diff --git a/.gitignore b/.gitignore
index 3b4f66b7..aeec055a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,7 +12,10 @@ pom.xml.versionsBackup
/Bundle/target/
/lib/
/Server/src/logs/
+/Server/src/config/config.xml
/Server/src/test/resources/config/
+/Server/s.bat
+/Server/src/bin/c.bat
**/.DS_Store
**/.settings
**/*.class
diff --git a/Server/s.bat b/Server/s.bat
new file mode 100644
index 00000000..73cc28e7
--- /dev/null
+++ b/Server/s.bat
@@ -0,0 +1,2 @@
+cd target\dist\bin
+start-openas2.bat
diff --git a/Server/src/bin/c.bat b/Server/src/bin/c.bat
new file mode 100644
index 00000000..43e1e801
--- /dev/null
+++ b/Server/src/bin/c.bat
@@ -0,0 +1,2 @@
+cd ..\..
+mvn clean package -DskipTests
diff --git a/Server/src/config/config.xml b/Server/src/config/config.xml
deleted file mode 100644
index a242e8d6..00000000
--- a/Server/src/config/config.xml
+++ /dev/null
@@ -1,219 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/Server/src/main/java/org/openas2/cmd/processor/restapi/ApiResource.java b/Server/src/main/java/org/openas2/cmd/processor/restapi/ApiResource.java
index a5bf91a2..5ed1de48 100644
--- a/Server/src/main/java/org/openas2/cmd/processor/restapi/ApiResource.java
+++ b/Server/src/main/java/org/openas2/cmd/processor/restapi/ApiResource.java
@@ -5,30 +5,22 @@
*/
package org.openas2.cmd.processor.restapi;
+import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializationFeature;
+import jakarta.ws.rs.*;
import org.openas2.cert.AliasedCertificateFactory;
import org.openas2.cert.CertificateFactory;
import org.openas2.cmd.CommandResult;
import org.openas2.cmd.processor.RestCommandProcessor;
+import org.openas2.Session;
+import org.openas2.util.Properties;
import jakarta.annotation.security.RolesAllowed;
-import jakarta.ws.rs.Consumes;
-import jakarta.ws.rs.DefaultValue;
-
-import jakarta.ws.rs.GET;
-import jakarta.ws.rs.Path;
-import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.POST;
-import jakarta.ws.rs.PUT;
-import jakarta.ws.rs.DELETE;
-import jakarta.ws.rs.HEAD;
-
-import jakarta.ws.rs.PathParam;
import jakarta.ws.rs.core.Context;
@@ -37,15 +29,26 @@
import jakarta.ws.rs.core.Response;
import jakarta.ws.rs.core.UriInfo;
import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.StringWriter;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Base64;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
+import java.util.*;
+
import org.slf4j.LoggerFactory;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathExpression;
+import javax.xml.xpath.XPathFactory;
/**
* @author javier
@@ -73,9 +76,9 @@ public static void setProcessor(RestCommandProcessor aProcessor) {
@Context
Request request;
private final ObjectMapper mapper;
-
+
public ApiResource() {
-
+
mapper = new ObjectMapper();
// enable pretty printing
mapper.enable(SerializationFeature.INDENT_OUTPUT);
@@ -220,6 +223,75 @@ public Response headCommand(@PathParam("param") String command) {
return Response.status(200).build();
}
+ @GET
+ @RolesAllowed({"ADMIN"})
+ @Path("/getPropertyList")
+ @Produces(MediaType.APPLICATION_JSON)
+ public Response getPropertyList() {
+ Map result = new HashMap<>();
+ result = (Map) Properties.getProperties();
+
+ ObjectMapper om = new ObjectMapper();
+ try {
+ String js = om.writeValueAsString(result);
+ return Response.ok(js, MediaType.APPLICATION_JSON).build();
+ } catch (JsonProcessingException e) {
+ return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("error").type(MediaType.APPLICATION_JSON).build();
+ }
+ }
+
+ @GET
+ @RolesAllowed({"ADMIN"})
+ @Path("/getXml")
+ @Produces(MediaType.APPLICATION_XML)
+ public Response getXml(@QueryParam("filename") String filename, @QueryParam("xpath") String xpathExpression) {
+ Session session = getProcessor().getSession();
+ String filePath = session.getBaseDirectory() + '\\' + filename;
+ try {
+ NodeList nodeList = getNodes(filePath, xpathExpression);
+ DocumentBuilder db = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ Document resultDocument = db.newDocument();
+ for (int i = 0; i < nodeList.getLength(); i++) {
+ Node importedNode = resultDocument.importNode(nodeList.item(i), true);
+ resultDocument.appendChild(importedNode);
+ }
+ StringWriter stringWriter = new StringWriter(); // Convert the XML document to a string
+ TransformerFactory transformerFactory = TransformerFactory.newInstance();
+ Transformer transformer = transformerFactory.newTransformer();
+ transformer.transform(new DOMSource(resultDocument), new StreamResult(stringWriter));
+ String xmlContent = stringWriter.toString();
+ return Response.ok(xmlContent, MediaType.APPLICATION_XML).build();
+ } catch (Exception exception) {
+ return Response.serverError().entity("error").type(MediaType.APPLICATION_JSON).build();
+ }
+ }
+ private NodeList getNodes(String xmlFileName, String xpathExpression) {
+ NodeList nodeList = null;
+ try {
+ DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+
+ // === XXE Protection ===
+ dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ dbf.setXIncludeAware(false);
+ dbf.setExpandEntityReferences(false);
+
+ DocumentBuilder db = dbf.newDocumentBuilder();
+ File file = new File(xmlFileName);
+ Document document = db.parse(file);
+
+ XPathExpression xPathExpr = XPathFactory.newInstance().newXPath().compile(xpathExpression);
+ nodeList = (NodeList) xPathExpr.evaluate(document, XPathConstants.NODESET);
+
+ } catch (Exception ex) {
+ LoggerFactory.getLogger(ApiResource.class.getName()).error("Error parsing XML file: " + xmlFileName, ex);
+ // return null on error
+ }
+ return nodeList;
+ }
+
private CommandResult importCertificateByStream(String itemId, MultivaluedMap formParams) throws Exception {
try {
List params = new ArrayList();