Feature/save signs (#2127)

* apply fix * Fixes empty th:action * Update build.gradle * fix * formatting * Save signatures * Fix code scanning alert no. 42: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix UserServiceInterface * Merge branch 'feature/saveSigns' of git@github.com:Stirling-Tools/Stirling-PDF.git into feature/saveSigns * 0.31.0 bump and further csrf * formatting * preview name * add * sign doc * Update translation files (#2128) Signed-off-by: GitHub Action <action@github.com> Co-authored-by: GitHub Action <action@github.com> --------- Signed-off-by: GitHub Action <action@github.com> Co-authored-by: Dimitrios Kaitantzidis <james_k23@hotmail.gr> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: a <a> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: GitHub Action <action@github.com>
2024-10-30 12:46:44 +00:00
parent ed75fa4e1b
commit 27d2681a97
56 changed files with 741 additions and 44 deletions
--- a/src/main/java/stirling/software/SPDF/config/security/SecurityConfiguration.java
+++ b/src/main/java/stirling/software/SPDF/config/security/SecurityConfiguration.java
@@ -104,7 +104,32 @@ public class SecurityConfiguration {
                requestHandler.setCsrfRequestAttributeName(null);
                http.csrf(
                        csrf ->
-                                csrf.csrfTokenRepository(cookieRepo)
+                                csrf.ignoringRequestMatchers(
+                                                request -> {
+                                                    String apiKey = request.getHeader("X-API-Key");
+
+                                                    // If there's no API key, don't ignore CSRF
+                                                    // (return false)
+                                                    if (apiKey == null || apiKey.trim().isEmpty()) {
+                                                        return false;
+                                                    }
+
+                                                    // Validate API key using existing UserService
+                                                    try {
+                                                        Optional<User> user =
+                                                                userService.getUserByApiKey(apiKey);
+                                                        // If API key is valid, ignore CSRF (return
+                                                        // true)
+                                                        // If API key is invalid, don't ignore CSRF
+                                                        // (return false)
+                                                        return user.isPresent();
+                                                    } catch (Exception e) {
+                                                        // If there's any error validating the API
+                                                        // key, don't ignore CSRF
+                                                        return false;
+                                                    }
+                                                })
+                                        .csrfTokenRepository(cookieRepo)
                                        .csrfTokenRequestHandler(requestHandler));
            }
            http.addFilterBefore(rateLimitingFilter(), UsernamePasswordAuthenticationFilter.class);
--- a/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java
+++ b/src/main/java/stirling/software/SPDF/controller/api/security/CertSignController.java
@@ -96,17 +96,18 @@ public class CertSignController {

        public CreateSignature(KeyStore keystore, char[] pin)
                throws KeyStoreException,
-                UnrecoverableKeyException,
-                NoSuchAlgorithmException,
-                IOException,
-                CertificateException {
+                        UnrecoverableKeyException,
+                        NoSuchAlgorithmException,
+                        IOException,
+                        CertificateException {
            super(keystore, pin);
            ClassPathResource resource = new ClassPathResource("static/images/signature.png");
            imageFile = resource.getFile();
        }

-        public InputStream createVisibleSignature(PDDocument srcDoc, PDSignature signature, Integer pageNumber,
-                Boolean showImage) throws IOException {
+        public InputStream createVisibleSignature(
+                PDDocument srcDoc, PDSignature signature, Integer pageNumber, Boolean showImage)
+                throws IOException {
            // modified from org.apache.pdfbox.examples.signature.CreateVisibleSignature2
            try (PDDocument doc = new PDDocument()) {
                PDPage page = new PDPage(srcDoc.getPage(pageNumber).getMediaBox());
@@ -151,8 +152,8 @@ public class CertSignController {
                        extState.setNonStrokingAlphaConstant(0.5f);
                        cs.setGraphicsStateParameters(extState);
                        cs.transform(Matrix.getScaleInstance(0.08f, 0.08f));
-                        PDImageXObject img = PDImageXObject.createFromFileByExtension(imageFile,
-                                doc);
+                        PDImageXObject img =
+                                PDImageXObject.createFromFileByExtension(imageFile, doc);
                        cs.drawImage(img, 100, 0);
                        cs.restoreGraphicsState();
                    }
@@ -200,7 +201,10 @@ public class CertSignController {
    }

