Support for authentication in user-provided remote artifacts (OAuth2.0, HTTP basic, HTTP header)

Author: costas80

xmlvalidator-common/src/main/java/eu/europa/ec/itb/xml/InputHelper.java

@@ -53,7 +53,7 @@ public List<FileInfo> validateExternalArtifacts(DomainConfig domainConfig, Valid
             if (fileInfo.getFile() != null) {
                 File rootFile = fileManager.unzipFile(parentFolder, fileInfo.getFile());
                 if (rootFile == null) {
-                    artifactsToReturn.add(new FileInfo(fileManager.preprocessFileIfNeeded(domainConfig, validationType, artifactType, fileInfo.getFile(), true), fileInfo.getType(), fileInfo.getSource()));
+                    artifactsToReturn.add(new FileInfo(fileManager.preprocessFileIfNeeded(domainConfig, validationType, artifactType, fileInfo.getFile(), true), fileInfo.getType(), fileInfo.getSource(), fileInfo.getRequestDecorator()));
                 } else {
                     // ZIP File
                     boolean proceed;

xmlvalidator-common/src/main/java/eu/europa/ec/itb/xml/validation/XMLValidator.java

@@ -52,11 +52,13 @@
 import java.io.InputStream;
 import java.math.BigInteger;
 import java.net.URI;
+import java.net.http.HttpRequest;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
+import java.util.function.Consumer;
 
 import static eu.europa.ec.itb.xml.util.Utils.secureSchemaValidation;
 
@@ -96,10 +98,11 @@ public XMLValidator(ValidationSpecs specs) {
      * Create an XSD resolver.
      *
      * @param schemaSource The source from which the schema was initially loaded.
+     * @param requestDecorator The request decorator to use.
      * @return The resolver.
      */
-    private LSResourceResolver getXSDResolver(URI schemaSource) {
-        return ctx.getBean(XSDFileResolver.class, specs.getDomainConfig(), schemaSource);
+    private LSResourceResolver getXSDResolver(URI schemaSource, Consumer<HttpRequest.Builder> requestDecorator) {
+        return ctx.getBean(XSDFileResolver.class, specs.getDomainConfig(), schemaSource, requestDecorator);
     }
 
     /**
@@ -169,7 +172,7 @@ private TAR validateSchema(InputStream inputStream, FileInfo schemaFile) throws
         // Validate XML content against given XSD schema.
         var errorHandler = new XSDReportHandler();
         try {
-            secureSchemaValidation(inputStream, schemaFile.getFile().toPath(), errorHandler, getXSDResolver(schemaFile.getSource()), specs.getLocalisationHelper().getLocale(), specs.getDomainConfig().getSchemaVersionForValidationType(getValidationType()));
+            secureSchemaValidation(inputStream, schemaFile.getFile().toPath(), errorHandler, getXSDResolver(schemaFile.getSource(), schemaFile.getRequestDecorator()), specs.getLocalisationHelper().getLocale(), specs.getDomainConfig().getSchemaVersionForValidationType(getValidationType()));
         } catch (Exception e) {
             throw new XMLInvalidException(e);
         }

xmlvalidator-common/src/main/java/eu/europa/ec/itb/xml/validation/XSDFileResolver.java

@@ -33,9 +33,11 @@
 import java.io.Reader;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.net.http.HttpRequest;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Objects;
+import java.util.function.Consumer;
 
 /**
  * URI resolver for XSDs looking up resources from the local file system.
@@ -51,6 +53,7 @@ public class XSDFileResolver implements LSResourceResolver {
 
     private final DomainConfig domainConfig;
     private final URI schemaSource;
+    private final Consumer<HttpRequest.Builder> requestDecorator;
 
     @Autowired
     ApplicationConfig config;
@@ -60,10 +63,12 @@ public class XSDFileResolver implements LSResourceResolver {
      *
      * @param domainConfig The domain configuration.
      * @param schemaSource The source of the initial schema that triggered the validation.
+     * @param requestDecorator The request decorator to use.
      */
-    public XSDFileResolver(DomainConfig domainConfig, URI schemaSource) {
+    public XSDFileResolver(DomainConfig domainConfig, URI schemaSource, Consumer<HttpRequest.Builder> requestDecorator) {
         this.domainConfig = domainConfig;
         this.schemaSource = schemaSource;
+        this.requestDecorator = requestDecorator;
     }
 
