How to Intercept parameters sent as JSON data in HTTPRequest to Controller? - json

We are in the process of building a custom built JEE security layer which is going to ensure that all possible OWASP concerns are addressed. This security layer is built as Filters that needs to run before the Controllers (Spring in our case), so that they can execute before the request actually reaches the Controller. These security filters looks at the user input and performs various Sanitation. One such sanitation is the JSON sanitation, where the JSON data from client is looked for any malicious content.
Currently , the Spring Controllers use the #RequestBody annotation to populare the incoming JSON data into POJO classes.
I have exactly the same question but, is there a generic way to retrieve the parameters (sent as JSON data) from the request ?
my objective is to have a JSON sanitizer code in a Filter, so that it
intercepts and parses all JSON data that comes to the controller.

I was able to read & retrieve the json data using the following technique. The StringBuffer jb finally has the entire JSON data.
StringBuffer jb = new StringBuffer();
String line = null;
BufferedReader reader = request.getReader();
while ((line = reader.readLine()) != null)
jb.append(line);
}
Ref: HttpServletRequest get JSON POST data

Related

Why is JsonContent not populating before SendAsync?

I'm using a .NET Core console application to send JSON data to an Azure Logic App. If the JSON data is a short list of data e.g. 4 items then everything works. For more data I have to evaluate the Content of the HttpRequestMessage before sending otherwise the Azure Logic App reports empty content. Is there any alternative to forcing evaluation, it feels counter intuitive.
httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
var postRequest = new HttpRequestMessage(HttpMethod.Post, uri)
{
Content = JsonContent.Create(data)//data is a list object
};
//need this line to evaluate the content before posting otherwise content is empty according to Azure Logic App
await postRequest.Content.ReadAsStringAsync();
using var postResponse = await httpClient.SendAsync(postRequest);
postResponse.EnsureSuccessStatusCode();
This code structure seems to feature in a lot of tutorials without the call to postRequest.Content.ReadAsStringAsync() without anyone experiencing similar problems.
An example of the JSON that fails would be:
[{"runDate":"2021-02-18T16:30:11.23","name":"AuditLog","rows":3859209,"reservedKb":22061528,"dataKb":8781560,"reservedIndexSize":66328,"reservedUnused":13213640,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"AnswerData","rows":70167,"reservedKb":12586736,"dataKb":12494912,"reservedIndexSize":1472,"reservedUnused":90352,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"Data_import","rows":3623146,"reservedKb":722632,"dataKb":379704,"reservedIndexSize":1424,"reservedUnused":341504,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"Answers","rows":2036892,"reservedKb":528872,"dataKb":270096,"reservedIndexSize":257360,"reservedUnused":1416,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"Data","rows":3623146,"reservedKb":381256,"dataKb":379704,"reservedIndexSize":1424,"reservedUnused":128,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"Data_backup","rows":3623146,"reservedKb":380048,"dataKb":379704,"reservedIndexSize":16,"reservedUnused":328,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"datadec","rows":3623146,"reservedKb":252168,"dataKb":232952,"reservedIndexSize":8,"reservedUnused":19208,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"SalesDetails","rows":84168,"reservedKb":170496,"dataKb":138104,"reservedIndexSize":20136,"reservedUnused":12256,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"OurUsers","rows":66145,"reservedKb":72240,"dataKb":37880,"reservedIndexSize":32776,"reservedUnused":1584,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.23","name":"Orders","rows":362720,"reservedKb":70016,"dataKb":53608,"reservedIndexSize":11976,"reservedUnused":4432,"dbName":"DBOne"},{"runDate":"2021-02-18T16:30:11.597","name":"CustDetails","rows":8949,"reservedKb":16392,"dataKb":15704,"reservedIndexSize":80,"reservedUnused":608,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"OurUsers","rows":5580,"reservedKb":6096,"dataKb":4456,"reservedIndexSize":1600,"reservedUnused":40,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"Answers","rows":56835,"reservedKb":5184,"dataKb":5104,"reservedIndexSize":32,"reservedUnused":48,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"UserRoles","rows":5577,"reservedKb":4632,"dataKb":1496,"reservedIndexSize":3056,"reservedUnused":80,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"CustDetails","rows":5866,"reservedKb":1928,"dataKb":1864,"reservedIndexSize":16,"reservedUnused":48,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"OrderHistories","rows":6102,"reservedKb":1224,"dataKb":1168,"reservedIndexSize":16,"reservedUnused":40,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"Orders","rows":6196,"reservedKb":1224,"dataKb":1176,"reservedIndexSize":16,"reservedUnused":32,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"Transfers","rows":7522,"reservedKb":840,"dataKb":816,"reservedIndexSize":16,"reservedUnused":8,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"SalesDetails","rows":8762,"reservedKb":648,"dataKb":576,"reservedIndexSize":16,"reservedUnused":56,"dbName":"DBTwo"},{"runDate":"2021-02-18T16:30:11.597","name":"TransferAdvice","rows":13706,"reservedKb":392,"dataKb":328,"reservedIndexSize":16,"reservedUnused":48,"dbName":"DBTwo"}]