    @PostMapping(consumes = "multipart/form-data", value = "/cert-sign")
-    @Operation(summary = "Sign PDF with a Digital Certificate", description = "This endpoint accepts a PDF file, a digital certificate and related information to sign the PDF. It then returns the digitally signed PDF file. Input:PDF Output:PDF Type:SISO")
+    @Operation(
+            summary = "Sign PDF with a Digital Certificate",
+            description =
+                    "This endpoint accepts a PDF file, a digital certificate and related information to sign the PDF. It then returns the digitally signed PDF file. Input:PDF Output:PDF Type:SISO")
    public ResponseEntity<byte[]> signPDFWithCert(@ModelAttribute SignPDFWithCertRequest request)
            throws Exception {
        MultipartFile pdf = request.getFileInput();
@@ -229,7 +233,7 @@ public class CertSignController {
                PrivateKey privateKey = getPrivateKeyFromPEM(privateKeyFile.getBytes(), password);
                Certificate cert = (Certificate) getCertificateFromPEM(certFile.getBytes());
                ks.setKeyEntry(
-                        "alias", privateKey, password.toCharArray(), new Certificate[] { cert });
+                        "alias", privateKey, password.toCharArray(), new Certificate[] {cert});
                break;
            case "PKCS12":
                ks = KeyStore.getInstance("PKCS12");
@@ -245,7 +249,15 @@ public class CertSignController {

        CreateSignature createSignature = new CreateSignature(ks, password.toCharArray());
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-        sign(pdfDocumentFactory, pdf.getBytes(), baos, createSignature, showSignature, pageNumber, name, location,
+        sign(
+                pdfDocumentFactory,
+                pdf.getBytes(),
+                baos,
+                createSignature,
+                showSignature,
+                pageNumber,
+                name,
+                location,
                reason);
        return WebResponseUtils.boasToWebResponse(
                baos,
@@ -274,8 +286,8 @@ public class CertSignController {

            if (showSignature) {
                SignatureOptions signatureOptions = new SignatureOptions();
-                signatureOptions
-                        .setVisualSignature(instance.createVisibleSignature(doc, signature, pageNumber, true));
+                signatureOptions.setVisualSignature(
+                        instance.createVisibleSignature(doc, signature, pageNumber, true));
                signatureOptions.setPage(pageNumber);

                doc.addSignature(signature, instance, signatureOptions);
@@ -291,19 +303,22 @@ public class CertSignController {

    private PrivateKey getPrivateKeyFromPEM(byte[] pemBytes, String password)
            throws IOException, OperatorCreationException, PKCSException {
-        try (PEMParser pemParser = new PEMParser(new InputStreamReader(new ByteArrayInputStream(pemBytes)))) {
+        try (PEMParser pemParser =
+                new PEMParser(new InputStreamReader(new ByteArrayInputStream(pemBytes)))) {
            Object pemObject = pemParser.readObject();
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
            PrivateKeyInfo pkInfo;
            if (pemObject instanceof PKCS8EncryptedPrivateKeyInfo) {
-                InputDecryptorProvider decProv = new JceOpenSSLPKCS8DecryptorProviderBuilder()
-                        .build(password.toCharArray());
+                InputDecryptorProvider decProv =
+                        new JceOpenSSLPKCS8DecryptorProviderBuilder().build(password.toCharArray());
                pkInfo = ((PKCS8EncryptedPrivateKeyInfo) pemObject).decryptPrivateKeyInfo(decProv);
            } else if (pemObject instanceof PEMEncryptedKeyPair) {
-                PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(password.toCharArray());
-                pkInfo = ((PEMEncryptedKeyPair) pemObject)
-                        .decryptKeyPair(decProv)
-                        .getPrivateKeyInfo();
+                PEMDecryptorProvider decProv =
+                        new JcePEMDecryptorProviderBuilder().build(password.toCharArray());
+                pkInfo =
+                        ((PEMEncryptedKeyPair) pemObject)
+                                .decryptKeyPair(decProv)
+                                .getPrivateKeyInfo();
            } else {
                pkInfo = ((PEMKeyPair) pemObject).getPrivateKeyInfo();
            }
--- a/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java
+++ b/src/main/java/stirling/software/SPDF/controller/web/GeneralWebController.java
@@ -31,6 +31,10 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import io.swagger.v3.oas.annotations.Hidden;
 import io.swagger.v3.oas.annotations.tags.Tag;