     /**
@@ -189,7 +194,7 @@ private InputStream readRemoteSchema(URI schemaResource, DomainConfig domainConf
         } else if (domainConfig.isSkipRemoteSchemaImportCaching()) {
             // Read from the remote URI directly.
             LOG.debug("Retrieving resource [{}] remotely due to disabled caching", schemaResource);
-            return fileManager.getInputStreamFromURL(uriAsString, null, domainConfig.getHttpVersion()).stream();
+            return fileManager.getInputStreamFromURL(uriAsString, null, domainConfig.getHttpVersion(), requestDecorator).stream();
         } else {
             // Go through our caching layer.
             LOG.debug("Retrieving resource [{}] from cache", schemaResource);

xmlvalidator-web/src/main/java/eu/europa/ec/itb/xml/upload/UploadController.java

@@ -51,9 +51,11 @@
 import java.io.File;
 import java.io.IOException;
 import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
 import java.nio.file.Path;
 import java.util.*;
 import java.util.function.BooleanSupplier;
+import java.util.function.Consumer;
 
 import static eu.europa.ec.itb.validation.commons.web.Constants.*;
 
@@ -519,28 +521,29 @@ private List<FileInfo> getExternalFiles(DomainConfig domainConfig, String[] exte
                                             String artifactType, File parentFolder) throws IOException {
         List<FileInfo> artifacts = new ArrayList<>();
         if (externalContentType != null) {
+            Consumer<HttpRequest.Builder> requestDecorator = fileManager.createRemoteFileRequestDecorator(domainConfig, artifactInfo);
             for (int i=0; i<externalContentType.length; i++) {
                 if (StringUtils.isNotBlank(externalContentType[i])) {
                     FileInfo fileInfo = null;
                     if (CONTENT_TYPE_FILE.equals(externalContentType[i])) {
                         if (!externalFiles[i].isEmpty()) {
                             try (var stream = externalFiles[i].getInputStream()) {
-                                fileInfo = new FileInfo(fileManager.getFileFromInputStream(parentFolder, stream, FileManager.EXTERNAL_FILE, externalFiles[i].getOriginalFilename()));
+                                fileInfo = new FileInfo(fileManager.getFileFromInputStream(parentFolder, stream, FileManager.EXTERNAL_FILE, externalFiles[i].getOriginalFilename()), null, null, requestDecorator);
                             }
                         }
                     } else if (CONTENT_TYPE_STRING.equals(externalContentType[i])) {
                         if (StringUtils.isNotBlank(externalStrings[i])) {
-                            fileInfo = new FileInfo(fileManager.getFileFromString(parentFolder, externalStrings[i], null, null, artifactType));
+                            fileInfo = new FileInfo(fileManager.getFileFromString(parentFolder, externalStrings[i], null, null, artifactType), null, null, requestDecorator);
                         }
                     } else {
                         if (StringUtils.isNotBlank(externalUri[i])) {
-                            fileInfo = fileManager.getFileFromURL(parentFolder, externalUri[i], null, null, null, null, artifactType, null, domainConfig.getHttpVersion());
+                            fileInfo = fileManager.getFileFromURL(parentFolder, externalUri[i], null, null, null, null, artifactType, null, domainConfig.getHttpVersion(), requestDecorator);
                         }
                     }
                     if (fileInfo != null) {
                         File rootFile = this.fileManager.unzipFile(parentFolder, fileInfo.getFile());
                         if (rootFile == null) {
-                            artifacts.add(new FileInfo(fileManager.preprocessFileIfNeeded(domainConfig, validationType, artifactType, fileInfo.getFile(), true), fileInfo.getType(), fileInfo.getSource()));
+                            artifacts.add(new FileInfo(fileManager.preprocessFileIfNeeded(domainConfig, validationType, artifactType, fileInfo.getFile(), true), fileInfo.getType(), fileInfo.getSource(), requestDecorator));
                         } else {
                             // ZIP File
                             boolean proceed;