From aa2743a38c8105ef98d6b44417129b2790f9ed98 Mon Sep 17 00:00:00 2001 From: Pierre Lupien Date: Tue, 7 Nov 2023 17:19:55 -0500 Subject: [PATCH 1/3] Working to remove 'leaving secure site' redirect page from Spring Boot project --- .../goc/webtemplate/component/BaseUtil.java | 6 +++- .../component/jsonentities/SetupBase.java | 3 +- .../component/spring/BaseCoreBean.java | 2 +- .../spring/controller/CoreController.java | 7 ---- .../LeavingSecureSiteSampleBean.java | 1 - .../samples/LeavingSecureSiteSample.html | 35 ++++--------------- 6 files changed, 14 insertions(+), 40 deletions(-) diff --git a/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java b/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java index e68e8da4..1aead7ea 100644 --- a/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java +++ b/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java @@ -8,7 +8,7 @@ import goc.webtemplate.Constants; public final class BaseUtil { - public static void doLeaveSecureSite(HttpServletRequest req, HttpServletResponse res) throws Exception { + public static void doLeaveSecureSite(HttpServletRequest req, HttpServletResponse res) throws Exception { //TODO: Remove this once no longer referenced String redirectUrl = URLDecoder.decode(req.getParameter("targetUrl"), "UTF-8"); res.sendRedirect(redirectUrl); } @@ -24,6 +24,10 @@ public static void doLocaleSwitch(HttpServletRequest req, HttpServletResponse re } String prevUrl = URLDecoder.decode(req.getParameter(Constants.QUERYSTRING_KEY), "UTF-8"); + + // Validate that the redirect link is relative to the host and NOT absolute or relative to scheme + if ((!prevUrl.startsWith("/")) || prevUrl.startsWith("//")) throw new Exception("Unauthorized return URL specified for language switching."); + res.sendRedirect(prevUrl); } diff --git a/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/jsonentities/SetupBase.java b/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/jsonentities/SetupBase.java index 35e83559..d5e28c9c 100644 --- a/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/jsonentities/SetupBase.java +++ b/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/jsonentities/SetupBase.java @@ -5,7 +5,6 @@ import java.util.List; import goc.webtemplate.LeavingSecureSiteWarning; -import goc.webtemplate.Utility; import goc.webtemplate.WebAnalyticsInfo; /** @@ -39,7 +38,7 @@ public SetupBase(String subTheme, String jqueryEnv, LeavingSecureSiteWarning lss this.subTheme = subTheme; this.jqueryEnv = jqueryEnv; this.exitSecureSite = null; - if ((lssw != null) && lssw.isEnabled() && !Utility.isNullOrEmpty(lssw.getRedirectUrl())) { + if ((lssw != null) && lssw.isEnabled()) { this.exitSecureSite = new ExitSecureSite(lssw); } this.webAnalytics = webAnalytics; diff --git a/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/BaseCoreBean.java b/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/BaseCoreBean.java index 6d7ce548..24afb1a0 100644 --- a/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/BaseCoreBean.java +++ b/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/BaseCoreBean.java @@ -35,7 +35,7 @@ protected String getDefaultLanguageLinkUrl() { @Override protected String getDefaultLeaveSecureSiteRedirectUrl() { - return "gocwebtemplate_leavesecuresiteredirect"; + return null; } @Override diff --git a/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/controller/CoreController.java b/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/controller/CoreController.java index d341fec2..b0739652 100644 --- a/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/controller/CoreController.java +++ b/gocwebtemplate-core/gocwebtemplate-core-spring/src/main/java/goc/webtemplate/component/spring/controller/CoreController.java @@ -10,15 +10,8 @@ @Controller public class CoreController { - @GetMapping("/gocwebtemplate_switchlocale") public void SwitchLocale(HttpServletRequest request, HttpServletResponse response) throws Exception { BaseUtil.doLocaleSwitch(request, response); } - - @GetMapping("/gocwebtemplate_leavesecuresiteredirect") - public void LeaveSecureSiteRedirect(HttpServletRequest request, HttpServletResponse response) throws Exception { - //Custom processing would go here - BaseUtil.doLeaveSecureSite(request, response); - } } diff --git a/gocwebtemplate-sample-spring/src/main/java/goc/webtemplate/spring/samplebeans/LeavingSecureSiteSampleBean.java b/gocwebtemplate-sample-spring/src/main/java/goc/webtemplate/spring/samplebeans/LeavingSecureSiteSampleBean.java index c45f95bd..f45dd9aa 100644 --- a/gocwebtemplate-sample-spring/src/main/java/goc/webtemplate/spring/samplebeans/LeavingSecureSiteSampleBean.java +++ b/gocwebtemplate-sample-spring/src/main/java/goc/webtemplate/spring/samplebeans/LeavingSecureSiteSampleBean.java @@ -14,7 +14,6 @@ public void onWebTemplateInitialize() { lssw.setEnabled(true); lssw.setMessage("You are about to leave a secure site, do you wish to continue?"); - lssw.setRedirectUrl("gocwebtemplate_leavesecuresiteredirect"); lssw.setExcludedDomains("www.esdc.gc.ca,www.jobbank.gc.ca,www.readseal.ca"); lssw.setCancelMessage("Don't leave"); lssw.setYesMessage("Yes, leave this site"); diff --git a/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html b/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html index ad541b66..2d731080 100644 --- a/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html +++ b/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html @@ -20,8 +20,8 @@

