From a0c824942e37c970c732d75f98a9c1c69f5c7a6c Mon Sep 17 00:00:00 2001
From: Dave Bouvier <dave@bx.psu.edu>
Date: Wed, 9 Dec 2020 16:25:09 -0500
Subject: [PATCH] First pass at modifying the tool HTML allow list

- Enable partial matches for owner, repository, or tool ID
- Add API endpoints to GET, PUT, and DELETE list entries
- Partially vuefy client components
- Implement client-side interface with GET endpoint

TODO: Implement interface with PUT and DELETE endpoints.
---
 client/src/components/admin/Home.vue          |  7 ++
 client/src/components/admin/SanitizeAllow.vue | 65 ++++++++++++++++++
 .../components/admin/SanitizeAllowGrid.vue    | 48 ++++++++++++++
 client/src/entry/admin/AdminRouter.js         |  6 ++
 lib/galaxy/config/__init__.py                 | 10 ++-
 lib/galaxy/datatypes/data.py                  |  2 +-
 .../webapps/galaxy/api/sanitize_allowlist.py  | 66 +++++++++++++++++++
 lib/galaxy/webapps/galaxy/buildapp.py         |  5 ++
 .../webapps/galaxy/controllers/admin.py       | 20 ------
 .../galaxy/admin/sanitize_allowlist.mako      | 59 -----------------
 10 files changed, 202 insertions(+), 86 deletions(-)
 create mode 100755 client/src/components/admin/SanitizeAllow.vue
 create mode 100755 client/src/components/admin/SanitizeAllowGrid.vue
 create mode 100755 lib/galaxy/webapps/galaxy/api/sanitize_allowlist.py
 delete mode 100644 templates/webapps/galaxy/admin/sanitize_allowlist.mako

diff --git a/client/src/components/admin/Home.vue b/client/src/components/admin/Home.vue
index eb96e955ff0..8f9f18e4384 100644
--- a/client/src/components/admin/Home.vue
+++ b/client/src/components/admin/Home.vue
@@ -84,6 +84,12 @@
 