how to get the JSON out of the jackson ObjectMapper

We need to bulid up a json payload to send to a rest endpoint. Our org uses Jackson. The only way to build up the json (without creating dozens of nested empty pojos) is as follows:
ObjectMapper mapper = new ObjectMapper();
ObjectNode rootNode = mapper.createObjectNode();
ObjectNode content = mapper.createObjectNode();
rootNode.set("someContent", content);
content.put("somekey","someval");
... lots more nested objects created here...
Ok, so now I have a complex json object in the mapper. How do I get it out?
E.g. How do I get a json string out of it suitable for sending to an REST api as post payload?
There are various examples of setting up pretty print, but these revolve around jsonizing a single java object (which I am not doing), or outputting to streams or files, not a simple String.
Any suggestions?
perhaps use ObjectMapper.writeValueAsString:
System.out.println(mapper.writeValueAsString(rootNode));

How to sanitize html/javascript from request.JSON in grails 3.1.10 restful service

We have a grails 3.1.10 restful service that takes in json data on the http post. This data can contain html/javascript which is not desired.
Using encodeAsHTML and the xss-sanitizer plugin XssSanitizerUtil.stripXSS methods I can see how to sanitize an individual string, but how can I push this to a higher scope through filters or something so that when request.JSON is used in the controller it has already been sanitized?
Or is there already another easier way to accomplish this?
I created an interceptor to apply to the appropriate controllers. In it I made a copy of the JSON parse(HttpServletRequest request) method. Near the end of the method where it parses the inputStream I plugged in my Sanitizer class that uses xss-sanitizer:
def body = IOUtils.toString(pushbackInputStream, encoding)
def sanitized = Sanitizer.sanitize(body)
json = JSON.parse(sanitized);