+import stirling.software.SPDF.controller.api.pipeline.UserServiceInterface;
+import stirling.software.SPDF.model.SignatureFile;
+import stirling.software.SPDF.service.SignatureService;
+
@Controller
@Tag(name = "General", description = "General APIs")
 public class GeneralWebController {
@@ -171,11 +175,28 @@ public class GeneralWebController {
        return "split-pdfs";
    }

+    private static final String SIGNATURE_BASE_PATH = "customFiles/static/signatures/";
+    private static final String ALL_USERS_FOLDER = "ALL_USERS";
+
+    @Autowired private SignatureService signatureService;
+
+    @Autowired(required = false)
+    private UserServiceInterface userService;
+
    @GetMapping("/sign")
    @Hidden
    public String signForm(Model model) {
+        String username = "";
+        if (userService != null) {
+            username = userService.getCurrentUsername();
+        }
+
+        // Get signatures from both personal and ALL_USERS folders
+        List<SignatureFile> signatures = signatureService.getAvailableSignatures(username);
+
        model.addAttribute("currentPage", "sign");
        model.addAttribute("fonts", getFontNames());
+        model.addAttribute("signatures", signatures);
        return "sign";
    }

--- a/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java
+++ b/src/main/java/stirling/software/SPDF/controller/web/SignatureController.java
@@ -0,0 +1,44 @@
+package stirling.software.SPDF.controller.web;
+
+import java.io.IOException;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import stirling.software.SPDF.controller.api.pipeline.UserServiceInterface;
+import stirling.software.SPDF.service.SignatureService;
+
+@Controller
+@RequestMapping("/api/v1/general/")
+public class SignatureController {
+
+    @Autowired private SignatureService signatureService;
+
+    @Autowired(required = false)
+    private UserServiceInterface userService;
+
+    @GetMapping("/sign/{fileName}")
+    public ResponseEntity<byte[]> getSignature(@PathVariable(name = "fileName") String fileName)
+            throws IOException {
+        String username = "NON_SECURITY_USER";
+        if (userService != null) {
+            username = userService.getCurrentUsername();
+        }
+
+        // Verify access permission
+        if (!signatureService.hasAccessToFile(username, fileName)) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+
+        byte[] imageBytes = signatureService.getSignatureBytes(username, fileName);
+        return ResponseEntity.ok()
+                .contentType(MediaType.IMAGE_JPEG) // Adjust based on file type
+                .body(imageBytes);
+    }
+}
--- a/src/main/java/stirling/software/SPDF/model/SignatureFile.java
+++ b/src/main/java/stirling/software/SPDF/model/SignatureFile.java
@@ -0,0 +1,11 @@
+package stirling.software.SPDF.model;
+
+import lombok.AllArgsConstructor;
+import lombok.Data;
+
+@Data
+@AllArgsConstructor
+public class SignatureFile {
+    private String fileName;
+    private String category; // "Personal" or "Shared"
+}
--- a/src/main/java/stirling/software/SPDF/service/SignatureService.java
+++ b/src/main/java/stirling/software/SPDF/service/SignatureService.java
@@ -0,0 +1,100 @@
+package stirling.software.SPDF.service;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.springframework.stereotype.Service;
+import org.thymeleaf.util.StringUtils;
+
+import lombok.extern.slf4j.Slf4j;
+import stirling.software.SPDF.model.SignatureFile;
+
+@Service
+@Slf4j
+public class SignatureService {
+
+    private static final String SIGNATURE_BASE_PATH = "customFiles/signatures/";
+    private static final String ALL_USERS_FOLDER = "ALL_USERS";
+
+    public boolean hasAccessToFile(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // Check if file exists in user's personal folder or ALL_USERS folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+
+        return Files.exists(userPath) || Files.exists(allUsersPath);
+    }
+
+    public List<SignatureFile> getAvailableSignatures(String username) {
+        List<SignatureFile> signatures = new ArrayList<>();
+
+        // Get signatures from user's personal folder
+        if (!StringUtils.isEmptyOrWhitespace(username)) {
+            Path userFolder = Paths.get(SIGNATURE_BASE_PATH, username);
+            if (Files.exists(userFolder)) {
+                try {
+                    signatures.addAll(getSignaturesFromFolder(userFolder, "Personal"));
+                } catch (IOException e) {
+                    log.error("Error reading user signatures folder", e);
+                }
+            }
+        }
+
+        // Get signatures from ALL_USERS folder
