Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generic timestamp request #321

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,12 @@

import com.amazon.ask.Skill;
import com.amazon.ask.exception.AskSdkException;
import com.amazon.ask.model.RequestEnvelope;
import com.amazon.ask.model.services.Serializer;
import com.amazon.ask.request.impl.BaseSkillRequest;
import com.amazon.ask.response.SkillResponse;
import com.amazon.ask.servlet.util.ServletUtils;
import com.amazon.ask.servlet.verifiers.AlexaHttpRequest;
import com.amazon.ask.servlet.verifiers.GenericTimestampRequestEnvelope;
import com.amazon.ask.servlet.verifiers.ServletRequest;
import com.amazon.ask.servlet.verifiers.SkillRequestSignatureVerifier;
import com.amazon.ask.servlet.verifiers.SkillRequestTimestampVerifier;
Expand Down Expand Up @@ -127,8 +127,8 @@ protected void doPost(final HttpServletRequest request, final HttpServletRespons
throws IOException {
byte[] serializedRequestEnvelope = IOUtils.toByteArray(request.getInputStream());
try {
final RequestEnvelope deserializedRequestEnvelope = serializer.deserialize(IOUtils.toString(
serializedRequestEnvelope, ServletConstants.CHARACTER_ENCODING), RequestEnvelope.class);
final GenericTimestampRequestEnvelope deserializedRequestEnvelope = serializer.deserialize(IOUtils.toString(
serializedRequestEnvelope, ServletConstants.CHARACTER_ENCODING), GenericTimestampRequestEnvelope.class);

final AlexaHttpRequest alexaHttpRequest = new ServletRequest(request, serializedRequestEnvelope, deserializedRequestEnvelope);

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@

package com.amazon.ask.servlet.verifiers;

import com.amazon.ask.model.RequestEnvelope;

/**
* Provides container for server request that should be validated.
*/
Expand All @@ -37,5 +35,5 @@ public interface AlexaHttpRequest {
/**
* @return the request envelope, in deserialized form.
*/
RequestEnvelope getDeserializedRequestEnvelope();
GenericTimestampRequestEnvelope getDeserializedRequestEnvelope();
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,114 @@
package com.amazon.ask.servlet.verifiers;

import com.fasterxml.jackson.annotation.JsonIgnore;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.databind.annotation.JsonDeserialize;

import java.time.OffsetDateTime;
import java.util.Objects;

@JsonDeserialize(
builder = GenericTimestampRequest.Builder.class
)
public class GenericTimestampRequest {
Copy link
Contributor

@doiron doiron Apr 14, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel this belongs in the model package. We'd have to create some sort of base class and have RequestEnvelope inherit and extend. The models are autogenerated so we would have to make the change I believe.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the problem is that when you deal with requests that are not present in the model package. I think that request validation should not rely on the model package - you should have anemic request class that should deserialize to fields required only by validation logic

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree to some degree, I think this function should only extract what it needs. But that should be defined as a generic object in the model. Otherwise, we have two packages where a request is defined. i.e however unlikely, if the timestamp field moves/renamed, this would be hard to catch in the future.

so not entirely against this just need to think about this a bit more. Currently I see more pros in having this in the model than cons.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the biggest problem here is that I cannot edit your template files since they're private. Also having a base class can be tricky when relying on builders to create objects.

I know that there is a defaultImpl property in Jackson: https://fasterxml.github.io/jackson-annotations/javadoc/2.6/com/fasterxml/jackson/annotation/JsonTypeInfo.html#defaultImpl()

So a request could be mapped to UnknownRequest that would have locale, type, request-id, and timestamp.

@JsonProperty("type")
protected String type = null;
@JsonProperty("requestId")
protected String requestId = null;
@JsonProperty("timestamp")
protected OffsetDateTime timestamp = null;


public static GenericTimestampRequest.Builder builder() {
return new GenericTimestampRequest.Builder();
}

private GenericTimestampRequest(GenericTimestampRequest.Builder builder) {
if (builder.requestId != null) {
this.requestId = builder.requestId;
}

if (builder.timestamp != null) {
this.timestamp = builder.timestamp;
}

if (builder.type != null) {
this.type = builder.type;
}
}

@JsonIgnore
public String getType() {
return this.type;
}

@JsonProperty("requestId")
public String getRequestId() {
return this.requestId;
}