Leaving Secure Site Warning

How it works

-
  • if the "Yes" button is clicked: - +
  • if the "Yes" button is clicked, the browser will be directed to the external link
    • +
  • optionally, a redirect url can be set in "leavingSecureSiteRedirectUrl" via either the cdn.properties file or programmatically. + If this is used, the browser will be directed to this page before leaving, where the application can terminate the user's session and let them proceed to the external link. + The external link will be presented to the user by placing an element <span class="wb-exitscript wb-exitscript-exiturlparam"></span> on the page. + An example of "middle page" is available in the WET Documentation.

    • Here is a local link that will not display the warning: Link to Local Page

    @@ -51,7 +46,6 @@

    Enable the leaving secure site feature

    @@ -63,7 +57,6 @@

    Enable the leaving secure site feature

    lssw.setEnabled(true); lssw.setMessage("You are about to leave a secure site, do you wish to continue?"); - lssw.setRedirectUrl("gocwebtemplate_leavesecuresiteredirect"); lssw.setExcludedDomains("www.esdc.gc.ca,www.jobbank.gc.ca,www.readseal.ca"); lssw.setCancelMessage("Don't leave"); lssw.setYesMessage("Yes, leave this site"); @@ -74,20 +67,6 @@

    Enable the leaving secure site feature

    }
    -

    Map your "redirect" url in the controller

    - -
    -

    Code Sample for your Redirect Controller method

    - 
    -@GetMapping("/gocwebtemplate_leavesecuresiteredirect")
-public void LeaveSecureSiteRedirect(HttpServletRequest request, HttpServletResponse response) throws Exception {
-	//Custom processing would go here
-	BaseUtil.doLeaveSecureSite(request, response);
-}
-
    -
    From bbd4ea42c2e525598795487099bb6d6f7ee58e07 Mon Sep 17 00:00:00 2001 From: Pierre Lupien Date: Wed, 8 Nov 2023 11:23:24 -0500 Subject: [PATCH 2/3] Remove 'leaving secure site' redirect page from Struts project --- .../goc/webtemplate/component/BaseUtil.java | 5 --- .../component/jsp/BaseCoreBean.java | 2 +- .../component/jsp/LeaveSecureSiteAction.java | 11 ----- .../LeaveSecureSiteSampleBean.java | 1 - .../src/main/resources/struts.xml | 1 - .../src/main/webapp/ChangeLog.txt | 2 +- .../leavesecuresitesamplecontent.jsp | 45 +++---------------- .../samples/LeavingSecureSiteSample.html | 4 +- 8 files changed, 11 insertions(+), 60 deletions(-) delete mode 100644 gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/LeaveSecureSiteAction.java diff --git a/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java b/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java index 1aead7ea..5d881732 100644 --- a/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java +++ b/gocwebtemplate-core/gocwebtemplate-core-base/src/main/java/goc/webtemplate/component/BaseUtil.java @@ -8,11 +8,6 @@ import goc.webtemplate.Constants; public final class BaseUtil { - public static void doLeaveSecureSite(HttpServletRequest req, HttpServletResponse res) throws Exception { //TODO: Remove this once no longer referenced - String redirectUrl = URLDecoder.decode(req.getParameter("targetUrl"), "UTF-8"); - res.sendRedirect(redirectUrl); - } - public static void doLocaleSwitch(HttpServletRequest req, HttpServletResponse res) throws Exception { String currLang = req.getSession().getAttribute(Constants.CURRENT_LANG_SESSION_KEY) == null ? req.getLocale().getLanguage() : diff --git a/gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/BaseCoreBean.java b/gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/BaseCoreBean.java index 10778c29..80cc20a9 100644 --- a/gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/BaseCoreBean.java +++ b/gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/BaseCoreBean.java @@ -35,7 +35,7 @@ protected String getDefaultLanguageLinkUrl() { @Override protected String getDefaultLeaveSecureSiteRedirectUrl() { - return "leavesecuresiteredirect.action"; + return null; } @Override diff --git a/gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/LeaveSecureSiteAction.java b/gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/LeaveSecureSiteAction.java deleted file mode 100644 index 59c9cf4b..00000000 --- a/gocwebtemplate-core/gocwebtemplate-core-jsp/src/main/java/goc/webtemplate/component/jsp/LeaveSecureSiteAction.java +++ /dev/null @@ -1,11 +0,0 @@ -package goc.webtemplate.component.jsp; - -import org.apache.struts2.ServletActionContext; - -import goc.webtemplate.component.BaseUtil; - -public class LeaveSecureSiteAction { - public void execute() throws Exception { - BaseUtil.doLeaveSecureSite(ServletActionContext.getRequest(), ServletActionContext.getResponse()); - } -} diff --git a/gocwebtemplate-sample-jsp/src/main/java/goc/webtemplate/jsp/samplebeans/LeaveSecureSiteSampleBean.java b/gocwebtemplate-sample-jsp/src/main/java/goc/webtemplate/jsp/samplebeans/LeaveSecureSiteSampleBean.java index 6bb7f2bd..d2b78e87 100644 --- a/gocwebtemplate-sample-jsp/src/main/java/goc/webtemplate/jsp/samplebeans/LeaveSecureSiteSampleBean.java +++ b/gocwebtemplate-sample-jsp/src/main/java/goc/webtemplate/jsp/samplebeans/LeaveSecureSiteSampleBean.java @@ -12,7 +12,6 @@ public void onWebTemplateInitialize() { lssw.setEnabled(true); lssw.setMessage("You are about to leave a secure site, do you wish to continue?"); - lssw.setRedirectUrl("leavesecuresiteredirect.action"); lssw.setExcludedDomains("www.esdc.gc.ca,www.jobbank.gc.ca,www.readseal.ca"); lssw.setCancelMessage("Don't leave"); lssw.setYesMessage("Yes, leave this site"); diff --git a/gocwebtemplate-sample-jsp/src/main/resources/struts.xml b/gocwebtemplate-sample-jsp/src/main/resources/struts.xml index f63cf725..68d40f76 100644 --- a/gocwebtemplate-sample-jsp/src/main/resources/struts.xml +++ b/gocwebtemplate-sample-jsp/src/main/resources/struts.xml @@ -13,7 +13,6 @@ - diff --git a/gocwebtemplate-sample-jsp/src/main/webapp/ChangeLog.txt b/gocwebtemplate-sample-jsp/src/main/webapp/ChangeLog.txt index 98b71d35..cc55ab10 100644 --- a/gocwebtemplate-sample-jsp/src/main/webapp/ChangeLog.txt +++ b/gocwebtemplate-sample-jsp/src/main/webapp/ChangeLog.txt @@ -1,3 +1,3 @@ For the up to date release/change log, please refer to: - https://gccode.ssc-spc.gc.ca/iitb-dgiit/sds/GOCWebTemplates/JavaTemplates/releases + https://github.com/wet-boew/cdts-JavaTemplates/releases diff --git a/gocwebtemplate-sample-jsp/src/main/webapp/samplecontents/leavesecuresitesamplecontent.jsp b/gocwebtemplate-sample-jsp/src/main/webapp/samplecontents/leavesecuresitesamplecontent.jsp index e58a939a..b1d29e45 100644 --- a/gocwebtemplate-sample-jsp/src/main/webapp/samplecontents/leavesecuresitesamplecontent.jsp +++ b/gocwebtemplate-sample-jsp/src/main/webapp/samplecontents/leavesecuresitesamplecontent.jsp @@ -17,8 +17,8 @@

