Merge pull request #4289 from erasche/local-network

Local network access restrictions

client/galaxy/scripts/utils/uploadbox.js

@@ -65,11 +65,14 @@
             if (xhr.readyState == xhr.DONE) {
                 // parse response
                 var response = null;
+                var extra_info = "";
                 if (xhr.responseText) {
                     try {
                         response = jQuery.parseJSON(xhr.responseText);
+                        extra_info = response.err_msg;
                     } catch (e) {
                         response = xhr.responseText;
+                        extra_info = response;
                     }
                 }
                 // pass any error to the error option
@@ -82,7 +85,7 @@
                     } else if (!text) {
                         text = cnf.error_default;
                     }
-                    cnf.error(text + ' (' + xhr.status + ')');
+                    cnf.error(text + ' (' + xhr.status + '). ' + extra_info);
                 } else {
                     cnf.success(response);
                 }

config/galaxy.ini.sample

@@ -1069,6 +1069,15 @@ use_interactive = True
 #expose_user_name = False
 #expose_user_email = False
 
+# Whitelist for local network addresses for "Upload from URL" dialog.
+# By default, Galaxy will deny access to the local network address space, to
+# prevent users making requests to services which the administrator did not
+# intend to expose. Previously, you could request any network service that
+# Galaxy might have had access to, even if the user could not normally access it.
+# It should be a comma separated list of IP addresses or IP address/mask, e.g.
+# 10.10.10.10,10.0.1.0/24,fd00::/8
+#fetch_url_whitelist=
+
 # -- Beta features
 
 # Enable new run workflow form

lib/galaxy/config.py

@@ -4,6 +4,7 @@ Universe configuration builder.
 # absolute_import needed for tool_shed package.
 from __future__ import absolute_import
 
+import ipaddress
 import logging
 import logging.config
 import os
@@ -26,6 +27,7 @@ from galaxy.exceptions import ConfigurationError
 from galaxy.util import ExecutionTimer
 from galaxy.util import listify
 from galaxy.util import string_as_bool
+from galaxy.util import unicodify
 from galaxy.util.dbkeys import GenomeBuilds
 from galaxy.web.formatting import expand_pretty_datetime_format
 from galaxy.web.stack import register_postfork_function
@@ -226,6 +228,13 @@ class Configuration(object):
         self.remote_user_logout_href = kwargs.get("remote_user_logout_href", None)
         self.remote_user_secret = kwargs.get("remote_user_secret", None)
         self.require_login = string_as_bool(kwargs.get("require_login", "False"))
+        self.fetch_url_whitelist_ips = [
+            ipaddress.ip_network(unicodify(ip.strip()))  # If it has a slash, assume 127.0.0.1/24 notation
+            if '/' in ip else
+            ipaddress.ip_address(unicodify(ip.strip()))  # Otherwise interpret it as an ip address.
+            for ip in kwargs.get("fetch_url_whitelist", "").split(',')
+            if len(ip.strip()) > 0
+        ]
         self.allow_user_creation = string_as_bool(kwargs.get("allow_user_creation", "True"))
         self.allow_user_deletion = string_as_bool(kwargs.get("allow_user_deletion", "False"))
         self.allow_user_dataset_purge = string_as_bool(kwargs.get("allow_user_dataset_purge", "True"))

lib/galaxy/tools/actions/upload.py

@@ -19,7 +19,7 @@ class UploadToolAction(ToolAction):
 
         persisting_uploads_timer = ExecutionTimer()
         precreated_datasets = upload_common.get_precreated_datasets(trans, incoming, trans.app.model.HistoryDatasetAssociation)
-        incoming = upload_common.persist_uploads(incoming)
+        incoming = upload_common.persist_uploads(incoming, trans)
         log.debug("Persisted uploads %s" % persisting_uploads_timer)
         # We can pass an empty string as the cntrller here since it is used to check whether we
         # are in an admin view, and this tool is currently not used there.

lib/galaxy/tools/actions/upload_common.py

@@ -1,6 +1,8 @@
+import ipaddress
 import logging
 import os
 import shlex
+import socket
 import subprocess
 import tempfile
 from cgi import FieldStorage
@@ -8,16 +10,103 @@ from json import dumps
 
 from six import StringIO
 from sqlalchemy.orm import eagerload_all
+try:
+    from urlparse import urlparse
+except ImportError:
+    from urllib.parse import urlparse
 
 from galaxy import datatypes, util
 from galaxy.exceptions import ObjectInvalid
 from galaxy.managers import tags
+from galaxy.util import unicodify
 from galaxy.util.odict import odict
 
 log = logging.getLogger(__name__)
 