Create JAX-RS Client Post Request with JSON String as Body

I am writing a REST Client for one of the Vendor REST Service. I use jersey 2.x and JSON-P, below are dependencies I add.
<dependencies>
<dependency>
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-json-processing</artifactId>
<version>2.26</version>
</dependency>
<dependency>
<groupId>org.glassfish.jersey.core</groupId>
<artifactId>jersey-client</artifactId>
<version>2.26</version>
</dependency>
</dependencies>
I successfully write code for GET request and received JSON output. I saved it to a file and used JSON-P to interpret and do my own logic without any issues.
But now I need to write a POST request. When I use CURL as below I am able do it. and want to implement the same using Jeresey 2.x and JSON-P.
curl -v -H "Accept:application/json" -H "Content-Type:application/json" -u user:password -X POST --databinary #./InputParameters.json https://<IP>:<PORT>/Configuration/server
InputParameters.json contents
{
"ip": "10.197.70.16",
"partNumber": 202067,
"model": "IBM P7"
}
When I tried to pass response body as String in JSON format ({"ip": "10.197.70.16", "partNumber": 202067, "model": "IBM P7"}), but didn't work. So tried as JsonObject as below still didn't work.
JsonObject jsonObj = Json.createObjectBuilder()
.add("ip", "10.197.70.16")
.add("partNumber", 202067)
.add("model", "IBM P7")
.build();
response = invocationBuilder.post(Entity.json(jsonObj));
I know core java, based on that experience I jumped into writing this program and got success with GET but not POST. I doubt I am doing something fundamentally wrong with POST.
Let's unpack what you're doing for a bit. First there's this part:
JsonObject jsonObj = Json.createObjectBuilder()
.add("ip", "10.197.70.16")
.add("partNumber", 202067)
.add("model", "IBM P7")
.build();
This creates a javax.json.JsonObject instance. JsonObject, which is part of the JSON-P Java API, is pretty much what it says: a class to represent a JSON object. A JsonObject instance contains a hierarchy of javax.json.JsonValue instances, which conform to more specific types like JsonArray, JsonString, other JsonObjects and so on. In this regard it's not unlike the classes of the DOM API for representing XML documents (let's hope Oracle keeps the API docs at that URL for a while). But JSON is fortunately a lot more straightforward than XML and DOM.
Your jsonObj instance would contain a JsonString instance with value "10.197.70.16" mapped to name "ip", a JsonNumber with value 202067 (probably represented as BigDecimal) mapped to name "partNumber" and so on.
Next your code executes this:
Entity.json(jsonObj)
javax.ws.rs.client.Entity.json(something) basically states that you want to create an entity that will provide the payload for a JAX-RS client invocation with as Content-Type application/json. In other words, the something you create it for must be transformed to a JSON representation when it's sent to the API, which should expect a JSON payload and know how to handle it. Note that Entity.json(...) has a generic type parameter. The method signature is static <T> Entity<t> json(T entity). So you're creating an instance of Entity<JsonObject> with the payload entity jsonObj.
When this is handed over to the post method of a javax.ws.rs.client.Invocation.Builder instance (the post method is actually defined in its parent interface SyncInvoker) the client implementation goes to work.
response = invocationBuilder.post(Entity.json(jsonObj));
It takes the provided Entity instance and its content (our jsonObj), checks what the desired output is of the Entity (this is application/json) and seeks a provider that can turn objects of the given type into that output. In other words, some component must be located that can be given a javax.json.JsonObject and write a representation of it as JSON to an OutputStream. The component handling this could be a javax.ws.rs.ext.MessageBodyWriter that claims it can perform this transformation and was registered to the JAX-RS runtime. Various libraries supply such providers and you can also write your own. This makes JAX-RS extensible to deal with various scenarios, handle non-standard input and output or lets you tune its behaviour. When multiple providers are capable of handling the given entity type and producing the desired output, there are rules to determine which one takes on the job. Note that this can depend on what is on your classpath. There are ways of forcing this explicitly.
The client puts together the invocation through its configuration, using the proper URL, query parameters, HTTP method, headers and so on. The payload is created by writing the entity to an OutputStream in the required format. In your example this results in a POST to the server. When the invocation has been completed you receive a javax.ws.rs.core.Response that you can use to determine the HTTP result code and retrieve a response payload, if any. The readEntity(Class<T> entityType) method of Response works like the reverse of turning an Entity into a payload. It searches for a MessageBodyReader that can interpret the response stream according to the value returned from response.getMediaType() and can create an instance of Class entityType from it.
So with all of that explained, what exactly is going wrong in your approach? Well, the issue is that the default implementations available to your JAX-RS runtime probably don't have a writer specifically for an input of type JsonObject and with expected output application/json. It may seem very logical if the server expects JSON, that you should be able to supply a JsonObject as payload. But if the JAX-RS implementation can't find something to handle that class, then at best it can just use some default approach. In that case it may try to interpret the object as a POJO and serialize it to JSON in a default manner, which could lead to weirdness like this:
{
"valueMap": {
"ip": {
"value": "10.197.70.16"
},
"partNumber": {
"num": 202067,
"integral": TRUE
},
...
}
}
That's what a literal interpretation of the JsonObject instance could look like, depending on which implementation it uses and what is used by JAX-RS to turn it into JSON output. Of course it's possible that the object can't be serialized to JSON at all, either because no suitable MessageBodyWriter can be found or it runs into an error when creating the output.
A first solution would be a very simple one. Just turn the JsonObject into a String and simply provide that as the entity:
StringWriter stringWriter = new StringWriter();
try (JsonWriter jsonWriter = Json.createWriter(stringWriter);) {
jsonWriter.writeObject(jsonObject);
} // some error handling would be needed here
String jsonPayload = stringWriter.toString();
response = invocationBuilder.post(Entity.json(jsonPayload));
It seems you had already tried that. A possible problem with this is that the MessageBodyWriter that gets used needs to just output the String's bytes in a suitable encoding (probably UTF-8) when presented with a String as output and application/json as the required content type. Some may not do that. You could try Entity.entity(jsonPayload, MediaType.TEXT_PLAIN_TYPE.withCharset("UTF-8")) but then the server might reject the call.
Other possible solutions are
Writing your own MessageBodyWriter for String objects with an #javax.ws.rs.Produces(MediaType.APPLICATION_JSON) annotation on it.
Better yet, writing such a class that accepts JsonObject instances.
Creating POJO classes for your JSON structure and letting those get used for generating JSON from instances or deserializing JSON responses to instances.
Finding an extension library that contains suitable providers for dealing with javax.json classes.
The addition of the com.owlike:genson dependency to your project is exactly the application of that last suggestion. The Genson library provides conversions between Java objects and JSON in both directions, as well as data binding. Part of its code base is dedicated to JAX-RS providers, among which a class suitable for accepting JsonObject as input.
Issue is resolved after adding below dependency. At this point I am not sure on what does it do.
Thanks to Swamy (TCS) for his support to resolve this.
<dependency>
<groupId>com.owlike</groupId>
<artifactId>genson</artifactId>
<version>1.4</version>
</dependency>
Example using genson
String serialize = new Genson().serialize(
Json.createObjectBuilder()
.add("ip", "10.197.70.16")
.add("partNumber", 202067)
.add("model", "IBM P7")
.build()
);
response = invocationBuilder.post(Entity.json(serialize));

Java servlets and JSON parsing

I currently have a servlet returning a JSON string on a POST to the output stream of the response.
This is my code:
...
response.setContentType("application/json");
PrintWriter out = response.getWriter();
out.print(jsonString);
out.flush();
I'm not sure how to handle this on the client side as it just displays the string on the page. What needs to be done?
A servlet returning a JSON is not meant to be called directly by the browser. It's meant to be called with JavaScript or another artifact that can interpret JSON.
Usually you will have something like:
var myObject = JSON.parse(myJSONtext, reviver);
That will get you an object parsed from JSON contents you send from servlet.
To get myJSONtext you usually do an AJAX call within a piece of Java Script code.
Google for: json ajax example
You will get a lot of information online.