package com.cox.applications.bpel; import java.io.BufferedReader; import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; import java.io.PrintWriter; import java.util.ArrayList; import java.util.List; import java.util.regex.Matcher; import java.util.regex.Pattern; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class BPELConsoleFilter implements Filter { private static final String CONTENT_TYPE = "text/html; charset=windows-1252"; // Use the bpelfilters.txt to determine what to deny access to private static final String FILE_LOCATION = "bpelfilters.txt"; // The filter applies to users with the Viewers role private static final String VIEWERS_ROLE = "Viewers"; private static List filters = null; public BPELConsoleFilter() throws Exception { if (filters == null) { filters = readFilters(FILE_LOCATION); } } private FilterConfig filterConfig = null; public void init(FilterConfig filterConfig) throws ServletException { this.filterConfig = filterConfig; } public void destroy() { this.filterConfig = null; } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpServletRequest = (HttpServletRequest)request; boolean viewersRole = httpServletRequest.isUserInRole(VIEWERS_ROLE); String requestURL = httpServletRequest.getRequestURI() + "?" + httpServletRequest.getQueryString(); if (viewersRole == true) { if (filters == null) { filters = readFilters(FILE_LOCATION); } if (matchAll(filters, requestURL)) { HttpServletResponse httpServletResponse = (HttpServletResponse)response; httpServletResponse.setContentType(CONTENT_TYPE); PrintWriter out = httpServletResponse.getWriter(); // What is displayed to the user out.println("Access Denied"); out.println(""); out.close(); return; } else { // Requested URL is not sensitive, so give access chain.doFilter(request, response); } } else{ // Does not have Viewers role, so let BPEL handle it chain.doFilter(request, response); } } public boolean match(String pattern, String inputString) { Pattern p = Pattern.compile(pattern.toUpperCase()); Matcher m = p.matcher(inputString.toUpperCase()); boolean b = m.matches(); return b; } public boolean matchAll(List patterns, String inputString) { for (String pattern: patterns) { if (match(pattern, inputString) == true) { return true; } } return false; } public List readFilters(String fileName) throws IOException { List filterList = new ArrayList(); try { InputStream inStream = this.getClass().getClassLoader().getResourceAsStream(fileName); BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inStream)); while (true) { String line = bufferedReader.readLine(); if (line == null) { break; } filterList.add(line); } } catch (IOException e) { e.printStackTrace(); throw e; } return filterList; } }