 
-def persist_uploads(params):
+def validate_url(url, ip_whitelist):
+    # If it doesn't look like a URL, ignore it.
+    if not (url.lstrip().startswith('http://') or url.lstrip().startswith('https://')):
+        return url
+
+    # Extract hostname component
+    parsed_url = urlparse(url).netloc
+    # If credentials are in this URL, we need to strip those.
+    if parsed_url.count('@') > 0:
+        # credentials.
+        parsed_url = parsed_url[parsed_url.rindex('@') + 1:]
+    # Percent encoded colons and other characters will not be resolved as such
+    # so we don't have to either.
+
+    # Sometimes the netloc will contain the port which is not desired, so we
+    # need to extract that.
+    port = None
+    # However, it could ALSO be an IPv6 address they've supplied.
+    if ':' in parsed_url:
+        # IPv6 addresses have colons in them already (it seems like always more than two)
+        if parsed_url.count(':') >= 2:
+            # Since IPv6 already use colons extensively, they wrap it in
+            # brackets when there is a port, e.g. http://[2001:db8:1f70::999:de8:7648:6e8]:100/
+            # However if it ends with a ']' then there is no port after it and
+            # they've wrapped it in brackets just for fun.
+            if ']' in parsed_url and not parsed_url.endswith(']'):
+                # If this +1 throws a range error, we don't care, their url
+                # shouldn't end with a colon.
+                idx = parsed_url.rindex(':')
+                # We parse as an int and let this fail ungracefully if parsing
+                # fails because we desire to fail closed rather than open.
+                port = int(parsed_url[idx + 1:])
+                parsed_url = parsed_url[:idx]
+            else:
+                # Plain ipv6 without port
+                pass
+        else:
+            # This should finally be ipv4 with port. It cannot be IPv6 as that
+            # was caught by earlier cases, and it cannot be due to credentials.
+            idx = parsed_url.rindex(':')
+            port = int(parsed_url[idx + 1:])
+            parsed_url = parsed_url[:idx]
+
+    # safe to log out, no credentials/request path, just an IP + port
+    log.debug("parsed url, port: %s : %s", parsed_url, port)
+    # Call getaddrinfo to resolve hostname into tuples containing IPs.
+    addrinfo = socket.getaddrinfo(parsed_url, port)
+    # Get the IP addresses that this entry resolves to (uniquely)
+    # We drop:
+    #   AF_* family: It will resolve to AF_INET or AF_INET6, getaddrinfo(3) doesn't even mention AF_UNIX,
+    #   socktype: We don't care if a stream/dgram/raw protocol
+    #   protocol: we don't care if it is tcp or udp.
+    addrinfo_results = set([info[4][0] for info in addrinfo])
+    # There may be multiple (e.g. IPv4 + IPv6 or DNS round robin). Any one of these
+    # could resolve to a local addresses (and could be returned by chance),
+    # therefore we must check them all.
+    for raw_ip in addrinfo_results:
+        # Convert to an IP object so we can tell if it is in private space.
+        ip = ipaddress.ip_address(unicodify(raw_ip))
+        # If this is a private address
+        if ip.is_private:
+            results = []
+            # If this IP is not anywhere in the whitelist
+            for whitelisted in ip_whitelist:
+                # If it's an IP address range (rather than a single one...)
+                if hasattr(whitelisted, 'subnets'):
+                    results.append(ip in whitelisted)
+                else:
+                    results.append(ip == whitelisted)
+
+            if any(results):
+                # If we had any True, then THIS (and ONLY THIS) IP address that
+                # that specific DNS entry resolved to is in whitelisted and
+                # safe to access. But we cannot exit here, we must ensure that
+                # all IPs that that DNS entry resolves to are likewise safe.
+                pass
+            else:
+                # Otherwise, we deny access.
+                raise Exception("Access to this address in not permitted by server configuration")
+    return url
+
+
+def persist_uploads(params, trans):
     """
     Turn any uploads in the submitted form to persisted files.
     """
@@ -35,7 +124,10 @@ def persist_uploads(params):
             elif type(f) == dict and 'local_filename' not in f:
                 raise Exception('Uploaded file was encoded in a way not understood by Galaxy.')
             if upload_dataset['url_paste'] and upload_dataset['url_paste'].strip() != '':
-                upload_dataset['url_paste'], is_multi_byte = datatypes.sniff.stream_to_file(StringIO(upload_dataset['url_paste']), prefix="strio_url_paste_")
+                upload_dataset['url_paste'], is_multi_byte = datatypes.sniff.stream_to_file(
+                    StringIO(validate_url(upload_dataset['url_paste'], trans.app.config.fetch_url_whitelist_ips)),
+                    prefix="strio_url_paste_"
+                )
             else:
                 upload_dataset['url_paste'] = None
             new_files.append(upload_dataset)

