rushlink/handlers/handlers.go

357 lines
8.8 KiB
Go
Raw Normal View History

package handlers
2019-08-25 21:33:56 +02:00
import (
"crypto/rand"
2019-09-01 01:41:01 +02:00
"crypto/subtle"
"encoding/base64"
2019-08-25 21:33:56 +02:00
"fmt"
"log"
"net/http"
"net/url"
2019-09-01 01:41:01 +02:00
"strings"
2019-08-25 21:33:56 +02:00
"time"
2019-09-01 01:41:01 +02:00
"unicode"
2019-08-25 21:33:56 +02:00
2019-08-29 23:40:24 +02:00
"github.com/gorilla/mux"
"github.com/pkg/errors"
2019-08-25 21:33:56 +02:00
bolt "go.etcd.io/bbolt"
2019-09-15 17:43:09 +02:00
"gitea.hashru.nl/dsprenkels/rushlink/db"
"gitea.hashru.nl/dsprenkels/rushlink/gobmarsh"
2019-08-25 21:33:56 +02:00
)
type PasteType int
type PasteState int
2019-08-25 21:33:56 +02:00
type StoredPaste struct {
Type PasteType
State PasteState
Content []byte
2019-09-15 22:54:07 +02:00
Key string
2019-09-01 01:41:01 +02:00
OwnerToken [16]byte
2019-08-25 21:33:56 +02:00
TimeCreated time.Time
}
const (
TypePaste PasteType = iota
TypeRedirect
)
const (
StatePresent PasteState = iota
StateDeleted
2019-08-25 21:33:56 +02:00
)
2019-09-01 01:41:01 +02:00
const CookieOwnerToken = "owner_token"
2019-09-01 12:04:43 +02:00
// These keys are designated reserved, and will not be randomly chosen
2019-09-15 22:54:07 +02:00
var ReservedPasteKeys = []string{"xd42", "example"}
2019-09-01 12:04:43 +02:00
2019-09-01 01:41:01 +02:00
// Base64 encoding and decoding
var base64Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
var base64Encoder = base64.RawURLEncoding.WithPadding(base64.NoPadding)
2019-09-01 01:41:01 +02:00
2019-09-15 22:54:07 +02:00
func (t PasteType) String() string {
2019-09-01 01:41:01 +02:00
switch t {
case TypePaste:
2019-09-15 22:54:07 +02:00
return "paste"
2019-09-01 01:41:01 +02:00
case TypeRedirect:
2019-09-15 22:54:07 +02:00
return "redirect"
2019-09-01 01:41:01 +02:00
default:
2019-09-15 22:54:07 +02:00
return "invalid"
2019-09-01 01:41:01 +02:00
}
}
2019-09-15 22:54:07 +02:00
func (t PasteState) String() string {
2019-09-01 01:41:01 +02:00
switch t {
case StatePresent:
2019-09-15 22:54:07 +02:00
return "present"
2019-09-01 01:41:01 +02:00
case StateDeleted:
2019-09-15 22:54:07 +02:00
return "deleted"
2019-09-01 01:41:01 +02:00
default:
2019-09-15 22:54:07 +02:00
return "invalid"
2019-09-01 01:41:01 +02:00
}
}
func IndexGetHandler(w http.ResponseWriter, r *http.Request) {
2019-09-15 19:51:54 +02:00
Render(w, r, "index", nil)
2019-08-25 21:33:56 +02:00
}
func IndexPostHandler(w http.ResponseWriter, r *http.Request) {
2019-08-25 21:33:56 +02:00
if err := r.ParseMultipartForm(50 * 1000 * 1000); err != nil {
2019-09-15 21:34:41 +02:00
log.Printf("error: %v\n", err)
RenderInternalServerError(w, r, err)
2019-08-25 21:33:56 +02:00
return
}
// Determine what kind of post this is, currently only `shorten=...`
if len(r.PostForm) == 0 {
2019-09-15 21:34:41 +02:00
RenderError(w, r, http.StatusBadRequest, "empty body in POST request\n")
2019-08-25 21:33:56 +02:00
return
}
shorten_values, prs := r.PostForm["shorten"]
