node-web-mvc
Version:
node spring mvc
174 lines (173 loc) • 6.75 kB
JavaScript
"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.BaseCorsOptions = void 0;
const IllegalArgumentException_1 = __importDefault(require("../../errors/IllegalArgumentException"));
const ApiUtils_1 = require("../util/ApiUtils");
class BaseCorsOptions {
}
exports.BaseCorsOptions = BaseCorsOptions;
class CorsConfiguration extends BaseCorsOptions {
constructor(options) {
super();
if (options) {
this.origins = options.origins;
this.originPatterns = options.originPatterns;
this.allowedHeaders = options.allowedHeaders;
this.exposedHeaders = options.exposedHeaders;
this.methods = options.methods;
this.allowCredentials = options.allowCredentials;
this.allowPrivateNetwork = options.allowPrivateNetwork;
}
}
validate() {
this.validateAllowCredentials();
this.validateAllowPrivateNetwork();
}
validateAllowCredentials() {
if (this.allowCredentials == true &&
this.origins != null && this.origins.indexOf(CorsConfiguration.ALL) > -1) {
throw new IllegalArgumentException_1.default('When allowCredentials is true, allowedOrigins cannot contain the special value "*" ' +
'since that cannot be set on the "Access-Control-Allow-Origin" response header. ' +
'To allow credentials to a set of origins, list them explicitly ' +
'or consider using "allowedOriginPatterns" instead.');
}
}
validateAllowPrivateNetwork() {
if (this.allowPrivateNetwork == true &&
this.origins != null && this.origins.indexOf(CorsConfiguration.ALL) > -1) {
throw new IllegalArgumentException_1.default('When allowPrivateNetwork is true, allowedOrigins cannot contain the special value "*" ' +
'as it is not recommended from a security perspective. ' +
'To allow private network access to a set of origins, list them explicitly ' +
'or consider using "allowedOriginPatterns" instead.');
}
}
merge(items, from) {
const set = new Set([].concat(items, from).filter(Boolean));
const elements = [];
set.forEach((m) => elements.push(m));
return elements;
}
addAllowedOrigin(origin) {
if (origin) {
origin = origin.replace(/\/$/, '');
this.origins = this.origins || [];
this.origins.push(origin);
}
}
addAllowedMethod(method) {
if (method) {
this.methods = this.methods || [];
this.methods.push(method);
}
}
addAllowedHeader(header) {
if (header) {
this.allowedHeaders = this.allowedHeaders || [];
this.allowedHeaders.push(header);
}
}
addAllowedOriginPattern(pattern) {
if (pattern) {
this.originPatterns = this.originPatterns || [];
this.originPatterns.push(pattern);
}
}
combine(other) {
if (!other) {
return this;
}
const config = new CorsConfiguration();
config.origins = this.merge(this.origins, other.origins);
config.originPatterns = this.merge(this.originPatterns, other.originPatterns);
config.allowedHeaders = this.merge(this.allowedHeaders, other.allowedHeaders);
config.exposedHeaders = this.merge(this.exposedHeaders, other.exposedHeaders);
config.methods = this.merge(this.methods, other.methods);
if (!(0, ApiUtils_1.isEmpty)(this.allowCredentials)) {
config.allowCredentials = this.allowCredentials;
}
if (!(0, ApiUtils_1.isEmpty)(this.allowPrivateNetwork)) {
config.allowPrivateNetwork = this.allowPrivateNetwork;
}
if (!(0, ApiUtils_1.isEmpty)(this.maxAge)) {
config.maxAge = this.maxAge;
}
return config;
}
matchOrigin(checkOrigin) {
var _a, _b;
return (_b = (_a = this.origins) === null || _a === void 0 ? void 0 : _a.find) === null || _b === void 0 ? void 0 : _b.call(_a, (m) => (0, ApiUtils_1.equalsIgnoreCase)(m, checkOrigin) || m === CorsConfiguration.ALL);
}
matchOriginWithPattern(checkOrigin) {
var _a, _b;
return (_b = (_a = this.originPatterns) === null || _a === void 0 ? void 0 : _a.find) === null || _b === void 0 ? void 0 : _b.call(_a, (m) => m.test(checkOrigin));
}
checkOrigin(origin) {
if ((0, ApiUtils_1.isEmpty)(origin)) {
return null;
}
const ALL = CorsConfiguration.ALL;
const checkOrigin = origin.replace(/\/$/, '');
const matcedhOrigin = this.matchOrigin(checkOrigin) || this.matchOriginWithPattern(checkOrigin);
if (matcedhOrigin == ALL) {
this.validate();
return ALL;
}
else if (matcedhOrigin) {
return origin;
}
return null;
}
checkHttpMethod(requestMethod) {
var _a;
if ((0, ApiUtils_1.isEmpty)(requestMethod)) {
return null;
}
if (((_a = this.methods) === null || _a === void 0 ? void 0 : _a.length) < 1) {
return [requestMethod];
}
const matched = this.methods.find((m) => (0, ApiUtils_1.equalsIgnoreCase)(m, requestMethod));
if (matched) {
return this.methods;
}
}
checkHeaders(requestHeaders) {
var _a;
if (requestHeaders == null) {
return null;
}
if (requestHeaders.length < 1) {
return [];
}
if (((_a = this.allowedHeaders) === null || _a === void 0 ? void 0 : _a.length) < 1) {
return null;
}
const allowHeaders = this.allowedHeaders;
if (allowHeaders.indexOf(CorsConfiguration.ALL) > -1) {
return [].concat(requestHeaders);
}
const headers = requestHeaders.filter((m) => {
return !!allowHeaders.find((a) => (0, ApiUtils_1.equalsIgnoreCase)(m, a));
});
return headers.length < 1 ? null : headers;
}
applyPermitDefaultValues() {
const ALL = CorsConfiguration.ALL;
if (this.origins == null) {
this.origins = [ALL];
}
if (this.allowedHeaders == null) {
this.allowedHeaders = [
ALL,
];
}
if (this.maxAge == null) {
this.maxAge = 1800;
}
return this;
}
}
CorsConfiguration.ALL = '*';
exports.default = CorsConfiguration;