         <h4>Tool Management</h4>
         <ul>
+            <li>
+                <strong>
+                    <a @click.prevent="useRouter" :href="adminSanitizeAllowUrl">Manage Allowlist</a>
+                </strong>
+                - Manage HTML rendering for installed tools' output datasets.
+            </li>
             <li v-if="isToolShedInstalled">
                 <strong>
                     <a @click.prevent="useRouter" :href="adminToolshedUrl">Install and Uninstall</a>
@@ -150,6 +156,7 @@ export default {
         adminQuotasUrl: () => `${root}admin/quotas`,
         adminGroupsUrl: () => `${root}admin/groups`,
         adminRolesUrl: () => `${root}admin/roles`,
+        adminSanitizeAllowUrl: () => `${root}admin/sanitize_allow`,
         adminFormsUrl: () => `${root}admin/forms`,
         adminToolshedUrl: () => `${root}admin/toolshed`,
         adminToolVersionsUrl: () => `${root}admin/tool_versions`,
diff --git a/client/src/components/admin/SanitizeAllow.vue b/client/src/components/admin/SanitizeAllow.vue
new file mode 100755
index 00000000000..1e2f617a8a1
--- /dev/null
+++ b/client/src/components/admin/SanitizeAllow.vue
@@ -0,0 +1,65 @@
+<template>
+    <div>
+        <message :message="message" :status="status"></message>
+        <component
+            :is="currentView"
+            v-if="status !== 'error'"
+            v-bind="currentProps"
+        >
+        </component>
+    </div>
+</template>
+
+<script>
+import { getAppRoot } from "onload/loadConfig";
+import axios from "axios";
+import Message from "../Message.vue";
+import SanitizeAllowGrid from "./SanitizeAllowGrid.vue";
+
+export default {
+    data() {
+        return {
+            currentView: "sanitize-allow-grid",
+            isLoaded: false,
+            allowList: [],
+            message: "",
+            status: "",
+        };
+    },
+
+    components: {
+        message: Message,
+        "sanitize-allow-grid": SanitizeAllowGrid,
+    },
+
+    computed: {
+        currentProps() {
+            let props;
+
+            if (this.currentView === "sanitize-allow-grid") {
+                props = {
+                    isLoaded: this.isLoaded,
+                    rows: this.allowList,
+                };
+            }
+            console.log(props);
+
+            return props;
+        },
+    },
+
+    created() {
+        axios
+            .get(`${getAppRoot()}api/sanitize_allowlist`)
+            .then((response) => {
+                this.isLoaded = true;
+                this.allowList = response.data.data;
+                this.message = response.data.message;
+                this.status = response.data.status;
+            })
+            .catch((error) => {
+                console.error(error);
+            });
+    },
+};
+</script>
diff --git a/client/src/components/admin/SanitizeAllowGrid.vue b/client/src/components/admin/SanitizeAllowGrid.vue
new file mode 100755
index 00000000000..61211573e6f
--- /dev/null
+++ b/client/src/components/admin/SanitizeAllowGrid.vue
@@ -0,0 +1,48 @@
+<template>
+    <base-grid :is-loaded="isLoaded" :columns="columns" id="sanitize-allow-grid">
+        <template v-slot:title> Tool Sanitization Allowlist </template>
+        <template v-slot:rows>
+            <template v-for="(row, index) in rows">
+                <tr :key="row.tool_id" :class="[index % 2 === 0 ? 'tr' : 'odd_row']">
+                    <td>{{ row.tool_name }}</td>
+                    <td>{{ row.tool_id }}</td>
+                    <td>{{ row.allowed }}</td>
+                    <td>{{ row.toolshed }}</td>
+                </tr>
+            </template>
+        </template>
+    </base-grid>
+</template>
+
+<script>
+import BaseGrid from "./BaseGrid.vue";
+
+export default {
+    props: {
+        isLoaded: {
+            type: Boolean,
+            required: true,
+        },
+        rows: {
+            type: Array,
+            required: true,
+        },
+    },
+
+    data() {
+        return {
+            columns: [
+                { text: "Tool Name", dataIndex: "tool_name" },
+                { text: "Tool ID", dataIndex: "tool_id" },
+                { text: "Allowed", dataIndex: "allowed" },
+                { text: "Tool Type", dataIndex: "tool_type" },
+            ],
+        };
+    },
+
+    components: {
+        "base-grid": BaseGrid,
+    },
+
+};
+</script>
diff --git a/client/src/entry/admin/AdminRouter.js b/client/src/entry/admin/AdminRouter.js
index 62a8147de41..02f05d11137 100644
--- a/client/src/entry/admin/AdminRouter.js
+++ b/client/src/entry/admin/AdminRouter.js
@@ -7,6 +7,7 @@ import QueryStringParsing from "utils/query-string-parsing";
 import Router from "layout/router";
 import DataTables from "components/admin/DataTables.vue";
 import DataTypes from "components/admin/DataTypes.vue";
+import SanitizeAllow from "components/admin/SanitizeAllow.vue";
 import Jobs from "components/admin/Jobs.vue";
 import ActiveInvocations from "components/admin/ActiveInvocations.vue";
 import Landing from "components/admin/Dependencies/Landing.vue";
@@ -40,6 +41,7 @@ export const getAdminRouter = (Galaxy, options) => {
             "(/)admin/data_types": "show_data_types",
             "(/)admin/jobs": "show_jobs",
             "(/)admin/invocations": "show_invocations",
+            "(/)admin/sanitize_allow": "show_sanitize_allow",
             "(/)admin/toolbox_dependencies": "show_toolbox_dependencies",
             "(/)admin/data_manager*path": "show_data_manager",
             "(/)admin(/)reset_metadata": "show_reset_metadata",
@@ -128,6 +130,10 @@ export const getAdminRouter = (Galaxy, options) => {
             this._display_vue_helper(ActiveInvocations);
         },
 