@JsonProperty("timestamp")
public OffsetDateTime getTimestamp() {
return this.timestamp;
}

public boolean equals(Object o) {
if (this == o) {
return true;
} else if (o != null && this.getClass() == o.getClass()) {
GenericTimestampRequest request = (GenericTimestampRequest) o;
return Objects.equals(this.type, request.type) && Objects.equals(this.requestId, request.requestId) && Objects.equals(this.timestamp, request.timestamp);
} else {
return false;
}
}

public int hashCode() {
return Objects.hash(this.type, this.requestId, this.timestamp);
}

public String toString() {
StringBuilder sb = new StringBuilder();
sb.append("class Request {\n");
sb.append(" type: ").append(this.toIndentedString(this.type)).append("\n");
sb.append(" requestId: ").append(this.toIndentedString(this.requestId)).append("\n");
sb.append(" timestamp: ").append(this.toIndentedString(this.timestamp)).append("\n");
sb.append("}");
return sb.toString();
}

private String toIndentedString(Object o) {
return o == null ? "null" : o.toString().replace("\n", "\n ");
}

public static class Builder {
private String type;
private String requestId;
private OffsetDateTime timestamp;

private Builder() {
}

@JsonProperty("requestId")
public GenericTimestampRequest.Builder withRequestId(String requestId) {
this.requestId = requestId;
return this;
}

@JsonProperty("timestamp")
public GenericTimestampRequest.Builder withTimestamp(OffsetDateTime timestamp) {
this.timestamp = timestamp;
return this;
}

@JsonProperty("type")
public GenericTimestampRequest.Builder withType(String type) {
this.type = type;
return this;
}

public GenericTimestampRequest build() {
return new GenericTimestampRequest(this);
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
package com.amazon.ask.servlet.verifiers;

import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
import java.util.Objects;

@JsonDeserialize(
builder = GenericTimestampRequestEnvelope.Builder.class
)
public final class GenericTimestampRequestEnvelope {
@JsonProperty("request")
private GenericTimestampRequest request;

public static GenericTimestampRequestEnvelope.Builder builder() {
return new GenericTimestampRequestEnvelope.Builder();
}

private GenericTimestampRequestEnvelope(GenericTimestampRequestEnvelope.Builder builder) {
this.request = null;

if (builder.request != null) {
this.request = builder.request;
}

}

@JsonProperty("request")
public GenericTimestampRequest getRequest() {
return this.request;
}

public boolean equals(Object o) {
if (this == o) {
return true;
} else if (o != null && this.getClass() == o.getClass()) {
GenericTimestampRequestEnvelope requestEnvelope = (GenericTimestampRequestEnvelope)o;
return Objects.equals(this.request, requestEnvelope.request);
} else {
return false;
}
}

public int hashCode() {
return Objects.hash(this.request);
}

public String toString() {
StringBuilder sb = new StringBuilder();
sb.append("class RequestEnvelope {\n");
sb.append(" request: ").append(this.toIndentedString(this.request)).append("\n");
sb.append("}");
return sb.toString();
}

private String toIndentedString(Object o) {
return o == null ? "null" : o.toString().replace("\n", "\n ");
}

public static class Builder {
private GenericTimestampRequest request;

private Builder() {
}

@JsonProperty("request")
public GenericTimestampRequestEnvelope.Builder withRequest(GenericTimestampRequest request) {
this.request = request;
return this;
}

public GenericTimestampRequestEnvelope build() {
return new GenericTimestampRequestEnvelope(this);
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@

package com.amazon.ask.servlet.verifiers;

import com.amazon.ask.model.RequestEnvelope;
import com.amazon.ask.servlet.ServletConstants;

import javax.servlet.http.HttpServletRequest;
Expand All @@ -31,7 +30,7 @@ public class ServletRequest implements AlexaHttpRequest {
/**
* De-serialized request envelope.
*/
private final RequestEnvelope deserializedRequestEnvelope;
private final GenericTimestampRequestEnvelope deserializedRequestEnvelope;

/**
* Base64 encoded signature.
Expand All @@ -50,7 +49,7 @@ public class ServletRequest implements AlexaHttpRequest {
* @param deserializedRequestEnvelope de-serialized request envelope.
*/
public ServletRequest(final HttpServletRequest httpServletRequest, final byte[] serializedRequestEnvelope,
final RequestEnvelope deserializedRequestEnvelope) {
final GenericTimestampRequestEnvelope deserializedRequestEnvelope) {
this.serializedRequestEnvelope = serializedRequestEnvelope.clone();
this.deserializedRequestEnvelope = deserializedRequestEnvelope;
this.baseEncoded64Signature = httpServletRequest.getHeader(ServletConstants.SIGNATURE_REQUEST_HEADER);
Expand Down Expand Up @@ -85,7 +84,7 @@ public byte[] getSerializedRequestEnvelope() {
* {@inheritDoc}
*/
@Override
public RequestEnvelope getDeserializedRequestEnvelope() {
public GenericTimestampRequestEnvelope getDeserializedRequestEnvelope() {
return deserializedRequestEnvelope;
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@

package com.amazon.ask.servlet.verifiers;

import com.amazon.ask.model.Request;
import com.amazon.ask.servlet.ServletConstants;
import com.amazon.ask.util.ValidationUtils;

