Files
WeatherTool/src/main/scala/server/Server.scala
T
b0txec 6b9c7cf4ae Fix path traversal, auth-bypass, and DoS findings from the security review
- Add ValidateFileName (allowlist regex, rejects .. and separators) and apply
  it to every route that concatenates a raw path segment into a filesystem or
  remote FTP path: /show/lvgmc-forecast, /show/grib, /grib/binary-chunk, and
  /debug/file. Previously an unauthenticated caller could read arbitrary
  files, including /proc/self/environ (leaks LVGMC_PASSWORD/POSTGRES_PASSWORD).
- Harden ValidateInt to reject negative integers.
- Gate /api/fetch/lvgmc/stations behind ENABLE_LVGMC_FTP_JOBS so it can no
  longer trigger a real, unauthenticated FTP login regardless of the flag;
  stop leaking error.getMessage in its response.
- Add an explicit /api/* catch-all (NotFound) so an unmatched API route can
  never fall through to the SPA fallback and be served index.html as a 200.
- Cap binary-chunk read length at 64MB to prevent an unbounded allocation.
2026-08-24 11:50:53 +03:00

250 lines
11 KiB
Scala

package server
import cats.effect._
import cats.implicits.toTraverseOps
import cats.syntax.semigroupk._
import com.comcast.ip4s.IpLiteralSyntax
import data.DataService
import db.PostgresService
import fetch.csv.FileNameService
import fetch.lvgmc.{FetchService, WaterTemperatureService}
import fetch.warnings.WarningService
import fs2.io.file.{Files, Path}
import server.ValidateRoutes.{AggFieldList, AggKey, CityList, DateTimeRange, Granularity, ValidateDate, ValidateDateTime, ValidateFileName, ValidateInt, ValidateMonths, ValidateZonedDateTime}
import org.http4s._
import org.http4s.dsl.io._
import org.http4s.implicits._
import org.http4s.server.{Router, staticcontent}
import org.http4s.server.middleware.CORS
import org.http4s.server.middleware.CORSConfig
import org.http4s.server.staticcontent.FileService
import org.http4s.ember.server.EmberServerBuilder
import io.circe.generic.auto._
import io.circe.syntax._
import parse.csv.Aggregate.AggregateValueImplicits.aggregateValueEncoder
import parse.csv.Aggregate.userQueryEncoder
import parse.csv.Aggregate.{AggregateKey, UserQuery}
import org.http4s.circe.jsonEncoder
import org.typelevel.log4cats.Logger
import org.typelevel.log4cats.slf4j.Slf4jLogger
import parse.csv.Aggregate
import org.http4s.headers.`Content-Type`
import java.time.{ZoneOffset, ZonedDateTime}
import scala.concurrent.duration.DurationInt
object Server {
def of(postgresService: PostgresService, dataService: DataService, fetch: FetchService, warnings: WarningService, waterTemperatures: WaterTemperatureService): IO[Server] = {
Slf4jLogger.create[IO].map {
new Server(postgresService, dataService, fetch, warnings, waterTemperatures, _)
}
}
}
class Server(postgresService: PostgresService, dataService: DataService, fetch: FetchService, warnings: WarningService, waterTemperatures: WaterTemperatureService, log: Logger[IO]) {
private case class ResponseWrapper(result: Map[String, Option[Aggregate.AggregateValue]], query: UserQuery)
private case class LatestTemperature(city: String, observedAt: String, value: Option[Double])
private val apiRoutes = HttpRoutes.of[IO] {
case GET -> Root / "warnings" =>
warnings.fetchWarnings
.flatMap(result => Ok(result.asJson))
.handleErrorWith { error =>
log.error(error)("Unable to load LVĢMC warnings") *>
ServiceUnavailable("LVĢMC brīdinājumu dati pašlaik nav pieejami")
}
case GET -> Root / "water-temperatures" =>
waterTemperatures.fetchWaterTemperatures
.flatMap(result => Ok(result.asJson))
.handleErrorWith { error =>
log.error(error)("Unable to load LVĢMC water temperatures") *>
ServiceUnavailable("Ūdens temperatūras dati pašlaik nav pieejami")
}
// http://0.0.0.0:8080/api/show/lvgmc-forecast/Latvija_LTV_pilsetas_tekosa_dn.csv
case GET -> Root / "show" / "lvgmc-forecast" / ValidateFileName(fileName) =>
fetch.fetchFile(fileName).flatMap(bytes =>
Ok(bytes).map(_.withContentType(`Content-Type`(MediaType.text.csv)))
)
// http://0.0.0.0:8080/api/fetch/lvgmc/stations
// Gated behind the same flag as the scheduled FTP task: this route would
// otherwise let anyone unauthenticated trigger a real LVGMC FTP login on
// demand, bypassing ENABLE_LVGMC_FTP_JOBS entirely.
