Giter Site home page Giter Site logo

cs6238project2's People

Contributors

estuart avatar heythisisevan avatar mpuckett13 avatar

Watchers

avatar avatar avatar

cs6238project2's Issues

[CLOSED] Added Document Delete Support

Issue by mpuckett7
Sunday Nov 15, 2015 at 21:45 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/pull/3

  • Added the ability to delete a document stored on the server. I also
    updated the document download request to return a 404 when the
    document does not exist and also updated the document upload request
    to return a 201 with the URI to access the resource.

mpuckett7 included the following code: https://github.gatech.edu/mpuckett7/CS6238Project2/pull/3/commits

Fix PMD Warnings

There are currently two PMD warning that need to be fixed. It should be an easy fix:

if (rs.next()) {
    // result set code
}

[CLOSED] Add Delegate PUT Request

Issue by mpuckett7
Sunday Nov 15, 2015 at 23:52 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/5

We need to add a new REST call that allows someone to update a document. This is for the "delegate" client call in the project request.

The REST call should be:

  • PUT /s2dr/${documentId}

The request body should accept the following params:

  • documentId: the identifier of the document to update
  • clientId: the identifier of the client that we are "delegating" permissions to (probably easiest to just use the client's user name, but a true unique ID would be more "real").
  • time: the time or duration we want this "delegation" to last. (I don't know a clean way to do this off the top of my head so this param can be optional for this ticket. If we need to come back and do it later that will be fine.
  • permission: what permission we are delegating to the user. According to the project description, possible permissions can be READ, WRITE, BOTH, or OWNER. It probably makes sense to map this to a new Permission enum in the Java code for type-safety.
  • propagationFlag: boolean flag that specifies if the client who is receiving the delegated permissions can delegate permissions further.

Database support will need to be added too (probably will need to be new tables added, and new columns to existing tables).

Change Documents GUID to Name

For simplicity's sake, a document's name should be considered it's unique ID. This is not something we would do in the "real world", but it makes fulfilling this project's requirements easier. This will include changing the DB table to use the name as the primary key.

Handle Multiple SecurityFlag Parameters

Reading through the project requirements, I noticed that a document can be checked in with multiple security flags (test step 7.1). The task for this issue is to update the server to handle multiple security flags per document.

Fix the H2 Server Thread

Fix the thread used to run the H2 server so that it can be shutdown without causing a memory leak.

Add SecurityFlag Parameter to Upload POST Request.

Issue by mpuckett7
Sunday Nov 15, 2015 at 23:37 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/4

Uploading a document is currently supported, however we need to add the ability to set a SecurityFlag when uploading. According to the project description, the SecurityFlag can be one of three possibilities:

  • CONFIDENTIALITY
  • INTEGRITY
  • NONE

This security flag needs to be received in the POST request body, and it should be saved in the database (a new column will need to be added to the s2dr.Documents table). It may make sense to map this to a new SecurityFlag enum in the Java code to provide a little type-safety.

Change UserId to be Username

Similar to the documents, we should change the userId to be the client's/user's username. This will make fulfilling the project requirements easier.

Persist Database

The in-memory database has served us well for scaffolding out the project, but once the schema stabilizes out, we need to make the database persist beyond volatile memory.

Add Guice Injected "Current User" Object

Add a new object CurrentUser that can be injected into other classes. This object will need to be configured when a user authenticates. It will make checking permissions easier on the server.

Add a Client Document Verification Endpoint

In order to provide a more secure way for the client to be ensured of the integrity of a document, we need to add a REST endpoint that allows the client to download the signature of the document that is stored on the server.

Fix Jersey and Guice Dependencies

Issue by mpuckett7
Tuesday Nov 17, 2015 at 23:30 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/18

There was a bit of a discrepancy regarding some of the jersey dependencies and the way that the servlet was configured in Guice. I was hoping to just be able to ignore it since this was just a class project, but when trying to use the jersey-client package in our tests, I'm hitting some show-stopping exceptions due to this.