+        Path allUsersFolder = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER);
+        if (Files.exists(allUsersFolder)) {
+            try {
+                signatures.addAll(getSignaturesFromFolder(allUsersFolder, "Shared"));
+            } catch (IOException e) {
+                log.error("Error reading shared signatures folder", e);
+            }
+        }
+
+        return signatures;
+    }
+
+    private List<SignatureFile> getSignaturesFromFolder(Path folder, String category)
+            throws IOException {
+        return Files.list(folder)
+                .filter(path -> isImageFile(path))
+                .map(path -> new SignatureFile(path.getFileName().toString(), category))
+                .collect(Collectors.toList());
+    }
+
+    public byte[] getSignatureBytes(String username, String fileName) throws IOException {
+        validateFileName(fileName);
+        // First try user's personal folder
+        Path userPath = Paths.get(SIGNATURE_BASE_PATH, username, fileName);
+        if (Files.exists(userPath)) {
+            return Files.readAllBytes(userPath);
+        }
+
+        // Then try ALL_USERS folder
+        Path allUsersPath = Paths.get(SIGNATURE_BASE_PATH, ALL_USERS_FOLDER, fileName);
+        if (Files.exists(allUsersPath)) {
+            return Files.readAllBytes(allUsersPath);
+        }
+
+        throw new FileNotFoundException("Signature file not found");
+    }
+
+    private boolean isImageFile(Path path) {
+        String fileName = path.getFileName().toString().toLowerCase();
+        return fileName.endsWith(".jpg")
+                || fileName.endsWith(".jpeg")
+                || fileName.endsWith(".png")
+                || fileName.endsWith(".gif");
+    }
+
+    private void validateFileName(String fileName) {
+        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
+            throw new IllegalArgumentException("Invalid filename");
+        }
+    }
+}
--- a/src/main/java/stirling/software/SPDF/utils/ImageProcessingUtils.java
+++ b/src/main/java/stirling/software/SPDF/utils/ImageProcessingUtils.java
@@ -30,17 +30,19 @@ public class ImageProcessingUtils {
        BufferedImage convertedImage;
        switch (colorType) {
            case "greyscale":
-                convertedImage = new BufferedImage(
-                        sourceImage.getWidth(),
-                        sourceImage.getHeight(),
-                        BufferedImage.TYPE_BYTE_GRAY);
+                convertedImage =
+                        new BufferedImage(
+                                sourceImage.getWidth(),
+                                sourceImage.getHeight(),
+                                BufferedImage.TYPE_BYTE_GRAY);
                convertedImage.getGraphics().drawImage(sourceImage, 0, 0, null);
                break;
            case "blackwhite":
-                convertedImage = new BufferedImage(
-                        sourceImage.getWidth(),
-                        sourceImage.getHeight(),
-                        BufferedImage.TYPE_BYTE_BINARY);
+                convertedImage =
+                        new BufferedImage(
+                                sourceImage.getWidth(),
+                                sourceImage.getHeight(),
+                                BufferedImage.TYPE_BYTE_BINARY);
                convertedImage.getGraphics().drawImage(sourceImage, 0, 0, null);
                break;
            default: // full color
@@ -79,7 +81,8 @@ public class ImageProcessingUtils {
    public static double extractImageOrientation(InputStream is) throws IOException {
        try {
            Metadata metadata = ImageMetadataReader.readMetadata(is);
-            ExifSubIFDDirectory directory = metadata.getFirstDirectoryOfType(ExifSubIFDDirectory.class);
+            ExifSubIFDDirectory directory =
+                    metadata.getFirstDirectoryOfType(ExifSubIFDDirectory.class);
            if (directory == null) {
                return 0;
            }
@@ -106,10 +109,11 @@ public class ImageProcessingUtils {
        if (orientation == 0) {
            return image;
        }
-        AffineTransform transform = AffineTransform.getRotateInstance(
-                Math.toRadians(orientation),
-                image.getWidth() / 2.0,
-                image.getHeight() / 2.0);
+        AffineTransform transform =
+                AffineTransform.getRotateInstance(
+                        Math.toRadians(orientation),
+                        image.getWidth() / 2.0,
+                        image.getHeight() / 2.0);
        AffineTransformOp op = new AffineTransformOp(transform, AffineTransformOp.TYPE_BILINEAR);
        return op.filter(image, null);
    }