+        show_sanitize_allow: function () {
+            this._display_vue_helper(SanitizeAllow);
+        },
+
         show_toolbox_dependencies: function () {
             this._display_vue_helper(Landing);
         },
diff --git a/lib/galaxy/config/__init__.py b/lib/galaxy/config/__init__.py
index 0eb7403b1ae..6b9a39e661e 100644
--- a/lib/galaxy/config/__init__.py
+++ b/lib/galaxy/config/__init__.py
@@ -957,14 +957,12 @@ class GalaxyAppConfiguration(BaseAppConfiguration, CommonConfigurationMixin):
 
     def reload_sanitize_allowlist(self, explicit=True):
         self.sanitize_allowlist = []
-        try:
-            with open(self.sanitize_allowlist_file) as f:
-                for line in f.readlines():
-                    if not line.startswith("#"):
-                        self.sanitize_allowlist.append(line.strip())
-        except OSError:
+        if not os.path.exists(self.sanitize_allowlist_file):
             if explicit:
                 log.warning("Sanitize log file explicitly specified as '%s' but does not exist, continuing with no tools allowlisted.", self.sanitize_allowlist_file)
+        else:
+            with open(self.sanitize_allowlist_file) as f:
+                self.sanitize_allowlist = [line.strip() for line in f.readlines() if not line.startswith('#')]
 
     def ensure_tempdir(self):
         self._ensure_directory(self.new_file_path)
diff --git a/lib/galaxy/datatypes/data.py b/lib/galaxy/datatypes/data.py
index b3924e2762b..0693e9d14ba 100644
--- a/lib/galaxy/datatypes/data.py
+++ b/lib/galaxy/datatypes/data.py
@@ -460,7 +460,7 @@ class Data(metaclass=DataMeta):
             # Sanitize anytime we respond with plain text/html content.
             # Check to see if this dataset's parent job is allowlisted
             # We cannot currently trust imported datasets for rendering.
-            if not from_dataset.creating_job.imported and from_dataset.creating_job.tool_id in trans.app.config.sanitize_allowlist:
+            if not from_dataset.creating_job.imported and from_dataset.creating_job.tool_id.startswith(tuple(trans.app.config.sanitize_allowlist)):
                 return open(filename, mode='rb')
 
