Coder Social home page Coder Social logo

httpfileuploadcomponent's Introduction

HTTP File Upload Component

About

This application allows occupants of an XMPP multi-user chat room to share data (images and such) with each-other.

More specifically, this is a Jabber Component that implements XEP-0363: HTTP File Upload

Download

The compiled application, as well as the source code, is available for download on the 'releases' page of this project.

Building

This project is using a Maven-based build process. To build this project yourself, ensure that the following are available on your local host:

  • A Java Development Kit, version 8.
  • Apache Maven 3

To build this project, invoke on a command shell:

$ mvn clean package

Upon completion, the application will be available in the target directory.

Usage

To run the application, execute

java -jar httpfileuploadcomponent-<versionnumber>-jar-with-dependencies.jar

A number of arguments can (and probably should) be added. A common execution is:

java -jar httpfileuploadcomponent-<versionnumber>-jar-with-dependencies.jar \
   --xmppHost openfire1.example.org \
   --sharedSecret hqcUrfHtgE73FktcXwfrP

This will start the application, connect it to an XMPP server with the provided shared secret, and launch a webserver on a non-local interface of the machine on which the application is executed.

When end-users should interact with the webserver using a different address, the announcedWebHost argument can be used. This provides a convenient way to work with remote proxies or port-forwarded network topologies.

A full set of usage instructions are provided by adding the --help argument:

$ java -jar httpfileuploadcomponent-1.0-jar-with-dependencies.jar --help
    usage: arguments
        --announcedWebContextRoot <arg>   The context root that is to be used
                                          by the end users (when different
                                          from webContextRoot). Defaults to
                                          webContextRoot value.
        --announcedWebHost <arg>          The hostname or IP address that is
                                          to be used by the end users (when
                                          different from webHost). Defaults to
                                          the webHost address.
        --announcedWebPort <arg>          The TCP port number that is to be
                                          used by the end users (when
                                          different from webPort). Defaults to
                                          the webPort value.
        --announcedWebProtocol <arg>      The Protocol that is to be used by
                                          the end users. Defaults to the
                                          webProtocol value
        --clamavHost <arg>                The FQDN or IP address of the host
                                          running the optional ClamAV malware
                                          scanner, if any.
        --clamavPort <arg>                The TCP port number for the optional
                                          ClamAV malware scanner, if any.
        --domain <arg>                    The domain that will be used for the
                                          component with the XMPP domain.
        --fileRepo <arg>                  Store files in a directory provided
                                          by the file system. Provide the
                                          desired path as a value. Path must
                                          exist.
        -h,--help                         Displays this help text.
        --maxFileSize <arg>               The maximum allowed size per file,
                                          in bytes. Use -1 to disable file
                                          size limit. Defaults to 5242880
                                          (five MB).
        --sharedSecret <arg>              The shared secret, that
                                          authenticates this component with
                                          the XMPP domain.
        --tempFileRepo                    Store files in the temporary
                                          directory provided by the file
                                          system.
        --webContextRoot <arg>            The context root of the web server
                                          through which the web frontend will
                                          be made available. Defaults to '/',
                                          the root context.
        --webHost <arg>                   The hostname or IP address on which
                                          the webserver will be ran. Defaults
                                          to an arbitrary, non-local address
                                          of this machine.
        --webPort <arg>                   The TCP port number of the
                                          webserver. Defaults to 12121.
        --webProtocol <arg>               The protocol that is used to expose
                                          services by the webservice. Defaults
                                          to http
        --wildcardCORS                    Add CORS headers that define a
                                          liberal access control regime
                                          (wildcard origin, various headers
                                          and methods).
        --xmppHost <arg>                  The FQDN or IP address (not XMPP
                                          domain name) of the XMPP domain that
                                          this component will connect to.
                                          Defaults to 'localhost'.
        --xmppPort <arg>                  The TCP port number on the xmppHost,
                                          to which a connection will be made.
                                          Defaults to 5275.

Scanning for Malware

To facilitate virus scanning, you can configure the application to use ClamAV. ClamAV is a third-party, open source (GPLv2) anti-virus toolkit, available at https://www.clamav.net/

To configure this application to use ClamAV, install, configure and run clamav-daemon, the scanner daemon of ClamAV. Configure the daemon in such a way that Openfire can access it via TCP.

Note: ClamAV is configured with a maximum file size. Ensure that this is at least as big as the maxFileSize that is provided as an argument to the HTTP File Upload Component.

