Skip to content

Commit 1c3b9f7

Browse files
mearvkmearvk
committed
Science Commit 5.
1 parent 63ed65e commit 1c3b9f7

3 files changed

Lines changed: 89 additions & 45 deletions

File tree

‎modules/black/presidential/Brarner.M.Alete/servlets/servlet/src/main/webapp/register.jsp‎

Lines changed: 44 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -12,36 +12,45 @@
1212
byte[] keyData = null;
1313
String keyFilename = "";
1414
15-
// Parse multipart manually (no external lib needed)
16-
ServletInputStream sis = request.getInputStream();
17-
String boundary = request.getContentType().split("boundary=")[1];
18-
String line;
19-
BufferedReader br = new BufferedReader(new InputStreamReader(sis, "UTF-8"));
20-
StringBuilder currentField = null;
21-
String currentFieldName = null;
22-
boolean inFile = false;
23-
ByteArrayOutputStream fileBytes = new ByteArrayOutputStream();
24-
25-
// Use Part API (Servlet 3.0+)
15+
// Use Part API (Servlet 6.0 / Jakarta)
2616
try {
2717
displayName = request.getParameter("display_name");
2818
jakarta.servlet.http.Part filePart = request.getPart("auth_key");
2919
if (filePart != null && filePart.getSize() > 0) {
30-
keyFilename = Paths.get(filePart.getSubmittedFileName()).getFileName().toString();
31-
InputStream fis = filePart.getInputStream();
32-
keyData = fis.readAllBytes();
33-
fis.close();
20+
// Validate file size (max 1MB for a key file)
21+
if (filePart.getSize() > 1048576) {
22+
message = "Key file too large (max 1MB).";
23+
} else {
24+
// Sanitize filename: strip path, allow only safe characters
25+
String rawName = filePart.getSubmittedFileName();
26+
keyFilename = Paths.get(rawName).getFileName().toString()
27+
.replaceAll("[^a-zA-Z0-9._\\-]", "_");
28+
// Validate extension
29+
String ext = keyFilename.contains(".") ? keyFilename.substring(keyFilename.lastIndexOf('.') + 1).toLowerCase() : "";
30+
if (!ext.matches("key|pem|pub|txt|crt|der")) {
31+
message = "Invalid file type. Allowed: .key, .pem, .pub, .txt, .crt, .der";
32+
keyFilename = "";
33+
} else {
34+
// Read bytes safely
35+
InputStream fis = filePart.getInputStream();
36+
keyData = fis.readAllBytes();
37+
fis.close();
38+
}
39+
}
3440
}
3541
} catch (Exception pe) {
36-
// fallback
37-
message = "Upload error: " + pe.getMessage();
42+
message = "Upload error: " + (pe.getMessage() != null ? pe.getMessage().replace("<","&lt;") : "unknown");
3843
}
3944
4045
if (displayName == null || displayName.trim().isEmpty()) {
41-
displayName = request.getParameter("display_name");
46+
displayName = "";
4247
}
48+
// Sanitize display name (max 100 chars, strip HTML)
49+
displayName = displayName.trim();
50+
if (displayName.length() > 100) displayName = displayName.substring(0, 100);
51+
displayName = displayName.replaceAll("<[^>]*>", "");
4352
44-
if (message == null && displayName != null && !displayName.trim().isEmpty()) {
53+
if (message == null && !displayName.isEmpty()) {
4554
// Save registration
4655
Properties dbProps = new Properties();
4756
InputStream dbIn = application.getResourceAsStream("/WEB-INF/db.properties");
@@ -68,21 +77,34 @@
6877
"ip_address VARCHAR(45) NOT NULL, " +
6978
"auth_key MEDIUMBLOB, " +
7079
"key_filename VARCHAR(255), " +
80+
"key_sha256 CHAR(64), " +
7181
"authorized BOOLEAN DEFAULT FALSE, " +
7282
"registered_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP)");
7383
84+
// Compute SHA-256 of key if present
85+
String keySha256 = null;
86+
if (keyData != null) {
87+
java.security.MessageDigest md = java.security.MessageDigest.getInstance("SHA-256");
88+
byte[] hash = md.digest(keyData);
89+
StringBuilder sb = new StringBuilder();
90+
for (byte b : hash) sb.append(String.format("%02x", b));
91+
keySha256 = sb.toString();
92+
}
93+
7494
PreparedStatement ps = conn.prepareStatement(
75-
"INSERT INTO registrations (display_name, ip_address, auth_key, key_filename, authorized) VALUES (?, ?, ?, ?, ?)");
95+
"INSERT INTO registrations (display_name, ip_address, auth_key, key_filename, key_sha256, authorized) VALUES (?, ?, ?, ?, ?, ?)");
7696
ps.setString(1, displayName.trim());
7797
ps.setString(2, clientIp);
7898
if (keyData != null && keyData.length > 0) {
7999
ps.setBytes(3, keyData);
80100
ps.setString(4, keyFilename);
81-
ps.setBoolean(5, true);
101+
ps.setString(5, keySha256);
102+
ps.setBoolean(6, true);
82103
} else {
83104
ps.setNull(3, java.sql.Types.BLOB);
84105
ps.setNull(4, java.sql.Types.VARCHAR);
85-
ps.setBoolean(5, false);
106+
ps.setNull(5, java.sql.Types.VARCHAR);
107+
ps.setBoolean(6, false);
86108
}
87109
ps.executeUpdate();
88110
ps.close();

‎modules/black/presidential/Brarner.M.Alete/tomcat.8080/work/Tomcat/localhost/brarner.m.alete/org/apache/jsp/register_jsp.class‎

1.05 KB
Binary file not shown.

‎modules/black/presidential/Brarner.M.Alete/tomcat.8080/work/Tomcat/localhost/brarner.m.alete/org/apache/jsp/register_jsp.java‎