lib/galaxy/webapps/galaxy/controllers/library_common.py

@@ -1096,7 +1096,7 @@ class LibraryCommon(BaseUIController, UsesFormDefinitionsMixin, UsesExtendedMeta
         if response_code == 200:
             precreated_datasets = upload_common.get_precreated_datasets(trans, tool_params, trans.app.model.LibraryDatasetDatasetAssociation, controller=cntrller)
             if upload_option == 'upload_file':
-                tool_params = upload_common.persist_uploads(tool_params)
+                tool_params = upload_common.persist_uploads(tool_params, trans)
                 uploaded_datasets = upload_common.get_uploaded_datasets(trans, cntrller, tool_params, precreated_datasets, dataset_upload_inputs, library_bunch=library_bunch)
             elif upload_option == 'upload_directory':
                 uploaded_datasets, response_code, message = self.get_server_dir_uploaded_datasets(trans, cntrller, kwd, full_dir, import_dir_desc, library_bunch, response_code, message)

static/maps/utils/uploadbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"uploadbox.js","sources":["../../src/utils/uploadbox.js"],"names":["$","jQuery","event","props","push","uploadpost","config","cnf","extend","data","success","error","progress","url","maxfilesize","error_filesize","error_default","error_server","error_login","error_message","form","FormData","key","payload","append","sizes","files","d","name","file","size","xhr","XMLHttpRequest","open","setRequestHeader","onreadystatechange","readyState","DONE","response","responseText","parseJSON","e","status","text","statusText","upload","addEventListener","lengthComputable","Math","round","loaded","total","Galaxy","emit","debug","send","fn","uploadinput","options","el","this","opts","ondragover","ondragleave","onchange","multiple","$input","change","target","val","on","dataTransfer","preventDefault","stopPropagation","dialog","trigger","uploadbox","add","length","queue_running","current_index","queue_index","_","each","mode","filter","queue","f","duplicate","index","String","announce","queue_length","remove","process","queue_stop","complete","initialize","message","percentage","select","reset","start","stop","configure","compatible","window","File","FileList","dragover","dragleave","m","alert"],"mappings":"CAGC,SAAUA,GAEPC,OAAOC,MAAMC,MAAMC,KAAK,gBAKxBJ,EAAEK,WAAa,SAAUC,GAErB,GAAIC,GAAMP,EAAEQ,WACRC,QACAC,QAAkB,aAClBC,MAAkB,aAClBC,SAAkB,aAClBC,IAAkB,KAClBC,YAAkB,KAClBC,eAAkB,6CAClBC,cAAkB,0CAClBC,aAAkB,yBAClBC,YAAkB,kCACnBZ,GAGCG,EAAOF,EAAIE,IAGf,IAAIA,EAAKU,cAEL,WADAZ,GAAII,MAAMF,EAAKU,cAKnB,IAAIC,GAAO,GAAIC,SACf,KAAK,GAAIC,KAAOb,GAAKc,QACjBH,EAAKI,OAAOF,EAAKb,EAAKc,QAAQD,GAIlC,IAAIG,GAAQ,CACZ,KAAK,GAAIH,KAAOb,GAAKiB,MAAO,CACxB,GAAIC,GAAIlB,EAAKiB,MAAMJ,EACnBF,GAAKI,OAAOG,EAAEC,KAAMD,EAAEE,KAAMF,EAAEE,KAAKD,MACnCH,GAASE,EAAEE,KAAKC,KAIpB,GAAIL,EAAQ,QAAUlB,EAAIO,YAEtB,WADAP,GAAII,MAAMJ,EAAIQ,eAKlB,IAAIgB,GAAM,GAAIC,eACdD,GAAIE,KAAK,OAAQ1B,EAAIM,KAAK,GAC1BkB,EAAIG,iBAAiB,SAAU,oBAC/BH,EAAIG,iBAAiB,gBAAiB,YACtCH,EAAIG,iBAAiB,mBAAoB,kBAGzCH,EAAII,mBAAqB,WAErB,GAAIJ,EAAIK,YAAcL,EAAIM,KAAM,CAE5B,GAAIC,GAAW,IACf,IAAIP,EAAIQ,aACJ,IACID,EAAWrC,OAAOuC,UAAUT,EAAIQ,cAClC,MAAOE,GACLH,EAAWP,EAAIQ,aAIvB,GAAIR,EAAIW,OAAS,KAAOX,EAAIW,OAAS,IAAK,CACtC,GAAIC,GAAOZ,EAAIa,UACG,MAAdb,EAAIW,OACJC,EAAOpC,EAAIW,YACU,GAAda,EAAIW,OACXC,EAAOpC,EAAIU,aACH0B,IACRA,EAAOpC,EAAIS,eAEfT,EAAII,MAAMgC,EAAO,KAAOZ,EAAIW,OAAS,SAErCnC,GAAIG,QAAQ4B,KAMxBP,EAAIc,OAAOC,iBAAiB,WAAY,SAASL,GACzCA,EAAEM,kBACFxC,EAAIK,SAASoC,KAAKC,MAAkB,IAAXR,EAAES,OAAgBT,EAAEU,UAElD,GAGHC,OAAOC,KAAKC,MAAM,0BAA2B,0BAA2B/C,GACxEwB,EAAIwB,KAAKnC,IAMbpB,EAAEwD,GAAGC,YAAc,SAASC,GAExB,GAAIC,GAAKC,KACLC,EAAO7D,EAAEQ,WACTsD,WAAc,aACdC,YAAc,aACdC,SAAc,aACdC,UAAc,GACfP,GAGCQ,EAASlE,EAAE,6CAA+C6D,EAAKI,UAAY,YAAc,IAAM,KAwBnG,OAvBAN,GAAGnC,OAAO0C,EAAOC,OAAO,SAAU1B,GAC9BoB,EAAKG,SAASvB,EAAE2B,OAAO1C,OACvB1B,EAAE4D,MAAMS,IAAI,OAIhBV,EAAGW,GAAG,OAAQ,SAAU7B,GACpBoB,EAAKE,YAAYtB,GACdA,EAAE8B,eACDV,EAAKG,SAASvB,EAAE8B,aAAa7C,OAC7Be,EAAE+B,oBAGVb,EAAGW,GAAG,WAAa,SAAU7B,GACzBA,EAAE+B,iBACFX,EAAKC,WAAWrB,KAEpBkB,EAAGW,GAAG,YAAa,SAAU7B,GACzBA,EAAEgC,kBACFZ,EAAKE,YAAYtB,MAKjBiC,OAAQ,WACJR,EAAOS,QAAQ,YAQ3B3E,EAAEwD,GAAGoB,UAAY,SAASlB,GAiCtB,QAASmB,GAAInD,GACT,GAAIA,GAASA,EAAMoD,SAAWC,EAAe,CACzC,GAAIC,GAAgBC,CAgBpB,OAfAC,GAAEC,KAAKzD,EAAO,SAASG,GACD,QAAdA,EAAKuD,MAAkBF,EAAEG,OAAOC,EAAO,SAASC,GAChD,MAAOA,GAAE3D,OAASC,EAAKD,MAAQ2D,EAAEzD,OAASD,EAAKC,OAChDgD,SACCjD,EAAK2D,WAAY,KAGzBN,EAAEC,KAAKzD,EAAO,SAASG,GACnB,IAAKA,EAAK2D,UAAW,CACjB,GAAIC,GAAQC,OAAOT,IACnBK,GAAMG,GAAS5D,EACfgC,EAAK8B,SAASF,EAAOH,EAAMG,IAC3BG,OAGDZ,GAKf,QAASa,GAAOJ,GACRH,EAAMG,WACCH,GAAMG,GACbG,KAKR,QAASE,KAEL,GAAoB,GAAhBF,GAAqBG,EAIrB,MAHAA,IAAa,EACbhB,GAAgB,MAChBlB,GAAKmC,UAGLjB,IAAgB,CAIpB,IAAIU,GAAQ,EACZ,KAAK,GAAInE,KAAOgE,GAAO,CACnBG,EAAQnE,CACR,OAIOgE,EAAMG,EAGjBI,GAAOJ,GAGPzF,EAAEK,YACEQ,IAAWgD,EAAKhD,IAChBJ,KAAWoD,EAAKoC,WAAWR,GAC3B/E,QAAW,SAASwF,GAAWrC,EAAKnD,QAAQ+E,EAAOS,GAAUJ,KAC7DnF,MAAW,SAASuF,GAAWrC,EAAKlD,MAAM8E,EAAOS,GAAUJ,KAC3DlF,SAAW,SAASuF,GAActC,EAAKjD,SAAS6E,EAAOU,MAS/D,QAASC,KACL3C,EAAYiB,SAIhB,QAAS2B,GAAMZ,GACX,IAAKA,IAASH,GACVO,EAAOJ,GAKf,QAASa,KACAvB,IACDA,GAAgB,EAChBe,KAKR,QAASS,KACLR,GAAa,EAIjB,QAASS,GAAU9C,GAEf,MADAG,GAAO7D,EAAEQ,UAAWqD,EAAMH,GAK9B,QAAS+C,KACL,MAAOC,QAAOC,MAAQD,OAAOrF,UAAYqF,OAAO1E,gBAAkB0E,OAAOE,SArI7E,GAAI/C,GAAO7D,EAAEQ,WACTqG,SAAkB,aAClBC,UAAkB,aAClBnB,SAAkB,aAClBM,WAAkB,aAClBrF,SAAkB,aAClBF,QAAkB,aAClBC,MAAkB,SAASgB,EAAGoF,GAAKC,MAAMD,IACzCf,SAAkB,cACnBtC,GAGC4B,KAGAL,EAAc,EACdW,EAAe,EAGfb,GAAgB,EAChBgB,GAAa,EAGbtC,EAAczD,EAAE4D,MAAMH,aACtBQ,UAAc,EACdD,SAAc,SAAStC,GAASmD,EAAInD,IACpCoC,WAAcJ,EAAQI,WACtBC,YAAcL,EAAQK,aA8G1B,QACIqC,OAAkBA,EAClBvB,IAAkBA,EAClBgB,OAAkBA,EAClBS,MAAkBA,EAClBC,KAAkBA,EAClBF,MAAkBA,EAClBG,UAAkBA,EAClBC,WAAkBA,KAG3BxG"}
+{"version":3,"file":"uploadbox.js","sources":["../../src/utils/uploadbox.js"],"names":["$","jQuery","event","props","push","uploadpost","config","cnf","extend","data","success","error","progress","url","maxfilesize","error_filesize","error_default","error_server","error_login","error_message","form","FormData","key","payload","append","sizes","files","d","name","file","size","xhr","XMLHttpRequest","open","setRequestHeader","onreadystatechange","readyState","DONE","response","extra_info","responseText","parseJSON","err_msg","e","status","text","statusText","upload","addEventListener","lengthComputable","Math","round","loaded","total","Galaxy","emit","debug","send","fn","uploadinput","options","el","this","opts","ondragover","ondragleave","onchange","multiple","$input","change","target","val","on","dataTransfer","preventDefault","stopPropagation","dialog","trigger","uploadbox","add","length","queue_running","current_index","queue_index","_","each","mode","filter","queue","f","duplicate","index","String","announce","queue_length","remove","process","queue_stop","complete","initialize","message","percentage","select","reset","start","stop","configure","compatible","window","File","FileList","dragover","dragleave","m","alert"],"mappings":"CAGC,SAAUA,GAEPC,OAAOC,MAAMC,MAAMC,KAAK,gBAKxBJ,EAAEK,WAAa,SAAUC,GAErB,GAAIC,GAAMP,EAAEQ,WACRC,QACAC,QAAkB,aAClBC,MAAkB,aAClBC,SAAkB,aAClBC,IAAkB,KAClBC,YAAkB,KAClBC,eAAkB,6CAClBC,cAAkB,0CAClBC,aAAkB,yBAClBC,YAAkB,kCACnBZ,GAGCG,EAAOF,EAAIE,IAGf,IAAIA,EAAKU,cAEL,WADAZ,GAAII,MAAMF,EAAKU,cAKnB,IAAIC,GAAO,GAAIC,SACf,KAAK,GAAIC,KAAOb,GAAKc,QACjBH,EAAKI,OAAOF,EAAKb,EAAKc,QAAQD,GAIlC,IAAIG,GAAQ,CACZ,KAAK,GAAIH,KAAOb,GAAKiB,MAAO,CACxB,GAAIC,GAAIlB,EAAKiB,MAAMJ,EACnBF,GAAKI,OAAOG,EAAEC,KAAMD,EAAEE,KAAMF,EAAEE,KAAKD,MACnCH,GAASE,EAAEE,KAAKC,KAIpB,GAAIL,EAAQ,QAAUlB,EAAIO,YAEtB,WADAP,GAAII,MAAMJ,EAAIQ,eAKlB,IAAIgB,GAAM,GAAIC,eACdD,GAAIE,KAAK,OAAQ1B,EAAIM,KAAK,GAC1BkB,EAAIG,iBAAiB,SAAU,oBAC/BH,EAAIG,iBAAiB,gBAAiB,YACtCH,EAAIG,iBAAiB,mBAAoB,kBAGzCH,EAAII,mBAAqB,WAErB,GAAIJ,EAAIK,YAAcL,EAAIM,KAAM,CAE5B,GAAIC,GAAW,KACXC,EAAa,EACjB,IAAIR,EAAIS,aACJ,IACIF,EAAWrC,OAAOwC,UAAUV,EAAIS,cAChCD,EAAaD,EAASI,QACxB,MAAOC,GACLL,EAAWP,EAAIS,aACfD,EAAaD,EAIrB,GAAIP,EAAIa,OAAS,KAAOb,EAAIa,OAAS,IAAK,CACtC,GAAIC,GAAOd,EAAIe,UACG,MAAdf,EAAIa,OACJC,EAAOtC,EAAIW,YACU,GAAda,EAAIa,OACXC,EAAOtC,EAAIU,aACH4B,IACRA,EAAOtC,EAAIS,eAEfT,EAAII,MAAMkC,EAAO,KAAOd,EAAIa,OAAS,MAAQL,OAE7ChC,GAAIG,QAAQ4B,KAMxBP,EAAIgB,OAAOC,iBAAiB,WAAY,SAASL,GACzCA,EAAEM,kBACF1C,EAAIK,SAASsC,KAAKC,MAAkB,IAAXR,EAAES,OAAgBT,EAAEU,UAElD,GAGHC,OAAOC,KAAKC,MAAM,0BAA2B,0BAA2BjD,GACxEwB,EAAI0B,KAAKrC,IAMbpB,EAAE0D,GAAGC,YAAc,SAASC,GAExB,GAAIC,GAAKC,KACLC,EAAO/D,EAAEQ,WACTwD,WAAc,aACdC,YAAc,aACdC,SAAc,aACdC,UAAc,GACfP,GAGCQ,EAASpE,EAAE,6CAA+C+D,EAAKI,UAAY,YAAc,IAAM,KAwBnG,OAvBAN,GAAGrC,OAAO4C,EAAOC,OAAO,SAAU1B,GAC9BoB,EAAKG,SAASvB,EAAE2B,OAAO5C,OACvB1B,EAAE8D,MAAMS,IAAI,OAIhBV,EAAGW,GAAG,OAAQ,SAAU7B,GACpBoB,EAAKE,YAAYtB,GACdA,EAAE8B,eACDV,EAAKG,SAASvB,EAAE8B,aAAa/C,OAC7BiB,EAAE+B,oBAGVb,EAAGW,GAAG,WAAa,SAAU7B,GACzBA,EAAE+B,iBACFX,EAAKC,WAAWrB,KAEpBkB,EAAGW,GAAG,YAAa,SAAU7B,GACzBA,EAAEgC,kBACFZ,EAAKE,YAAYtB,MAKjBiC,OAAQ,WACJR,EAAOS,QAAQ,YAQ3B7E,EAAE0D,GAAGoB,UAAY,SAASlB,GAiCtB,QAASmB,GAAIrD,GACT,GAAIA,GAASA,EAAMsD,SAAWC,EAAe,CACzC,GAAIC,GAAgBC,CAgBpB,OAfAC,GAAEC,KAAK3D,EAAO,SAASG,GACD,QAAdA,EAAKyD,MAAkBF,EAAEG,OAAOC,EAAO,SAASC,GAChD,MAAOA,GAAE7D,OAASC,EAAKD,MAAQ6D,EAAE3D,OAASD,EAAKC,OAChDkD,SACCnD,EAAK6D,WAAY,KAGzBN,EAAEC,KAAK3D,EAAO,SAASG,GACnB,IAAKA,EAAK6D,UAAW,CACjB,GAAIC,GAAQC,OAAOT,IACnBK,GAAMG,GAAS9D,EACfkC,EAAK8B,SAASF,EAAOH,EAAMG,IAC3BG,OAGDZ,GAKf,QAASa,GAAOJ,GACRH,EAAMG,WACCH,GAAMG,GACbG,KAKR,QAASE,KAEL,GAAoB,GAAhBF,GAAqBG,EAIrB,MAHAA,IAAa,EACbhB,GAAgB,MAChBlB,GAAKmC,UAGLjB,IAAgB,CAIpB,IAAIU,GAAQ,EACZ,KAAK,GAAIrE,KAAOkE,GAAO,CACnBG,EAAQrE,CACR,OAIOkE,EAAMG,EAGjBI,GAAOJ,GAGP3F,EAAEK,YACEQ,IAAWkD,EAAKlD,IAChBJ,KAAWsD,EAAKoC,WAAWR,GAC3BjF,QAAW,SAAS0F,GAAWrC,EAAKrD,QAAQiF,EAAOS,GAAUJ,KAC7DrF,MAAW,SAASyF,GAAWrC,EAAKpD,MAAMgF,EAAOS,GAAUJ,KAC3DpF,SAAW,SAASyF,GAActC,EAAKnD,SAAS+E,EAAOU,MAS/D,QAASC,KACL3C,EAAYiB,SAIhB,QAAS2B,GAAMZ,GACX,IAAKA,IAASH,GACVO,EAAOJ,GAKf,QAASa,KACAvB,IACDA,GAAgB,EAChBe,KAKR,QAASS,KACLR,GAAa,EAIjB,QAASS,GAAU9C,GAEf,MADAG,GAAO/D,EAAEQ,UAAWuD,EAAMH,GAK9B,QAAS+C,KACL,MAAOC,QAAOC,MAAQD,OAAOvF,UAAYuF,OAAO5E,gBAAkB4E,OAAOE,SArI7E,GAAI/C,GAAO/D,EAAEQ,WACTuG,SAAkB,aAClBC,UAAkB,aAClBnB,SAAkB,aAClBM,WAAkB,aAClBvF,SAAkB,aAClBF,QAAkB,aAClBC,MAAkB,SAASgB,EAAGsF,GAAKC,MAAMD,IACzCf,SAAkB,cACnBtC,GAGC4B,KAGAL,EAAc,EACdW,EAAe,EAGfb,GAAgB,EAChBgB,GAAa,EAGbtC,EAAc3D,EAAE8D,MAAMH,aACtBQ,UAAc,EACdD,SAAc,SAASxC,GAASqD,EAAIrD,IACpCsC,WAAcJ,EAAQI,WACtBC,YAAcL,EAAQK,aA8G1B,QACIqC,OAAkBA,EAClBvB,IAAkBA,EAClBgB,OAAkBA,EAClBS,MAAkBA,EAClBC,KAAkBA,EAClBF,MAAkBA,EAClBG,UAAkBA,EAClBC,WAAkBA,KAG3B1G"}