    How it works

    -
  • if the "Yes" button is clicked: -
      -
    • the user will first be redirect to the url set in "leavingSecureSiteRedirectUrl" via either the cdn.properties file or programmatically
      • -
    • the info of the linked that was clicked is part of the querystring to that url
      • -
    • in the redirect url provided earlier, attach the preRenderView event to the page and execute a custom bean method to perform the redirect
      • -
    • execute any clean up code your application requires
      • -
    • once executed the custom bean class will redirect the user to the url of the clicked link
      • -
    • the leave secure site feature is already provided by default as part of the GoC Web Template package, by default it will use the templates/leavesecuresiteredirect.xhtml page
      • -
    • by default the leave secure site redirect page will invoke the leavesecuresiteredirect.action Struts Action already pre-registered in struts.xml
      • -
    +
  • if the "Yes" button is clicked, the browser will be directed to the external link
    • +
  • optionally, a redirect url can be set in "leavingSecureSiteRedirectUrl" via either the cdn.properties file or programmatically. + If this is used, the browser will be directed to this page before leaving, where the application can terminate the user's session and let them proceed to the external link. + The external link will be presented to the user by placing an element <span class="wb-exitscript wb-exitscript-exiturlparam"></span> on the page. + For an example of a "middle page", refer to scenario 3 link in the WET Documentation.

    • Here is a local link that will not display the warning: Link to Local Page

    -

    Here is an external link that will display the warning:Link to External Page

    +

    Here is an external link that will display the warning:Link to External Page

    Steps to implement:

    Enable the leaving secure site feature

    @@ -62,7 +54,6 @@ public void onWebTemplateInitialize() {
 
     lssw.setEnabled(true);
     lssw.setMessage("You are about to leave a secure site, do you wish to continue?");
-    lssw.setRedirectUrl("leavesecuresiteredirect.action");
     lssw.setExcludedDomains("www.esdc.gc.ca,www.jobbank.gc.ca,www.readseal.ca");
     lssw.setCancelMessage("Don't leave");
     lssw.setYesMessage("Yes, leave this site");
@@ -73,26 +64,4 @@ public void onWebTemplateInitialize() {
 }
    -

    Created your custom "redirect" class

    - -
    -

    Code Sample for your Redirect action class

    - 
    -import java.net.URLDecoder;
-import javax.servlet.http.HttpServletRequest;
-import org.apache.struts2.ServletActionContext;
-
-public class LeaveSecureSiteAction {
-	public void execute() throws Exception {
-		HttpServletRequest currentReq = ServletActionContext.getRequest();
-		String redirectUrl = URLDecoder.decode(currentReq.getParameter("targetUrl"), "UTF-8");
-		ServletActionContext.getResponse().sendRedirect(redirectUrl);
-	}
-}
-
    -
    <%@ include file="_sampleslist.jsp" %> diff --git a/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html b/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html index 2d731080..c11cf268 100644 --- a/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html +++ b/gocwebtemplate-sample-spring/src/main/resources/samples/LeavingSecureSiteSample.html @@ -36,11 +36,11 @@

    How it works

  • optionally, a redirect url can be set in "leavingSecureSiteRedirectUrl" via either the cdn.properties file or programmatically. If this is used, the browser will be directed to this page before leaving, where the application can terminate the user's session and let them proceed to the external link. The external link will be presented to the user by placing an element <span class="wb-exitscript wb-exitscript-exiturlparam"></span> on the page. - An example of "middle page" is available in the WET Documentation. + For an example of a "middle page", refer to scenario 3 link in the WET Documentation.

    • Here is a local link that will not display the warning: Link to Local Page

    -

    Here is an external link that will display the warning: Link to External Page

    +

    Here is an external link that will display the warning: Link to External Page

    Steps to implement:

    Enable the leaving secure site feature