case GET -> Root / "fetch" / "lvgmc" / "stations" =>
if (sys.env.get("ENABLE_LVGMC_FTP_JOBS").exists(_.equalsIgnoreCase("true")))
(
for {
fileName <- new FileNameService().generateCurrentHour
stationDataStr <- fetch.fetchWeatherStations()
_ <- postgresService.save(fileName, stationDataStr)
} yield stationDataStr
)
.flatMap(content => Ok(content))
.handleErrorWith(error =>
log.error(error)("Failed to fetch LVGMC stations") *>
InternalServerError("Failed to fetch stations")
)
else
ServiceUnavailable("LVGMC FTP fetching is currently disabled")
// http://0.0.0.0:8080/api/show/grib-all-structure
case GET -> Root / "show" / "grib-all-structure" =>
dataService.getAllFileStructure().flatMap(gribList => Ok(gribList.asJson))
// http://0.0.0.0:8080/api/show/grib-list
case GET -> Root / "show" / "grib-list" =>
dataService.getFileList().flatMap(fileList => Ok(fileList.asJson))
// http://0.0.0.0:8080/api/show/grib-name/harmonie_2025-02-01T1500Z_2025-02-01T180000Z.grib
case GET -> Root / "show" / "grib" / ValidateFileName(fileName) =>
dataService.getGribStucture(fileName).flatMap(response => Ok(response.asJson))
case GET -> Root / "grib" / "binary-chunk" / ValidateInt(binaryOffset) / ValidateInt(binaryLength) / ValidateFileName(fileName) =>
dataService.getBinaryChunk(binaryOffset, binaryLength, fileName).flatMap(buffer => Ok(buffer))
// http://0.0.0.0:8080/api/grib/delete-old-forecasts
case GET -> Root / "grib" / "delete-old-forecasts" =>
dataService.deleteOldForecasts().flatMap(result => Ok(result.asJson))
// http://0.0.0.0:8080/api/debug/delete-tmp
case GET -> Root / "debug" / "delete-tmp" =>
dataService.deleteTmp().flatMap(result => Ok(result.asJson))
// http://0.0.0.0:8080/api/debug/time
case GET -> Root / "debug" / "time" =>
val nowUTC = ZonedDateTime.now(ZoneOffset.UTC)
val ageThreshold = nowUTC.minusHours(9)
Ok(ageThreshold.toString)
// http://0.0.0.0:8080/api/debug/folder-structure
case GET -> Root / "debug" / "folder-structure" =>
DebugUtils.getFolderStructure.flatMap(response => Ok(response.asJson))
// http://0.0.0.0:8080/api/debug/file/error_2025-03-16_152201.txt
case GET -> Root / "debug" / "file" / ValidateFileName(fileName) =>
val filePath = Path(s"data/tmp/$fileName")
Files[IO].exists(filePath).flatMap {
case true =>
Files[IO].readUtf8(filePath)
.compile
.string
.flatMap(content => Ok(content).map(_.withContentType(`Content-Type`(MediaType.text.plain, Charset.`UTF-8`))))
.handleErrorWith(err => InternalServerError(s"Failed to read file: ${err.getMessage}"))
case false =>
NotFound(s"File not found: $fileName")
}
// http://0.0.0.0:8080/api/query/city/Liepāja,Rēzekne/20230414_2200-20230501_1230/hour/tempMax/max
case GET -> Root / "query" / "city" / CityList(cities) / DateTimeRange(from, to) / Granularity(granularity) / field / AggKey(key) =>
val userQuery = UserQuery(cities, field, key, granularity, from, to)
postgresService.query(userQuery)
.map(result => ResponseWrapper(result, userQuery))
.flatMap(responseWrapper => Ok(responseWrapper.asJson))
// Latest observation-time temperatures for a fixed production station set.