static/scripts/utils/uploadbox.js

@@ -1,2 +1,2 @@
-!function(a){jQuery.event.props.push("dataTransfer"),a.uploadpost=function(b){var c=a.extend({},{data:{},success:function(){},error:function(){},progress:function(){},url:null,maxfilesize:2048,error_filesize:"File exceeds 2GB. Please use a FTP client.",error_default:"Please make sure the file is available.",error_server:"Upload request failed.",error_login:"Uploads require you to log in."},b),d=c.data;if(d.error_message)return void c.error(d.error_message);var e=new FormData;for(var f in d.payload)e.append(f,d.payload[f]);var g=0;for(var f in d.files){var h=d.files[f];e.append(h.name,h.file,h.file.name),g+=h.file.size}if(g>1048576*c.maxfilesize)return void c.error(c.error_filesize);var i=new XMLHttpRequest;i.open("POST",c.url,!0),i.setRequestHeader("Accept","application/json"),i.setRequestHeader("Cache-Control","no-cache"),i.setRequestHeader("X-Requested-With","XMLHttpRequest"),i.onreadystatechange=function(){if(i.readyState==i.DONE){var a=null;if(i.responseText)try{a=jQuery.parseJSON(i.responseText)}catch(b){a=i.responseText}if(i.status<200||i.status>299){var d=i.statusText;403==i.status?d=c.error_login:0==i.status?d=c.error_server:d||(d=c.error_default),c.error(d+" ("+i.status+")")}else c.success(a)}},i.upload.addEventListener("progress",function(a){a.lengthComputable&&c.progress(Math.round(100*a.loaded/a.total))},!1),Galaxy.emit.debug("uploadbox::uploadpost()","Posting following data.",c),i.send(e)},a.fn.uploadinput=function(b){var c=this,d=a.extend({},{ondragover:function(){},ondragleave:function(){},onchange:function(){},multiple:!1},b),e=a('<input type="file" style="display: none" '+(d.multiple&&"multiple"||"")+"/>");return c.append(e.change(function(b){d.onchange(b.target.files),a(this).val("")})),c.on("drop",function(a){d.ondragleave(a),a.dataTransfer&&(d.onchange(a.dataTransfer.files),a.preventDefault())}),c.on("dragover",function(a){a.preventDefault(),d.ondragover(a)}),c.on("dragleave",function(a){a.stopPropagation(),d.ondragleave(a)}),{dialog:function(){e.trigger("click")}}},a.fn.uploadbox=function(b){function c(a){if(a&&a.length&&!p){var b=n;return _.each(a,function(a){"new"!==a.mode&&_.filter(m,function(b){return b.name===a.name&&b.size===a.size}).length&&(a.duplicate=!0)}),_.each(a,function(a){if(!a.duplicate){var b=String(n++);m[b]=a,l.announce(b,m[b]),o++}}),b}}function d(a){m[a]&&(delete m[a],o--)}function e(){if(0==o||q)return q=!1,p=!1,void l.complete();p=!0;var b=-1;for(var c in m){b=c;break}m[b];d(b),a.uploadpost({url:l.url,data:l.initialize(b),success:function(a){l.success(b,a),e()},error:function(a){l.error(b,a),e()},progress:function(a){l.progress(b,a)}})}function f(){r.dialog()}function g(a){for(a in m)d(a)}function h(){p||(p=!0,e())}function i(){q=!0}function j(b){return l=a.extend({},l,b)}function k(){return window.File&&window.FormData&&window.XMLHttpRequest&&window.FileList}var l=a.extend({},{dragover:function(){},dragleave:function(){},announce:function(){},initialize:function(){},progress:function(){},success:function(){},error:function(a,b){alert(b)},complete:function(){}},b),m={},n=0,o=0,p=!1,q=!1,r=a(this).uploadinput({multiple:!0,onchange:function(a){c(a)},ondragover:b.ondragover,ondragleave:b.ondragleave});return{select:f,add:c,remove:d,start:h,stop:i,reset:g,configure:j,compatible:k}}}(jQuery);