Then, start the HTTP File Upload Component application with the clamavHost and clamavPort arguments. When these are provided, the application will supply each file that is being uploaded to the ClamAV daemon for scanning. A file upload will fail when the ClamAV daemon could not be reached, or, obviously, when it detects malware.

While malware scanning can offer some protection against distributing unwanted content, it has limitations. Particularly when the uploaded data is encrypted, the scanner is unlikely able to detect any malware in it.

httpfileuploadcomponent's People

Contributors

dependabot[bot] avatar fank avatar gmournos avatar guusdk avatar mnsuccess avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

httpfileuploadcomponent's Issues

NullPointerException with Conversations 1.23.6

Unexpected exception while processing IQ stanza: <iq type="get" id="<snip>" from="[email protected]/phone" to="httpfileupload.example.org"><request xmlns="urn:xmpp:http:upload:0" content-type="image/jpeg" filename="SLCjCdpkQgas0sh5oGuKig.jpg" size="125262"></request></iq>
java.lang.NullPointerException
    at nl.goodbytes.xmpp.xep0363.Component.handleIQGet(Component.java:173)
    at org.xmpp.component.AbstractComponent.processIQRequest(AbstractComponent.java:511)
    at org.xmpp.component.AbstractComponent.processIQ(AbstractComponent.java:289)
    at org.xmpp.component.AbstractComponent.processQueuedPacket(AbstractComponent.java:239)
    at org.xmpp.component.AbstractComponent.access$100(AbstractComponent.java:81)
    at org.xmpp.component.AbstractComponent$PacketProcessor.run(AbstractComponent.java:1051)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1152)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:622)
    at java.lang.Thread.run(Thread.java:748)

Update Guava dependency

The version of Google's Guava library that is used has associated security vulnerability reports. It should be updated.

Increase default max file size.

The default maximum file size is currently 5MB (and configurable, see #5 ). This appears to introduce issues for many user, which isn't to far-fetched, realizing that a photo snapped with an up-to-date phone can easily be several megabytes. The default should be raised.

Is jetty mandatory and other questions ...

Hi !

I need some clarifications :)

A short summary of my settings:

  • 2 Openfire servers running into 2 differents domains;
  • 2 Converse.js clients running at each extremities.
    That gives:
    Client 1 (converse.js) <-> [email protected] <-> [email protected] <-> Client 2 (converse.js)
    Everything works fine (chat, group chat, HTTP-upload thx to the dedicated plug-in).

For some reasons, I would like to use distinct ports for Chat and HTTP-upload.
I noticed that I could configure the HTTP-upload plug-in using the properties below:

  • plugin.httpfileupload.announcedWebHost -> DNS name of the local Openfire server
  • plugin.httpfileupload.announcedWebPort -> 7444 (port different from 7443)
    The new port is taken into account by the attempt of transfer (could see that in Openfire logs), unfortunately the port is not actually opened on Openfire host :(
    Is this the expected behaviour ?

I tried to use an Nginx as external Web server (running on another machine).
But I noticed that some dependencies from Jetty are somehow hardcoded in the source code of the httpfileuploadcomponent.
In addition, when trying to upload files from Converse.js, the intermediate UUID sub-folder (in the upload path) is not created in the target web context root folder 'httpfileupload' hosted by the Nginx server.
My understanding is that I can't run another Web server than Jetty, the one embedded into Openfire server. No chance to run another type of Web server as Nginx, and on another server than Openfire.
Do you confirm ?

Many many thx for your clarification.
KR
ErwanF

Allow repository cleanup to be configurable.

The file-based repositories will automatically start deleting old files, when the amount of space used by the repository grows over a certain threshold.

This threshold should be configurable, as should it be possible to disable this functionality completely.

Add possibility to set relaxed access control using CORS headers

When running on a different domain than the domain that's hosting the client (eg: a HTTP-based XMPP client), then CORS headers are needed to make the browser understand that the service can be used by the client.

For starters, lets add a flag that simply adds a wildcard CORS header, allowing all access. Future improvements could include domain-specific settings.

How to use Openfire plugin?

I wonder, how to use this component with Openfire server.
When I read the plugin description in admin console it seems that everything should work without my interference. But it doesn't.

I installed openfire plugin "Http file upload" and can't see any changes in admin console except one new row about installed plugin. No new ports in server information no new records in external components.
I also don't see any new listening sockets in netstat.