The task is to update Jersey dependencies to the 2.# libraries. This is actually going to require that the servlet gets changed in regards to how it registers itself with Guice

Fix Document Deleted/Not-Found HTTP Status

Due to the order of checking for a user's READ permission before attempting to read the document from the database, we are actually returning a 401 when a document doesn't exist or has been deleted rather than a 404.

Parse Subject Common Name for Username

With the current X.509 authentication framework, we use the entire subject "block" as the username (encapsulated in one String) because that's what java.security.cert.X509Certificate provides. The task for this issue is to parse the subject's common name out to use as the username.

Salt and Hash Password

Right now, the passwords are stored in plain text in the database. The task for this issue is to increase security by storing only salted and hashed representations of user passwords.

Need to implement CSRF tokens

Issue by estuart3
Monday Nov 16, 2015 at 00:04 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/8

For any of the rest calls that manipulate the server-state (DELETE, POST, PUT) we need to implement cross site request forgery tokens.

(https://www.owasp.org/index.php/Top_10_2010-A5)
(https://blog.whitehatsec.com/csrf-prevention-in-java/)

I bet the graders will be looking for this vulnerability when they grade us for "secure coding practices". I bet one of the frameworks we are using has this built in somewhere.

Document Permission Overwrite

Right now, a user can have multiple "instances" of the same permission. In response to a question on Piazza, the TA said that if a user is delegating a permission to another user and that user already has that permission, the new delegation should overwrite the old. The idea is that a user can "revoke" another user's permission.

Add Owner Permission on Upload

When a user uploads a document, we need to add an "Owner" permission in the DocumentPermissions table. The "time" column should be set to "unlimited" (tbd how this will be done).

Add the "Time" Parameter to Permission Delegation

Issue by mpuckett7
Tuesday Nov 17, 2015 at 22:46 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/17

The project description says that when delegating permissions for a document to other clients, there must be a time parameter that specifies how long that specific delegation is valid. Before we implement this feature, there are a few questions that we must answer. So this can be part of our discussion on Thursday on design.

Static Analysis on Server Code

Issue by mpuckett7
Monday Nov 16, 2015 at 00:14 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/12

The project description says that we need to use tools such as FindBugs and PMD to scan our code for vulnerabilities. I have never used either of these tools. It probably wouldn't be a bad idea for this to be an ongoing thing where we analyze our code before checking it in so that we don't get to the end and have a bunch to fix.

Change Package Structure

Update the package structure to better differentiate configuration code from app specific code.

Check Client Permissions When Deleting

Issue by mpuckett7
Monday Nov 16, 2015 at 00:01 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/6

Right now, the server just blindly deletes a document when it receives a request. Before deleting, we need to check that the user has permissions. One thing we need to determine is what permissions allow for deletion.

This depends on database support so that we can track which users have which permissions for certain documents (will be added in the issue for adding the delegation PUT request).

This also sort-of depends on us setting up sessions so that we can track which user is making the request (though we can fake it to work on this).

Fix Document Delete

The s2dr.DocumentPermissions table uses documentId as a foreign key to the s2dr.Documents table. So if you try to delete a document when there is a permissions pertaining to it, a SqlException is thrown. The task for this ticket is to delete all permissions from the DocumentPermissions table before deleting the document from the Documents table.

Strengthen Permission Delegation Support

Right now, we have basic permission delegation support, but we need to add in some checks to ensure that a user is

  • able to propogate the permission
  • figure out how to handle the weird time limit rules. (user1 delegates to user2 for 30 seconds, user2 delegates to user 3...can this time limit be beyond user2's time limit?)

WRITE Permission Permits Delete

Right now, only a user who has the OWNER permission can delete a file. According to a question asked on Piazza, WRITE and BOTH allow for a user to delete a file.

Add Document Encryption Support

Issue by mpuckett7
Monday Nov 16, 2015 at 00:09 GMT
Originally opened as https://github.gatech.edu/mpuckett7/CS6238Project2/issues/10

When a document's SecurityFlag is set as CONFIDENTIALITY, we need to encrypt it before storing it in the database. According to the project description, the file should be encrypted using AES and a random key, and then the server's public key encrypts the AES key and stores it with the document meta-data in the database.

Tho decrypt the server will then decrypt the AES key using it's private key, and then decrypt the document using the AES key.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.