case GET -> Root / "query" / "latest-temperatures" / CityList(cities) =>
postgresService.queryLatestTemperatures(cities)
.map(_.map { case (city, observedAt, value) => LatestTemperature(city, observedAt.toString, value) })
.flatMap(result => Ok(result.asJson))
// http://0.0.0.0:8080/api/query/city/Kolka/20230414_2200-20230501_1230/allFields
case GET -> Root / "query" / "city" / (city: String) / DateTimeRange(from, to) / "allFields" =>
postgresService.queryCityAllFields(city, from, to).flatMap(result => Ok(result.asJson))
// http://0.0.0.0:8080/api/query/country/20230414_2200-20230501_1230/tempMax,tempMin,tempAvg,precipitation
case GET -> Root / "query" / "country" / DateTimeRange(from, to) / AggFieldList(fieldList) =>
postgresService.queryCountry(from, to, fieldList)
.flatMap(result => Ok(result.asJson))
// // http://0.0.0.0:8080/api/fetch/date/20230514
// case GET -> Root / "fetch" / "date" / ValidateDate(date) =>
// val result = for {
// fetchResultEither <- fetch.fetchFromDate(date).attempt
// fetchServiceError = fetchResultEither.left.toOption.map(e => s"FetchServiceError: ${e.getMessage}").toList
// fetchResult = fetchResultEither.getOrElse(List.empty)
// (fetchErrors, successDownloads) = fetchResult.partitionMap(identity)
// _ <- log.info(s"FETCHED SUCCESSFULLY files: ${successDownloads.size}")
// saveResults <- successDownloads.traverse { case (name, content) => postgresService.save(name, content).attempt }
// (saveErrors, successSaves) = saveResults.partitionMap(identity)
//// successes = successDownloads.map(s => s"fetched: ${s._1}") ++ successSaves.map(s => s"saved: $s")
// successes = successSaves
// errors = fetchServiceError ++ fetchErrors.map(e => s"FetchError: ${e.getMessage}") ++ saveErrors.map(e => s"SaveError: ${e.getMessage}")
// _ <- log.error(s"errors: $errors")
// _ <- log.info(s"successes: $successes")
// } yield (successes, errors)
//
// result.flatMap { case (successes, errors) =>
// Ok(Json.obj(
// "errors" -> errors.asJson,
// "successes" -> successes.asJson
// ).pretty)
// }
// http://0.0.0.0:8080/api/show/months/202304,202305,202306
case GET -> Root / "show" / "months" / ValidateMonths(monthList) =>
postgresService.getDatesByMonths(monthList).flatMap(dates =>
Ok(dates.asJson)
)
// http://0.0.0.0:8080/api/show/date/20230423
case GET -> Root / "show" / "date" / ValidateDate(date) =>
postgresService.getDateFileNames(date).flatMap(fileNames =>
Ok(fileNames.asJson)
)
// http://0.0.0.0:8080/api/show/datetime/20230423_1300
case GET -> Root / "show" / "datetime" / ValidateDateTime(datetime) =>
postgresService.getDateTimeEntries(datetime).flatMap(content => Ok(content.asJson))
// Explicit catch-all: guarantees every /api/* request resolves inside
// this route set (never falls through to the SPA fallback below and
// gets served index.html as a false 200).
case _ =>
NotFound()
}
private val corsConfig = CORSConfig.default
.withAnyOrigin(true)
.withAnyMethod(true)
.withAllowedMethods(Some(Set(Method.GET, Method.POST)))
.withAllowCredentials(false)
.withMaxAge(1.day)
private val apiRoutesCors = CORS(apiRoutes, corsConfig)
// Real files (JS/CSS/images/favicon) are served as-is; anything else falls
// back to index.html so the SolidJS router can handle it client-side. This
// replaces an explicit per-route list that silently 404ed on a direct hit
// (e.g. a browser refresh) for any client-side route not on the list —
// real, observed on /faktiska and /udens-temperatura in production.
private val assets = staticcontent.fileService[IO](FileService.Config("./web/dist"))
private val spaFallback = HttpRoutes.of[IO] {
// A missing file under /assets (the only place Vite emits hashed build
// output) should stay a real 404, not silently serve HTML — otherwise a
// stale tab referencing a since-removed bundle after a future deploy
// would get a confusing "unexpected token" JS parse error instead.
case GET -> Root / "assets" / _ => NotFound()
case req @ GET -> _ =>
StaticFile.fromPath(Path("./web/dist/index.html"), Some(req)).getOrElseF(NotFound())
}
private val httpApp = Router(
"/api" -> apiRoutesCors,
"/" -> (assets <+> spaFallback),
).orNotFound
def run: IO[ExitCode] =
EmberServerBuilder
.default[IO]
.withHost(ipv4"0.0.0.0")
.withPort(port"8080")
.withHttpApp(httpApp)
.build
.useForever
}