Skip to content

Require HTTP method to blacklist CONNECTs #352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 1, 2016
Merged

Require HTTP method to blacklist CONNECTs #352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions browsermob-core-littleproxy/src/main/java/net/lightbody/bmp/filters/BlacklistFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import io.netty.channel.ChannelHandlerContext;
import io.netty.handler.codec.http.DefaultFullHttpResponse;
import io.netty.handler.codec.http.HttpHeaders;
import io.netty.handler.codec.http.HttpMethod;
import io.netty.handler.codec.http.HttpObject;
import io.netty.handler.codec.http.HttpRequest;
import io.netty.handler.codec.http.HttpResponse;
Expand Down Expand Up @@ -37,6 +38,11 @@ public HttpResponse clientToProxyRequest(HttpObject httpObject) {
String url = getFullUrl(httpRequest);

for (BlacklistEntry entry : blacklistedUrls) {
if (HttpMethod.CONNECT.equals(httpRequest.getMethod()) && entry.getHttpMethodPatern() == null) {
// do not allow CONNECTs to be blacklisted unless a method pattern is explicitly specified
continue;
}

if (entry.matches(url, httpRequest.getMethod().name())) {
HttpResponseStatus status = HttpResponseStatus.valueOf(entry.getStatusCode());
HttpResponse resp = new DefaultFullHttpResponse(httpRequest.getProtocolVersion(), status);
Expand Down
27 changes: 27 additions & 0 deletions browsermob-core-littleproxy/src/test/groovy/net/lightbody/bmp/proxy/BlacklistTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,4 +175,31 @@ class BlacklistTest extends MockServerTest {
assertThat("Expected blacklisted response to contain 0-length body", blacklistedResponseBody, isEmptyOrNullString())
}
}

@Test
void testBlacklistDoesNotApplyToCONNECT() {
mockServer.when(request()
.withMethod("GET")
.withPath("/connectNotBlacklisted"),
Times.unlimited())
.respond(response()
.withStatusCode(200)
.withBody("success"))

proxy = new BrowserMobProxyServer()
proxy.setTrustAllServers(true)
proxy.start()
int proxyPort = proxy.getPort()

// HTTP CONNECTs should not be blacklisted unless the method is explicitly specified
proxy.blacklistRequests("https://localhost:${mockServerPort}", 405)

ProxyServerTest.getNewHttpClient(proxyPort).withCloseable {
CloseableHttpResponse response = it.execute(new HttpGet("https://localhost:${mockServerPort}/connectNotBlacklisted"))
assertEquals("Expected to receive response from mock server after successful CONNECT", 200, response.getStatusLine().getStatusCode())

String responseBody = IOUtils.toStringAndClose(response.getEntity().getContent())
assertEquals("Expected to receive HTTP 200 and success message from server", "success", responseBody)
}
}
}