private void handleClient() {
try {
this.in = new BufferedReader(new InputStreamReader(client.getInputStream()));
this.out = new PrintWriter(new OutputStreamWriter(client.getOutputStream()));
if (authenticateClient()) {
handleRequest();
}
out.flush();
out.close();
in.close();
} catch (Exception ex) {
Log.warn(Thread.currentThread().getName() + ": failure handling client request.", ex);
} finally {
closeClientSocket();
}
}
public boolean handleCommand(String line, PrintWriter out) {
String[] split = line.split("[\t ]");
String commandName = split[0];
try {
Method[] methods = exportedInterface.getMethods();
for (Method method : methods) {
if (method.getName().equals(commandName) && method.getReturnType() == void.class) {
return invokeMethod(line, out, method, split);
}
}
throw new NoSuchMethodException();
} catch (NoSuchMethodException nsmex) {
out.println(fullName + ": didn't understand request \"" + line + "\".");
} catch (Exception ex) {
Log.warn(fullName + ": exception thrown while handling command \"" + line + "\".", ex);
out.println(fullName + ": request denied \"" + line + "\" (" + ex.toString() + ").");
} finally {
out.flush();
out.close();
}
return false;
}
public void writeLandingPage(HttpServletRequest request, HttpServletResponse response)
throws IOException {
String landingPage = getNewTokenLandingPage();
/** default to current page * */
if (landingPage == null) {
StringBuilder sb = new StringBuilder();
sb.append(request.getContextPath());
sb.append(request.getServletPath());
landingPage = sb.toString();
}
/** create auto posting form * */
StringBuilder sb = new StringBuilder();
sb.append("<html>\r\n");
sb.append("<head>\r\n");
sb.append("<title>OWASP CSRFGuard Project - New Token Landing Page</title>\r\n");
sb.append("</head>\r\n");
sb.append("<body>\r\n");
sb.append("<script type=\"text/javascript\">\r\n");
sb.append("var form = document.createElement(\"form\");\r\n");
sb.append("form.setAttribute(\"method\", \"post\");\r\n");
sb.append("form.setAttribute(\"action\", \"");
sb.append(landingPage);
sb.append("\");\r\n");
/** only include token if needed * */
if (isProtectedPage(landingPage)) {
sb.append("var hiddenField = document.createElement(\"input\");\r\n");
sb.append("hiddenField.setAttribute(\"type\", \"hidden\");\r\n");
sb.append("hiddenField.setAttribute(\"name\", \"");
sb.append(getTokenName());
sb.append("\");\r\n");
sb.append("hiddenField.setAttribute(\"value\", \"");
sb.append(getTokenValue(request, landingPage));
sb.append("\");\r\n");
sb.append("form.appendChild(hiddenField);\r\n");
}
sb.append("document.body.appendChild(form);\r\n");
sb.append("form.submit();\r\n");
sb.append("</script>\r\n");
sb.append("</body>\r\n");
sb.append("</html>\r\n");
String code = sb.toString();
/** setup headers * */
response.setContentType("text/html");
response.setContentLength(code.length());
/** write auto posting form * */
OutputStream output = null;
PrintWriter writer = null;
try {
output = response.getOutputStream();
writer = new PrintWriter(output);
writer.write(code);
writer.flush();
} finally {
Writers.close(writer);
Streams.close(output);
}
}
