Small fixes, dep updates, removed warning about Android app, made web app params into annotations

4 files changed, 39 insertions, 15 deletions

diff --git a/zxingorg/src/main/java/com/google/zxing/web/ChartServlet.java b/zxingorg/src/main/java/com/google/zxing/web/ChartServlet.java
index 4f6846f16..bdee82281 100644
--- a/zxingorg/src/main/java/com/google/zxing/web/ChartServlet.java
+++ b/zxingorg/src/main/java/com/google/zxing/web/ChartServlet.java
@@ -99,6 +99,10 @@ public final class ChartServlet extends HttpServlet {
     }
 
     String requestURI = request.getRequestURI();
+    if (requestURI == null) {
+      response.sendError(HttpServletResponse.SC_BAD_REQUEST);
+      return;
+    }
     int lastDot = requestURI.lastIndexOf('.');
     String imageFormat;
     if (lastDot > 0) {
diff --git a/zxingorg/src/main/java/com/google/zxing/web/DecodeServlet.java b/zxingorg/src/main/java/com/google/zxing/web/DecodeServlet.java
index 39263892a..65ee067a9 100644
--- a/zxingorg/src/main/java/com/google/zxing/web/DecodeServlet.java
+++ b/zxingorg/src/main/java/com/google/zxing/web/DecodeServlet.java
@@ -70,6 +70,7 @@ import javax.servlet.ServletConfig;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
 import javax.servlet.annotation.MultipartConfig;
+import javax.servlet.annotation.WebInitParam;
 import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
@@ -87,7 +88,11 @@ import javax.servlet.http.Part;
     maxRequestSize = 1L << 26, // ~64MB
     fileSizeThreshold = 1 << 23, // ~8MB
     location = "/tmp")
-@WebServlet(value = "/w/decode", loadOnStartup = 1)
+@WebServlet(value = "/w/decode", loadOnStartup = 1, initParams = {
+  @WebInitParam(name = "maxAccessPerTime", value = "150"),
+  @WebInitParam(name = "accessTimeSec", value = "300"),
+  @WebInitParam(name = "maxEntries", value = "10000")
+})
 public final class DecodeServlet extends HttpServlet {
 
   private static final Logger log = Logger.getLogger(DecodeServlet.class.getName());
@@ -131,8 +136,13 @@ public final class DecodeServlet extends HttpServlet {
       log.info("Blocking URIs containing: " + blockedURLSubstrings);
     }
 
+    int maxAccessPerTime = Integer.parseInt(servletConfig.getInitParameter("maxAccessPerTime"));
+    int accessTimeSec = Integer.parseInt(servletConfig.getInitParameter("accessTimeSec"));
+    long accessTimeMS = TimeUnit.MILLISECONDS.convert(accessTimeSec, TimeUnit.SECONDS);
+    int maxEntries = Integer.parseInt(servletConfig.getInitParameter("maxEntries"));
+
     timer = new Timer("DecodeServlet");
-    destHostTracker = new DoSTracker(timer, 500, TimeUnit.MILLISECONDS.convert(5, TimeUnit.MINUTES), 10_000);
+    destHostTracker = new DoSTracker(timer, maxAccessPerTime, accessTimeMS, maxEntries);
   }
 
   @Override
diff --git a/zxingorg/src/main/java/com/google/zxing/web/DoSFilter.java b/zxingorg/src/main/java/com/google/zxing/web/DoSFilter.java
index 5ccf5266d..0586779b6 100644
--- a/zxingorg/src/main/java/com/google/zxing/web/DoSFilter.java
+++ b/zxingorg/src/main/java/com/google/zxing/web/DoSFilter.java
@@ -23,6 +23,7 @@ import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.annotation.WebFilter;
+import javax.servlet.annotation.WebInitParam;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
@@ -36,20 +37,24 @@ import java.util.concurrent.TimeUnit;
  *
  * @author Sean Owen
  */
-@WebFilter({"/w/decode", "/w/chart"})
+@WebFilter(urlPatterns = {"/w/decode", "/w/chart"}, initParams = {
+  @WebInitParam(name = "maxAccessPerTime", value = "150"),
+  @WebInitParam(name = "accessTimeSec", value = "300"),
+  @WebInitParam(name = "maxEntries", value = "10000")
+})
 public final class DoSFilter implements Filter {
 
