Elgato_dark/zeppelin
1
0
Fork 0
mirror of https://github.com/apache/zeppelin synced 2026-05-24 09:38:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[ZEPPELIN-2288] Fix Cross-Site WebSocket check

Browse source 
Change-Id: Iad87ebe0b5dd6bd67a12e47fe83fbd0e1e71bda9
This commit is contained in:
Elek, Márton 2017-03-20 15:23:51 +01:00
parent 641863d563
commit 74b37a441e
1 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
zeppelin-server/src/main/java/org/apache/zeppelin/socket/NotebookWebSocketCreator.java
View file

@ -19,18 +19,31 @@ package org.apache.zeppelin.socket;
import org.eclipse.jetty.websocket.servlet.ServletUpgradeRequest;
import org.eclipse.jetty.websocket.servlet.ServletUpgradeResponse;
import org.eclipse.jetty.websocket.servlet.WebSocketCreator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import static org.apache.zeppelin.conf.ZeppelinConfiguration.ConfVars.ZEPPELIN_ALLOWED_ORIGINS;
/**
* Responsible to create the WebSockets for the NotebookServer.
*/
public class NotebookWebSocketCreator implements WebSocketCreator {
private static final Logger LOG = LoggerFactory.getLogger(NotebookWebSocketCreator.class);
private NotebookServer notebookServer;
public NotebookWebSocketCreator(NotebookServer notebookServer) {
this.notebookServer = notebookServer;
}
public Object createWebSocket(ServletUpgradeRequest request, ServletUpgradeResponse response) {
return new NotebookSocket(request.getHttpServletRequest(), "", notebookServer);
String origin = request.getHeader("Origin");
if (notebookServer.checkOrigin(request.getHttpServletRequest(), origin)) {
return new NotebookSocket(request.getHttpServletRequest(), "", notebookServer);
} else {
LOG.error("Websocket request is not allowed by {} settings. Origin: {}",
ZEPPELIN_ALLOWED_ORIGINS, origin);
return null;
}
}
}