if !prs {
2019-09-15 21:34:41 +02:00
RenderError(w, r, http.StatusBadRequest, "no 'shorten' param given\n")
2019-08-25 21:33:56 +02:00
return
}
if len(shorten_values) != 1 {
2019-09-15 21:34:41 +02:00
RenderError(w, r, http.StatusBadRequest, "only one 'shorten' param is allowed per request\n")
2019-08-25 21:33:56 +02:00
return
}
ShortenPostHandler(w, r)
2019-08-25 21:33:56 +02:00
}
func PasteGetHandler(w http.ResponseWriter, r *http.Request) {
2019-09-01 01:41:01 +02:00
pasteGetHandlerInner(w, r, false, false)
}
func PasteGetHandlerNoRedirect(w http.ResponseWriter, r *http.Request) {
2019-09-01 01:41:01 +02:00
pasteGetHandlerInner(w, r, true, false)
}
func PasteGetHandlerMeta(w http.ResponseWriter, r *http.Request) {
2019-09-01 01:41:01 +02:00
pasteGetHandlerInner(w, r, false, true)
}
func pasteGetHandlerInner(w http.ResponseWriter, r *http.Request, noRedirect, showMeta bool) {
2019-08-29 00:50:26 +02:00
vars := mux.Vars(r)
key := vars["key"]
var storedPaste *StoredPaste
if err := db.DB.View(func(tx *bolt.Tx) error {
2019-08-29 00:50:26 +02:00
var err error
storedPaste, err = getURL(tx, []byte(key))
2019-08-29 00:50:26 +02:00
return err
}); err != nil {
log.Printf("error: %v\n", err)
2019-09-15 21:34:41 +02:00
RenderInternalServerError(w, r, err)
2019-08-29 00:50:26 +02:00
return
}
if storedPaste == nil {
2019-09-15 21:34:41 +02:00
RenderError(w, r, http.StatusNotFound, "url key not found in the database")
2019-09-01 01:41:01 +02:00
return
}
if showMeta {
2019-09-15 22:54:07 +02:00
isOwner := false
2019-09-01 01:41:01 +02:00
ownerToken, ok := getOwnerTokenFromRequest(r)
if ok && subtle.ConstantTimeCompare(ownerToken[:], storedPaste.OwnerToken[:]) == 1 {
2019-09-15 22:54:07 +02:00
isOwner = true
2019-09-01 01:41:01 +02:00
}
2019-09-15 22:54:07 +02:00
data := map[string]interface{}{
"Paste": storedPaste,
"IsOwner": isOwner,
}
Render(w, r, "pasteMeta", data)
return
2019-08-29 00:50:26 +02:00
}
2019-09-01 01:41:01 +02:00
switch storedPaste.State {
case StatePresent:
if !noRedirect {
rawurl := string(storedPaste.Content)
urlParse, err := url.Parse(rawurl)
if err != nil {
log.Printf("error: invalid URL ('%v') in database for key '%v': %v\n", rawurl, storedPaste.Key, err)
2019-09-15 21:34:41 +02:00
RenderInternalServerError(w, r, "invalid url in database")
return
}
http.Redirect(w, r, urlParse.String(), http.StatusSeeOther)
}
w.Write(storedPaste.Content)
case StateDeleted:
2019-09-15 21:34:41 +02:00
RenderError(w, r, http.StatusGone, "key has been deleted")
2019-08-29 00:50:26 +02:00
default:
log.Printf("error: invalid storedPaste.State (%v) for key '%v'\n", storedPaste.State, storedPaste.Key)
2019-09-15 21:34:41 +02:00
msg := fmt.Sprintf("internal server error: invalid storedPaste.State (%v\n)", storedPaste.State)
RenderInternalServerError(w, r, msg)
2019-08-29 00:50:26 +02:00
}
}
func ShortenPostHandler(w http.ResponseWriter, r *http.Request) {
2019-08-25 21:33:56 +02:00
rawurl := r.PostForm.Get("shorten")
userURL, err := url.ParseRequestURI(rawurl)