             # This is returning to the browser, it needs to be encoded.
diff --git a/lib/galaxy/webapps/galaxy/api/sanitize_allowlist.py b/lib/galaxy/webapps/galaxy/api/sanitize_allowlist.py
new file mode 100755
index 00000000000..3eb93aa91c9
--- /dev/null
+++ b/lib/galaxy/webapps/galaxy/api/sanitize_allowlist.py
@@ -0,0 +1,66 @@
+"""
+API operations allowing clients to retrieve and modify the HTML sanitization allow list.
+"""
+import logging
+
+from galaxy.datatypes.data import Data
+from galaxy.util import asbool
+from galaxy import web
+from galaxy.webapps.base.controller import BaseAPIController
+
+log = logging.getLogger(__name__)
+
+
+class SanitizeAllowlistController(BaseAPIController):
+
+    @web.require_admin
+    @web.legacy_expose_api
+    def index(self, trans, **kwd):
+        """
+        GET /api/sanitize_allowlist
+        Return an object showing the current state of the toolbox and allow list.
+        """
+        allowlist = []
+        tool_name = None
+        for tool_id in trans.app.config.sanitize_allowlist:
+            for toolbox_id in trans.app.toolbox.tools_by_id:
+                tool = trans.app.toolbox.tools_by_id[toolbox_id]
+                if toolbox_id.startswith(tool_id):
+                    tool_name = tool.name
+                    break
+            sanitize_tuple = dict(tool_name=tool.name, tool_id=tool_id, allowed=True, toolshed='/' in tool_id)
+            allowlist.append(sanitize_tuple)
+        for tool_id in sorted(trans.app.toolbox.tools_by_id):
+            tool = trans.app.toolbox.tools_by_id[tool_id]
+            if not tool_id.startswith(tuple(trans.app.config.sanitize_allowlist)):
+                tool_status = dict(tool_name=tool.name, tool_id=tool_id, allowed=False, toolshed='/' in tool_id)
+                allowlist.append(tool_status)
+        return {'status': 'done', 'message': 'Tool allow list loaded.', 'data': allowlist}
+
+    @web.require_admin
+    @web.legacy_expose_api
+    def create(self, trans, tool_id, **kwd):
+        """
+        POST /api/sanitize_allowlist
+        Add a new tool specification to the allow list.
+        """
+        if tool_id not in trans.app.config.sanitize_allowlist:
+            trans.app.config.sanitize_allowlist.append(tool_id)
+            self._save_allowlist(trans)
+
+    @web.require_admin
+    @web.legacy_expose_api
+    def delete(self, trans, tool_id, **kwd):
+        """
+        DELETE /api/sanitize_allowlist
+        Add a new tool specification to the allow list.
+        """
+        if tool_id in trans.app.config.sanitize_allowlist:
+            trans.app.config.sanitize_allowlist.remove(tool_id)
+            self._save_allowlist(trans)
+
+    def _save_allowlist(self, trans):
+        new_allowlist = sorted([tid for tid in trans.app.config.sanitize_allowlist])
+        trans.app.config.sanitize_allowlist = new_allowlist
+        with open(trans.app.config.sanitize_allowlist_file, 'wt') as f:
+            f.write("\n".join(new_allowlist))
diff --git a/lib/galaxy/webapps/galaxy/buildapp.py b/lib/galaxy/webapps/galaxy/buildapp.py
index 7fbe248c66d..e89cf72aa1d 100644
--- a/lib/galaxy/webapps/galaxy/buildapp.py
+++ b/lib/galaxy/webapps/galaxy/buildapp.py
@@ -143,6 +143,7 @@ def app_pair(global_conf, load_app_kwds=None, wsgi_preflight=True, **kwargs):
     webapp.add_client_route('/admin/forms', 'admin')
     webapp.add_client_route('/admin/groups', 'admin')
     webapp.add_client_route('/admin/repositories', 'admin')
+    webapp.add_client_route('/admin/sanitize_allowlist', 'admin')
     webapp.add_client_route('/admin/tool_versions', 'admin')
     webapp.add_client_route('/admin/toolshed', 'admin')
     webapp.add_client_route('/admin/quotas', 'admin')
@@ -429,6 +430,10 @@ def populate_api_routes(webapp, app):
     webapp.mapper.resource('tool', 'tools', path_prefix='/api')
     webapp.mapper.resource('dynamic_tools', 'dynamic_tools', path_prefix='/api')
 
+    webapp.mapper.connect('/api/sanitize_allowlist', action='index', controller='sanitize_allowlist', conditions=dict(method=["GET"]))
+    webapp.mapper.connect('/api/sanitize_allowlist', action='create', controller='sanitize_allowlist', conditions=dict(method=["PUT"]))
+    webapp.mapper.connect('/api/sanitize_allowlist', action='delete', controller='sanitize_allowlist', conditions=dict(method=["DELETE"]))
+
     webapp.mapper.connect('/api/entry_points', action='index', controller="tool_entry_points")
     webapp.mapper.connect('/api/entry_points/{id:.+?}/access', action='access_entry_point', controller="tool_entry_points")
     webapp.mapper.connect('/api/entry_points/{id:.+?}', action='stop_entry_point', controller="tool_entry_points", conditions={'method': ['DELETE']})
diff --git a/lib/galaxy/webapps/galaxy/controllers/admin.py b/lib/galaxy/webapps/galaxy/controllers/admin.py
index 53545bd9446..151c56f52db 100644
--- a/lib/galaxy/webapps/galaxy/controllers/admin.py
+++ b/lib/galaxy/webapps/galaxy/controllers/admin.py
@@ -1554,26 +1554,6 @@ class AdminGalaxy(controller.JSAppLauncher, AdminActions, UsesQuotaMixin, QuotaP
                                    unused_environments=view.unused_dependency_paths,
                                    viewkey=viewkey)
 
