(loginPageResource.getPath());
        }
        return path;
    }

    private AuthenticationInfo extractAuthentication(HttpServletRequest request) {
        char[] password;
        String user;
        String decoded;
        String authHeader = request.getHeader("Authorization");
        if (!(authHeader != null && authHeader.length() != 0 || authHeader != null && authHeader.length() != 0)) {
            return null;
        }
        int blank = (authHeader = authHeader.trim()).indexOf(32);
        if (blank <= 0) {
            return null;
        }
        String authType = authHeader.substring(0, blank);
        String authInfo = authHeader.substring(blank).trim();
        if (!authType.equalsIgnoreCase("Basic")) {
            return null;
        }
        try {
            byte[] encoded = authInfo.getBytes("ISO-8859-1");
            byte[] bytes = Base64.decodeBase64((byte[])encoded);
            decoded = new String(bytes, this.getCredentialsEncoding(request));
        }
        catch (UnsupportedEncodingException uee) {
            this.log.error("extractAuthentication: Cannot en/decode authentication info", (Throwable)uee);
            return null;
        }
        int colIdx = decoded.indexOf(58);
        if (colIdx < 0) {
            user = decoded;
            password = new char[]{};
        } else {
            user = decoded.substring(0, colIdx);
            password = decoded.substring(colIdx + 1).toCharArray();
        }
        return new AuthenticationInfo("BASIC", user, password);
    }

    private boolean forceAuthentication(HttpServletRequest request, HttpServletResponse response) {
        boolean authenticationForced = false;
        if (request.getParameter("sling:authRequestLogin") != null) {
            if (!response.isCommitted()) {
                authenticationForced = this.sendUnauthorized(request, response);
            } else {
                this.log.error("forceAuthentication: Response is committed, cannot request authentication");
            }
        } else {
            this.log.debug("forceAuthentication: Not forcing authentication because request parameter {} is not set", (Object)"sling:authRequestLogin");
        }
        return authenticationForced;
    }

    private boolean sendUnauthorized(HttpServletRequest request, HttpServletResponse response) {
        if (response.isCommitted()) {
            this.log.debug("sendUnauthorized: Response committed, cannot send 401/UNAUTHORIZED");
            return false;
        }
        String realm = this.getRealm(request);
        if (realm == null) {
            realm = this.realm;
        }
        response.reset();
        response.setStatus(401);
        response.setHeader("WWW-Authenticate", "Basic realm=\"" + realm + "\"");
        try {
            response.flushBuffer();
            return true;
        }
        catch (IOException ioe) {
            this.log.error("sendUnauthorized: Failed requesting authentication", (Throwable)ioe);
            return false;
        }
    }

    private boolean doLoginForm(HttpServletRequest request) {
        if (request.getAttribute("cq.authhandler.dologin") != null) {
            return true;
        }
        return !this.noLoginForm;
    }

    private boolean isLoginFormClient(HttpServletRequest request) {
        String userAgent = request.getHeader("User-Agent");
        if (this.userAgentMatch(userAgent, this.formSupportingUserAgents)) {
            this.log.debug("isLoginFormClient: Client ({}) assumed to support form based authentication", (Object)userAgent);
            return true;
        }
        this.log.debug("isLoginFormClient: Client ({}) assumed to not support form based authentication, sending 401/UNAUTHORIZED", (Object)userAgent);
        return false;
    }

    private boolean isLoginFormLoop(HttpServletRequest request, String loginPage) {
        String loginUri;
        String ctxPath = request.getContextPath();
        String string = loginUri = ctxPath == null || ctxPath.length() == 0 ? loginPage : ctxPath.concat(loginPage);
        if (request.getRequestURI().equals(loginUri)) {
            return true;
        }
        String referer = request.getHeader("Referer");
        if (referer != null) {
            try {
                URI refererUri = new URI(referer);
                return loginUri.equals(refererUri.getPath());
            }
            catch (URISyntaxException e) {
                // empty catch block
            }
        }
        return false;
    }

    private String getCredentialsEncoding(HttpServletRequest request) {
        String userAgent = request.getHeader("User-Agent");
        if (this.userAgentMatch(userAgent, this.utf8EncodingUserAgents)) {
            this.log.debug("getCredentialsEncoding: User-Agent ({}) indicates UTF-8 encoding browser, using UTF-8", (Object)userAgent);
            return "UTF-8";
        }
        this.log.debug("getCredentialsEncoding: User-Agent ({}) indicates non-UTF-8 encoding browser, using ISO-8859-1", (Object)userAgent);
        return "ISO-8859-1";
    }

    private /* varargs */ boolean userAgentMatch(String userAgent, String ... options) {
        if (userAgent != null && options.length > 0) {
            for (String option : options) {
                if (!userAgent.contains(option)) continue;
                return true;
            }
        }
        return false;
    }

    protected void bindRepository(SlingRepository slingRepository) {
        this.repository = slingRepository;
    }

    protected void unbindRepository(SlingRepository slingRepository) {
        if (this.repository == slingRepository) {
            this.repository = null;
        }
    }

    protected void bindResolverFactory(ResourceResolverFactory resourceResolverFactory) {
        this.resolverFactory = resourceResolverFactory;
    }

    protected void unbindResolverFactory(ResourceResolverFactory resourceResolverFactory) {
        if (this.resolverFactory == resourceResolverFactory) {
            this.resolverFactory = null;
        }
    }

    protected void bindCugSupport(CugSupport cugSupport) {
        this.cugSupport = cugSupport;
    }

    protected void unbindCugSupport(CugSupport cugSupport) {
        if (this.cugSupport == cugSupport) {
            this.cugSupport = null;
        }
    }

    protected void bindXssAPI(XSSAPI xSSAPI) {
        this.xssAPI = xSSAPI;
    }

    protected void unbindXssAPI(XSSAPI xSSAPI) {
        if (this.xssAPI == xSSAPI) {
            this.xssAPI = null;
        }
    }
}