Lines changed: 45 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/*
22
* Generated by the Jasper component of Apache Tomcat
33
* Version: Apache Tomcat/11.0.2
4-
* Generated at: 2026-06-29 01:17:57 UTC
4+
* Generated at: 2026-06-29 01:20:37 UTC
55
* Note: The last modified time of this file was set to
66
* the last modified time of the source file after
77
* generation to assist with modification tracking.
@@ -140,36 +140,45 @@ public void _jspService(final jakarta.servlet.http.HttpServletRequest request, f
140140
byte[] keyData = null;
141141
String keyFilename = "";
142142

143-
// Parse multipart manually (no external lib needed)
144-
ServletInputStream sis = request.getInputStream();
145-
String boundary = request.getContentType().split("boundary=")[1];
146-
String line;
147-
BufferedReader br = new BufferedReader(new InputStreamReader(sis, "UTF-8"));
148-
StringBuilder currentField = null;
149-
String currentFieldName = null;
150-
boolean inFile = false;
151-
ByteArrayOutputStream fileBytes = new ByteArrayOutputStream();
152-
153-
// Use Part API (Servlet 3.0+)
143+
// Use Part API (Servlet 6.0 / Jakarta)
154144
try {
155145
displayName = request.getParameter("display_name");
156146
jakarta.servlet.http.Part filePart = request.getPart("auth_key");
157147
if (filePart != null && filePart.getSize() > 0) {
158-
keyFilename = Paths.get(filePart.getSubmittedFileName()).getFileName().toString();
159-
InputStream fis = filePart.getInputStream();
160-
keyData = fis.readAllBytes();
161-
fis.close();
148+
// Validate file size (max 1MB for a key file)
149+
if (filePart.getSize() > 1048576) {
150+
message = "Key file too large (max 1MB).";
151+
} else {
152+
// Sanitize filename: strip path, allow only safe characters
153+
String rawName = filePart.getSubmittedFileName();
154+
keyFilename = Paths.get(rawName).getFileName().toString()
155+
.replaceAll("[^a-zA-Z0-9._\\-]", "_");
156+
// Validate extension
157+
String ext = keyFilename.contains(".") ? keyFilename.substring(keyFilename.lastIndexOf('.') + 1).toLowerCase() : "";
158+
if (!ext.matches("key|pem|pub|txt|crt|der")) {
159+
message = "Invalid file type. Allowed: .key, .pem, .pub, .txt, .crt, .der";
160+
keyFilename = "";
161+
} else {
162+
// Read bytes safely
163+
InputStream fis = filePart.getInputStream();
164+
keyData = fis.readAllBytes();
165+
fis.close();
166+
}
167+
}
162168
}
163169
} catch (Exception pe) {
164-
// fallback
165-
message = "Upload error: " + pe.getMessage();
170+
message = "Upload error: " + (pe.getMessage() != null ? pe.getMessage().replace("<","&lt;") : "unknown");
166171
}
167172

168173
if (displayName == null || displayName.trim().isEmpty()) {
169-
displayName = request.getParameter("display_name");
174+
displayName = "";
170175
}
176+
// Sanitize display name (max 100 chars, strip HTML)
177+
displayName = displayName.trim();
178+
if (displayName.length() > 100) displayName = displayName.substring(0, 100);
179+
displayName = displayName.replaceAll("<[^>]*>", "");
171180

172-
if (message == null && displayName != null && !displayName.trim().isEmpty()) {
181+
if (message == null && !displayName.isEmpty()) {
173182
// Save registration
174183
Properties dbProps = new Properties();
175184
InputStream dbIn = application.getResourceAsStream("/WEB-INF/db.properties");
@@ -196,21 +205,34 @@ public void _jspService(final jakarta.servlet.http.HttpServletRequest request, f
196205
"ip_address VARCHAR(45) NOT NULL, " +
197206
"auth_key MEDIUMBLOB, " +
198207
"key_filename VARCHAR(255), " +
208+
"key_sha256 CHAR(64), " +
199209
"authorized BOOLEAN DEFAULT FALSE, " +
200210
"registered_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP)");
201211

212+
// Compute SHA-256 of key if present
213+
String keySha256 = null;
214+
if (keyData != null) {
215+
java.security.MessageDigest md = java.security.MessageDigest.getInstance("SHA-256");
216+
byte[] hash = md.digest(keyData);
217+
StringBuilder sb = new StringBuilder();
218+
for (byte b : hash) sb.append(String.format("%02x", b));
219+
keySha256 = sb.toString();
220+
}
221+
202222
PreparedStatement ps = conn.prepareStatement(
203-
"INSERT INTO registrations (display_name, ip_address, auth_key, key_filename, authorized) VALUES (?, ?, ?, ?, ?)");
223+
"INSERT INTO registrations (display_name, ip_address, auth_key, key_filename, key_sha256, authorized) VALUES (?, ?, ?, ?, ?, ?)");
204224
ps.setString(1, displayName.trim());
205225
ps.setString(2, clientIp);
206226
if (keyData != null && keyData.length > 0) {
207227
ps.setBytes(3, keyData);
208228
ps.setString(4, keyFilename);
209-
ps.setBoolean(5, true);
229+
ps.setString(5, keySha256);
230+
ps.setBoolean(6, true);
210231
} else {
211232
ps.setNull(3, java.sql.Types.BLOB);
212233
ps.setNull(4, java.sql.Types.VARCHAR);
213-
ps.setBoolean(5, false);
234+
ps.setNull(5, java.sql.Types.VARCHAR);
235+
ps.setBoolean(6, false);
214236
}
215237
ps.executeUpdate();
216238
ps.close();

0 commit comments

Comments
 (0)