+!function(a){jQuery.event.props.push("dataTransfer"),a.uploadpost=function(b){var c=a.extend({},{data:{},success:function(){},error:function(){},progress:function(){},url:null,maxfilesize:2048,error_filesize:"File exceeds 2GB. Please use a FTP client.",error_default:"Please make sure the file is available.",error_server:"Upload request failed.",error_login:"Uploads require you to log in."},b),d=c.data;if(d.error_message)return void c.error(d.error_message);var e=new FormData;for(var f in d.payload)e.append(f,d.payload[f]);var g=0;for(var f in d.files){var h=d.files[f];e.append(h.name,h.file,h.file.name),g+=h.file.size}if(g>1048576*c.maxfilesize)return void c.error(c.error_filesize);var i=new XMLHttpRequest;i.open("POST",c.url,!0),i.setRequestHeader("Accept","application/json"),i.setRequestHeader("Cache-Control","no-cache"),i.setRequestHeader("X-Requested-With","XMLHttpRequest"),i.onreadystatechange=function(){if(i.readyState==i.DONE){var a=null,b="";if(i.responseText)try{a=jQuery.parseJSON(i.responseText),b=a.err_msg}catch(d){a=i.responseText,b=a}if(i.status<200||i.status>299){var e=i.statusText;403==i.status?e=c.error_login:0==i.status?e=c.error_server:e||(e=c.error_default),c.error(e+" ("+i.status+"). "+b)}else c.success(a)}},i.upload.addEventListener("progress",function(a){a.lengthComputable&&c.progress(Math.round(100*a.loaded/a.total))},!1),Galaxy.emit.debug("uploadbox::uploadpost()","Posting following data.",c),i.send(e)},a.fn.uploadinput=function(b){var c=this,d=a.extend({},{ondragover:function(){},ondragleave:function(){},onchange:function(){},multiple:!1},b),e=a('<input type="file" style="display: none" '+(d.multiple&&"multiple"||"")+"/>");return c.append(e.change(function(b){d.onchange(b.target.files),a(this).val("")})),c.on("drop",function(a){d.ondragleave(a),a.dataTransfer&&(d.onchange(a.dataTransfer.files),a.preventDefault())}),c.on("dragover",function(a){a.preventDefault(),d.ondragover(a)}),c.on("dragleave",function(a){a.stopPropagation(),d.ondragleave(a)}),{dialog:function(){e.trigger("click")}}},a.fn.uploadbox=function(b){function c(a){if(a&&a.length&&!p){var b=n;return _.each(a,function(a){"new"!==a.mode&&_.filter(m,function(b){return b.name===a.name&&b.size===a.size}).length&&(a.duplicate=!0)}),_.each(a,function(a){if(!a.duplicate){var b=String(n++);m[b]=a,l.announce(b,m[b]),o++}}),b}}function d(a){m[a]&&(delete m[a],o--)}function e(){if(0==o||q)return q=!1,p=!1,void l.complete();p=!0;var b=-1;for(var c in m){b=c;break}m[b];d(b),a.uploadpost({url:l.url,data:l.initialize(b),success:function(a){l.success(b,a),e()},error:function(a){l.error(b,a),e()},progress:function(a){l.progress(b,a)}})}function f(){r.dialog()}function g(a){for(a in m)d(a)}function h(){p||(p=!0,e())}function i(){q=!0}function j(b){return l=a.extend({},l,b)}function k(){return window.File&&window.FormData&&window.XMLHttpRequest&&window.FileList}var l=a.extend({},{dragover:function(){},dragleave:function(){},announce:function(){},initialize:function(){},progress:function(){},success:function(){},error:function(a,b){alert(b)},complete:function(){}},b),m={},n=0,o=0,p=!1,q=!1,r=a(this).uploadinput({multiple:!0,onchange:function(a){c(a)},ondragover:b.ondragover,ondragleave:b.ondragleave});return{select:f,add:c,remove:d,start:h,stop:i,reset:g,configure:j,compatible:k}}}(jQuery);
 //# sourceMappingURL=../../maps/utils/uploadbox.js.map

test/integration/test_upload_configuration_options.py

@@ -127,3 +127,15 @@ class AutoDecompressTestCase(BaseCheckUploadContentConfigurationTestCase):
         )
         dataset = self.dataset_populator.get_history_dataset_details(self.history_id, dataset=dataset)
         assert dataset["file_ext"] == "sam", dataset
+
+
+class LocalAddressWhitelisting(BaseCheckUploadContentConfigurationTestCase):
+
+    def test_external_url(self):
+        payload = self.dataset_populator.upload_payload(
+            self.history_id, 'http://localhost/', ext="txt"
+        )
+        create_response = self._post("tools", data=payload)
+        # Ideally this would be 403 but the tool API endpoint isn't using
+        # the newer API decorator that handles those details.
+        assert create_response.status_code >= 400