Expand Down Expand Up @@ -94,7 +93,7 @@ public void verify(final AlexaHttpRequest alexaHttpRequest) {
if (alexaHttpRequest.getDeserializedRequestEnvelope() == null) {
throw new SecurityException("Incoming request did not contain a request envelope");
}
Request request = alexaHttpRequest.getDeserializedRequestEnvelope().getRequest();
GenericTimestampRequest request = alexaHttpRequest.getDeserializedRequestEnvelope().getRequest();
if (request == null || request.getTimestamp() == null) {
throw new SecurityException("Incoming request was null or did not contain a timestamp to evaluate");
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
import javax.security.auth.x500.X500Principal;
import javax.servlet.http.HttpServletRequest;

import com.amazon.ask.model.RequestEnvelope;
import com.amazon.ask.servlet.ServletConstants;
import org.apache.commons.codec.binary.Base64;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
Expand Down Expand Up @@ -75,7 +74,7 @@ public class SkillRequestSignatureVerifierTest {
private static final String MALFORMED_URL = "badUrl";

private static PrivateKey validPrivateKey = null;
private static RequestEnvelope deserializedRequestEnvelope;
private static GenericTimestampRequestEnvelope deserializedRequestEnvelope;
private static SkillRequestSignatureVerifier verifier;
private HttpServletRequest mockServletRequest;

Expand Down Expand Up @@ -105,7 +104,7 @@ public static void initializeCertMap() throws Exception {
certCache.put(PREPOPULATED_CERT_URL, cert);
whenNew(ConcurrentHashMap.class).withAnyArguments().thenReturn(certCache);
verifier = new SkillRequestSignatureVerifier();
deserializedRequestEnvelope = RequestEnvelope.builder().build();
deserializedRequestEnvelope = GenericTimestampRequestEnvelope.builder().build();
}

@Before
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,6 @@

package com.amazon.ask.servlet.verifiers;

import com.amazon.ask.model.IntentRequest;
import com.amazon.ask.model.LaunchRequest;
import com.amazon.ask.model.RequestEnvelope;
import com.amazon.ask.model.events.skillevents.SkillEnabledRequest;

import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.runner.RunWith;
Expand Down Expand Up @@ -107,12 +102,12 @@ public void verify_nullRequestEnvelope_throws_exception() {

@Test(expected = SecurityException.class)
public void verify_nullRequest_throws_exception() {
verifier.verify(new ServletRequest(mockServletRequest, serializedRequestEnvelope, RequestEnvelope.builder().build()));
verifier.verify(new ServletRequest(mockServletRequest, serializedRequestEnvelope, GenericTimestampRequestEnvelope.builder().build()));
}

@Test(expected = SecurityException.class)
public void verify_nullTimestamp_throws_exception() {
verifier.verify(new ServletRequest(mockServletRequest, serializedRequestEnvelope, RequestEnvelope.builder().withRequest(IntentRequest.builder().build()).build()));
verifier.verify(new ServletRequest(mockServletRequest, serializedRequestEnvelope, GenericTimestampRequestEnvelope.builder().withRequest(GenericTimestampRequest.builder().build()).build()));
}

@Test (expected = IllegalArgumentException.class)
Expand All @@ -135,21 +130,21 @@ public void verify_skillEventRequestOutsideTolerance_throws_exception() {
verifier.verify(new ServletRequest(mockServletRequest, serializedRequestEnvelope, getSkillEventRequestEnvelope(new Date(System.currentTimeMillis() - TOLERANCE_SKILL_EVENTS_MILLIS * 2))));
}

private RequestEnvelope getRequestEnvelope(Date timestamp) {
return RequestEnvelope.builder().withRequest(LaunchRequest
private GenericTimestampRequestEnvelope getRequestEnvelope(Date timestamp) {
return GenericTimestampRequestEnvelope.builder().withRequest(GenericTimestampRequest
.builder()
.withRequestId("rId")
.withType("LaunchRequest")
.withTimestamp(timestamp != null ? OffsetDateTime.ofInstant(timestamp.toInstant(), ZoneId.systemDefault()) : null)
.withLocale("en-US")
.build()).build();
}

private RequestEnvelope getSkillEventRequestEnvelope(Date timestamp) {
return RequestEnvelope.builder().withRequest(SkillEnabledRequest
private GenericTimestampRequestEnvelope getSkillEventRequestEnvelope(Date timestamp) {
return GenericTimestampRequestEnvelope.builder().withRequest(GenericTimestampRequest
.builder()
.withRequestId("rId")
.withType("AlexaSkillEvent.SkillEnabled")
.withTimestamp(timestamp != null ? OffsetDateTime.ofInstant(timestamp.toInstant(), ZoneId.systemDefault()) : null)
.withLocale("en-US")
.build()).build();
}

Expand Down