Altitude/AltitudeWeb
5
0
Fork 0
Code Issues 12 Pull Requests Actions Packages Projects Releases Wiki Activity

Validate sender UUID in sendServerMessage to prevent spoofing and enhance security.

Browse Source
This commit is contained in:
akastijn 2026-08-02 18:43:12 +02:00
parent 065db06e16
commit ce7c68511b
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ServerMessageController.java
View File

@ -1,6 +1,7 @@
package com.alttd.altitudeweb.controllers.chat; package com.alttd.altitudeweb.controllers.chat;
import com.alttd.altitudeweb.api.ServerMessageApi; import com.alttd.altitudeweb.api.ServerMessageApi;
import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
import com.alttd.altitudeweb.model.ServerMessageRequestDto; import com.alttd.altitudeweb.model.ServerMessageRequestDto;
import com.alttd.altitudeweb.services.chat.to_server.ServerMessageService; import com.alttd.altitudeweb.services.chat.to_server.ServerMessageService;
import com.alttd.altitudeweb.services.chat.to_server.data.ChatFromWeb; import com.alttd.altitudeweb.services.chat.to_server.data.ChatFromWeb;
@ -11,6 +12,9 @@ import lombok.extern.slf4j.Slf4j;
import org.springframework.http.HttpStatus; import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity; import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.server.ResponseStatusException;
import java.util.UUID;
@Slf4j @Slf4j
@RestController @RestController
@ -19,6 +23,7 @@ public class ServerMessageController implements ServerMessageApi {
private final ServerMessageService serverMessageService; private final ServerMessageService serverMessageService;
private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper(); private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
private final AuthenticatedUuid authenticatedUuid;
public static String toJson(Object object) { public static String toJson(Object object) {
try { try {
@ -30,13 +35,19 @@ public class ServerMessageController implements ServerMessageApi {
@Override @Override
public ResponseEntity<Void> sendServerMessage(String server, ServerMessageRequestDto serverMessageRequestDto) { public ResponseEntity<Void> sendServerMessage(String server, ServerMessageRequestDto serverMessageRequestDto) {
UUID authenticatedUserUuid = authenticatedUuid.getAuthenticatedUserUuid();
if (!authenticatedUserUuid.equals(serverMessageRequestDto.getUuid())) {
throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Cannot send message as another user");
}
ChatFromWeb chatFromWeb = ChatFromWeb.builder() ChatFromWeb chatFromWeb = ChatFromWeb.builder()
.sender(serverMessageRequestDto.getUuid()) .sender(serverMessageRequestDto.getUuid())
.message(serverMessageRequestDto.getMessage()) .message(serverMessageRequestDto.getMessage())
.build(); .build();
String json = toJson(chatFromWeb); String json = toJson(chatFromWeb);
//TODO [Stijn] [2026-08-02]: Validate the user can send a message in this server (or do that in chat)
if (serverMessageService.sendMessage(server, "web_chat", json)) { if (serverMessageService.sendMessage(server, "web_chat", json)) {
return new ResponseEntity<>(HttpStatus.ACCEPTED); return new ResponseEntity<>(HttpStatus.ACCEPTED);
} else { } else {