-  static final int MAX_ACCESS_PER_TIME = 500;
-  static final long ACCESS_TIME_MS = TimeUnit.MILLISECONDS.convert(5, TimeUnit.MINUTES);
-  static final int MAX_ENTRIES = 10_000;
-
   private Timer timer;
   private DoSTracker sourceAddrTracker;
 
   @Override
   public void init(FilterConfig filterConfig) {
+    int maxAccessPerTime = Integer.parseInt(filterConfig.getInitParameter("maxAccessPerTime"));
+    int accessTimeSec = Integer.parseInt(filterConfig.getInitParameter("accessTimeSec"));
+    long accessTimeMS = TimeUnit.MILLISECONDS.convert(accessTimeSec, TimeUnit.SECONDS);
+    int maxEntries = Integer.parseInt(filterConfig.getInitParameter("maxEntries"));
     timer = new Timer("DoSFilter");
-    sourceAddrTracker = new DoSTracker(timer, MAX_ACCESS_PER_TIME, ACCESS_TIME_MS, MAX_ENTRIES);
+    sourceAddrTracker = new DoSTracker(timer, maxAccessPerTime, accessTimeMS, maxEntries);
     timer.scheduleAtFixedRate(
         new TimerTask() {
           @Override
@@ -75,10 +80,9 @@ public final class DoSFilter implements Filter {
 
   private boolean isBanned(HttpServletRequest request) {
     String remoteIPAddress = request.getHeader("x-forwarded-for");
-    if (remoteIPAddress == null) {
-      remoteIPAddress = request.getRemoteAddr();
-    }
-    return sourceAddrTracker.isBanned(remoteIPAddress);
+    return
+      (remoteIPAddress != null && sourceAddrTracker.isBanned(remoteIPAddress)) ||
+      sourceAddrTracker.isBanned(request.getRemoteAddr());
   }
 
   @Override
@@ -88,4 +92,4 @@ public final class DoSFilter implements Filter {
     }
   }
 
-}
\ No newline at end of file
+}
diff --git a/zxingorg/src/test/java/com/google/zxing/web/DoSFilterTestCase.java b/zxingorg/src/test/java/com/google/zxing/web/DoSFilterTestCase.java
index 1e5f48846..2ef336537 100644
--- a/zxingorg/src/test/java/com/google/zxing/web/DoSFilterTestCase.java
+++ b/zxingorg/src/test/java/com/google/zxing/web/DoSFilterTestCase.java
@@ -19,6 +19,7 @@ package com.google.zxing.web;
 import org.junit.Assert;
 import org.junit.Test;
 import org.springframework.mock.web.MockFilterChain;
+import org.springframework.mock.web.MockFilterConfig;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 
@@ -36,8 +37,13 @@ public final class DoSFilterTestCase extends Assert {
     request.setRemoteAddr("1.2.3.4");
     HttpServletResponse response = new MockHttpServletResponse();
     DoSFilter filter = new DoSFilter();
-    filter.init(null);
-    for (int i = 0; i < DoSFilter.MAX_ACCESS_PER_TIME; i++) {
+    MockFilterConfig config = new MockFilterConfig();
+    int maxAccessPerTime = 10;
+    config.addInitParameter("maxAccessPerTime", Integer.toString(maxAccessPerTime));
+    config.addInitParameter("accessTimeSec", "60");
+    config.addInitParameter("maxEntries", "100");
+    filter.init(config);
+    for (int i = 0; i < maxAccessPerTime; i++) {
       filter.doFilter(request, response, new MockFilterChain());
       assertEquals(HttpServletResponse.SC_OK, response.getStatus());
     }