-    @web.expose
-    @web.require_admin
-    def sanitize_allowlist(self, trans, submit_allowlist=False, tools_to_allowlist=None):
-        tools_to_allowlist = tools_to_allowlist or []
-        if submit_allowlist:
-            # write the configured sanitize_allowlist_file with new allowlist
-            # and update in-memory list.
-            with open(trans.app.config.sanitize_allowlist_file, 'wt') as f:
-                if isinstance(tools_to_allowlist, str):
-                    tools_to_allowlist = [tools_to_allowlist]
-                new_allowlist = sorted([tid for tid in tools_to_allowlist if tid in trans.app.toolbox.tools_by_id])
-                f.write("\n".join(new_allowlist))
-            trans.app.config.sanitize_allowlist = new_allowlist
-            trans.app.queue_worker.send_control_task('reload_sanitize_allowlist', noop_self=True)
-            # dispatch a message to reload list for other processes
-        return trans.fill_template('/webapps/galaxy/admin/sanitize_allowlist.mako',
-                                   sanitize_all=trans.app.config.sanitize_all_html,
-                                   tools=trans.app.toolbox.tools_by_id)
-
-
 # ---- Utility methods -------------------------------------------------------
 
 def build_select_input(name, label, options, value):
diff --git a/templates/webapps/galaxy/admin/sanitize_allowlist.mako b/templates/webapps/galaxy/admin/sanitize_allowlist.mako
deleted file mode 100644
index 170fecd0938..00000000000
--- a/templates/webapps/galaxy/admin/sanitize_allowlist.mako
+++ /dev/null
@@ -1,59 +0,0 @@
-<%inherit file="/base.mako"/>
-<%namespace file="/message.mako" import="render_msg" />
-
-%if message:
-    ${render_msg( message, status )}
-%endif
-
-%if not sanitize_all:
-    <div><p>You currently have <strong>sanitize_all_html</strong> set to False
-    in your galaxy configuration file.  This prevents Galaxy from sanitizing
-    tool outputs, which is an important security feature.  For improved
-    security, we recommend you disable the old-style blanket sanitization and
-    manage it via this allowlist instead.</p></div>
-%else:
-    <div><p>This interface will allow you to mark particular tools as 'trusted'
-    after which Galaxy will no longer attempt to sanitize any HTML contents of
-    datasets created by these tools upon display.  Please be aware of the
-    potential security implications of doing this -- bypassing sanitization
-    using this allowlist disables Galaxy's security feature (for the indicated
-    tools) that prevents Galaxy from displaying potentially malicious
-    Javascript.<br/>
-    Note that datasets originating from an archive import are still sanitized
-    even when their creating tool is allowlisted since it isn't possible to
-    validate the information supplied in the archive.</p></div>
-    <form name="sanitize_allowlist" method="post" action="${h.url_for( controller='admin', action='sanitize_allowlist' )}">
-    <div class="card mb-3">
-        <div class="card-header">Tool Sanitization Allowlist</div>
-        <div class="card-body overflow-auto">
-            <table class="manage-table colored" border="0" cellspacing="0" cellpadding="0" width="100%">
-                <tr>
-                    <th>Allowlist</th>
-                    <th>Name</th>
-                    <th>ID</th>
-                </tr>
-                <% ctr = 0 %>
-                %for tool in tools.values():
-                    %if ctr % 2 == 1:
-                        <tr class="odd_row">
-                    %else:
-                        <tr class="tr">
-                    %endif
-                        <td>
-                            %if tool.id in trans.app.config.sanitize_allowlist:
-                                <input type="checkbox" name="tools_to_allowlist" value="${tool.id}" checked="checked"/>
-                            %else:
-                                <input type="checkbox" name="tools_to_allowlist" value="${tool.id}"/>
-                            %endif
-                        </td>
-                        <td>${ tool.name | h }</td>
-                        <td>${ tool.id | h }</td>
-                    </tr>
-                    <% ctr += 1 %>
-                %endfor
-            </table>
-        </div>
-    </div>
-    <input type="submit" name="submit_allowlist" value="Submit new allowlist"/>
-    </form>
-%endif