if err != nil {
2019-09-15 21:34:41 +02:00
msg := fmt.Sprintf("invalid url (%v): %v", err, rawurl)
RenderError(w, r, http.StatusBadRequest, msg)
2019-08-25 21:33:56 +02:00
return
}
if userURL.Scheme == "" {
2019-09-15 21:34:41 +02:00
RenderError(w, r, http.StatusBadRequest, "invalid url (unspecified scheme)")
2019-08-25 21:33:56 +02:00
return
}
if userURL.Host == "" {
2019-09-15 21:34:41 +02:00
RenderError(w, r, http.StatusBadRequest, "invalid url (unspecified host)")
2019-08-25 21:33:56 +02:00
return
}
var storedPaste *StoredPaste
if err := db.DB.Update(func(tx *bolt.Tx) error {
2019-09-01 01:41:01 +02:00
ownerKey, ok := getOwnerTokenFromRequest(r)
if ok == false {
// Owner key not supplied or invalid, generate a new one
ownerKey, err = generateOwnerToken()
if err != nil {
return errors.Wrap(err, "generating OwnerToken")
}
}
sp, err := shortenURL(tx, userURL, ownerKey)
storedPaste = sp
2019-08-25 21:33:56 +02:00
return err
}); err != nil {
2019-08-29 00:50:26 +02:00
log.Printf("error: %v\n", err)
2019-09-15 21:34:41 +02:00
RenderInternalServerError(w, r, err)
2019-08-25 21:33:56 +02:00
return
}
2019-09-01 01:41:01 +02:00
saveURL, err := r.URL.Parse(string(storedPaste.Key))
if err != nil {
2019-09-06 00:07:50 +02:00
err = errors.Wrap(err, "parsing url")
log.Printf("error: %v\n", err)
2019-09-15 21:34:41 +02:00
RenderInternalServerError(w, r, err)
2019-09-06 00:07:50 +02:00
return
2019-09-01 01:41:01 +02:00
}
var base64OwnerToken = make([]byte, 24)
base64Encoder.Encode(base64OwnerToken, storedPaste.OwnerToken[:])
2019-09-15 21:34:41 +02:00
// TODO(dsprenkels) Put this into a template
w.WriteHeader(http.StatusOK)
fmt.Fprintf(w, "URL saved at %v\n", saveURL)
2019-09-01 01:41:01 +02:00
isNotPrint := func(r rune) bool { return !unicode.IsPrint(r) }
fmt.Fprintf(w, "Owner key is %s\n", strings.TrimRightFunc(string(base64OwnerToken), isNotPrint))
2019-08-29 00:50:26 +02:00
}
// Retrieve a URL from the database
func getURL(tx *bolt.Tx, key []byte) (*StoredPaste, error) {
shortenBucket := tx.Bucket([]byte(db.BUCKET_PASTES))
2019-08-29 00:50:26 +02:00
if shortenBucket == nil {
return nil, fmt.Errorf("bucket %v does not exist", db.BUCKET_PASTES)
2019-08-29 00:50:26 +02:00
}
storedBytes := shortenBucket.Get(key)
if storedBytes == nil {
return nil, nil
}
storedPaste := &StoredPaste{}
err := gobmarsh.Unmarshal(storedBytes, storedPaste)
return storedPaste, err
2019-08-25 21:33:56 +02:00
}
// Add a new URL to the database
//
// Returns the new ID if the url was successfully shortened
2019-09-01 01:41:01 +02:00
func shortenURL(tx *bolt.Tx, userURL *url.URL, ownerKey [16]byte) (*StoredPaste, error) {
shortenBucket := tx.Bucket([]byte(db.BUCKET_PASTES))
2019-08-25 21:33:56 +02:00
if shortenBucket == nil {
return nil, fmt.Errorf("bucket %v does not exist", db.BUCKET_PASTES)
2019-08-25 21:33:56 +02:00
}
// Generate a key until it is not in the database, this occurs in O(log N),
// where N is the amount of keys stored in the url-shorten database.
epoch := 0
2019-09-15 22:54:07 +02:00
var urlKey string
2019-08-25 21:33:56 +02:00
for {
var err error
urlKey, err = generateURLKey(epoch)
if err != nil {
return nil, errors.Wrap(err, "url-key generation failed")
}
2019-09-01 12:04:43 +02:00
2019-09-15 22:54:07 +02:00
found := shortenBucket.Get([]byte(urlKey))
2019-08-25 21:33:56 +02:00
if found == nil {
break
}
2019-09-01 12:04:43 +02:00
isReserved := false
for _, reservedKey := range ReservedPasteKeys {
2019-09-15 22:54:07 +02:00
if strings.HasPrefix(urlKey, reservedKey) {
2019-09-01 12:04:43 +02:00
isReserved = true
break
}
}
if !isReserved {
break
}
2019-08-25 21:33:56 +02:00
epoch++
}
// Store the new key
storedPaste := StoredPaste{
Type: TypeRedirect,
State: StatePresent,
Content: []byte(userURL.String()),
2019-08-29 00:50:26 +02:00
Key: urlKey,
2019-09-01 01:41:01 +02:00
OwnerToken: ownerKey,
2019-08-25 21:33:56 +02:00
TimeCreated: time.Now().UTC(),
}
storedBytes, err := gobmarsh.Marshal(storedPaste)
2019-08-25 21:33:56 +02:00
if err != nil {
return nil, errors.Wrap(err, "encoding for database failed")
}
2019-09-15 22:54:07 +02:00
if err := shortenBucket.Put([]byte(urlKey), storedBytes); err != nil {
2019-08-25 21:33:56 +02:00
return nil, errors.Wrap(err, "database transaction failed")
}
return &storedPaste, nil
2019-08-25 21:33:56 +02:00
}
2019-09-15 22:54:07 +02:00
func generateURLKey(epoch int) (string, error) {
2019-08-25 21:33:56 +02:00
urlKey := make([]byte, 4+epoch)
_, err := rand.Read(urlKey)
if err != nil {
2019-09-15 22:54:07 +02:00
return "", err
2019-08-25 21:33:56 +02:00
}
// Put all the values in the range 0..64 for easier base64-encoding
for i := 0; i < len(urlKey); i++ {
urlKey[i] &= 0x3F
}
// Implement truncate-resistance by forcing the prefix to
// 0b111110xxxxxxxxxx
// ^----- {epoch} ones followed by a single 0
//
// Example when epoch is 1: prefix is 0b10.
i := 0
for i < epoch {
// Set this bit to 1
limb := i / 6
bit := i % 6
urlKey[limb] |= 1 << uint(5-bit)
i++
}
// Finally set the next bit to 0
limb := i / 6
bit := i % 6
urlKey[limb] &= ^(1 << uint(5-bit))
// Convert this ID to a canonical base64 notation
2019-08-29 00:50:26 +02:00
for i := range urlKey {
urlKey[i] = base64Alphabet[urlKey[i]]
}
2019-09-15 22:54:07 +02:00
return string(urlKey), nil
2019-08-25 21:33:56 +02:00
}
2019-09-01 01:41:01 +02:00
func generateOwnerToken() ([16]byte, error) {
var ownerKey [16]byte
_, err := rand.Read(ownerKey[:])
if err != nil {
return ownerKey, err
}
return ownerKey, nil
}
func getOwnerTokenFromRequest(r *http.Request) ([16]byte, bool) {
var ownerKey [16]byte
ownerKeyCookie, err := r.Cookie(CookieOwnerToken)
if err != nil && err != http.ErrNoCookie {
return ownerKey, false
}
if ownerKeyCookie != nil {
n, err := base64Encoder.Strict().Decode(ownerKey[:], []byte(ownerKeyCookie.Value))
if err == nil || n == 16 {
return ownerKey, true
}
}
return ownerKey, false
}