I'm trying to send a file from Psi+ to Conversations.
In XML console I see this:

<iq from='[email protected]' id='aae6a' to='httpfileupload.koshka.ddns.net' type='get'><request xmlns='urn:xmpp:http:upload'><filename>DSC03184.jpg</filename><size>796982</size><content-type>image/jpeg</content-type></request></iq>

<iq id="aae6a" from="httpfileupload.koshka.ddns.net" type="result" to="[email protected]/Psi+">
<slot xmlns="urn:xmpp:http:upload">
<put>https://koshka.ddns.net:7443/httpfileupload/b80a76af-7b32-4393-9a3d-cc42cb7f9751/DSC03184.jpg</put>
<get>https://koshka.ddns.net:7443/httpfileupload/b80a76af-7b32-4393-9a3d-cc42cb7f9751/DSC03184.jpg</get>
</slot>
</iq>

After which I get message "Upload failed connection refused". Perhaps it means that nobody is listening port 7443. Why?
And why 7443? I didn't see this number anywhere.
Why the plugin works to invite client to send file but doesn't work to actually receive it?

Or maybe description inside Openfire is misleading and I should use the way described here: run as a separate service and manually registering it as a external component in Openfire?

Update to Java 8

The Maven project description defines that the project uses Java 1.7, but code is used that got introduced in Java 8. The easiest solution for this is to update the Maven project description to match the implementation.

Can't get mime type of uploaded file from webserver

Hi Guus,
your plugin makes image transfer with openfire a real pleasure. I was using for more than 5 years standard slow p2p transfer cause I was absolutely unaware about the XEP-363 implementation.

I got an Issue I don't really know if it is caused by the httpfileupload-plugin espcially the used Jetty-Webserver or my used windows jabber client (gajim with urlimagepreviewplugin).
The problem is that gajim can't show a preview of a picture/image sent with httpfileupload because the image preview plugin can't get the mime-type from the Jetty Webserver. So when sending an image (for example with conversations to gajim), I only get a link to the server (https://mydomain.tld:7443/http-bind/.....jpg) instead of a preview of that image.

When I try to "curl -I" the link of the Image I only get :
HTTP/1.1 200 OK Date: Thu, 14 Mar 2019 07:47:27 GMT Cache-Control: max-age=31536000 ETag: 1530580421 Content-Length: 149726 Server: Jetty(9.4.12.v20180830)
So the mime type is missing.
I am using your plugin integrated in Openfire. So I don't know if it is caused by an old Jetty Version or may be just a configuration issue.
Thanks for the info.

Upload Maximum 5MB

Hi,

there is a hardcoded maximum of uploaded files at 5 MB.
It is possible to make this value changeable or set it fix at 30 or 50 MB?

That would be great... ;-)
Greetz...

Failed to start

Hi and thank you for your great plugin
i have problem starting this
when i start i get exception:
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - Public address(es):
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - * xxx.xxx.xxx.xxx
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - *
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - Starting external component with endpoint http://xxx.xxx.xxx.xxx:12121
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - maxFileSize: 52428800
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - Starting repository...
[main] INFO nl.goodbytes.xmpp.xep0363.repository.AbstractFileSystemRepository - Initialized repository in: C:\Users\ADMINI~1\AppData\Local\Temp\2\xmppfileupload5004533732279233748
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - Starting webserver...
[main] INFO org.eclipse.jetty.util.log - Logging to org.slf4j.impl.SimpleLogger(org.eclipse.jetty.util.log) via org.eclipse.jetty.util.log.Slf4jLog
[main] INFO org.eclipse.jetty.util.log - jetty-1.2.0
[main] INFO org.eclipse.jetty.util.log - Started [email protected]:12121
[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - Webserver started at xxx.xxx.xxx.xxx:12121
[main] ERROR nl.goodbytes.xmpp.xep0363.Launcher - An unexpected exception occurred!
org.xmpp.component.ComponentException: internal-server-error
at org.jivesoftware.whack.ExternalComponent.connect(ExternalComponent.java:219)
at org.jivesoftware.whack.ExternalComponentManager.addComponent(ExternalComponentManager.java:221)
at org.jivesoftware.whack.ExternalComponentManager.addComponent(ExternalComponentManager.java:201)
at nl.goodbytes.xmpp.xep0363.Launcher.start(Launcher.java:345)
at nl.goodbytes.xmpp.xep0363.Launcher.main(Launcher.java:232)
[Shutdown] INFO org.eclipse.jetty.util.log - Shutdown hook executing

Add maximum file size to service discovery responses.

Disco-info responses should include the maximum allowed file size. It currently includes the appropriate element, but fails to include the actual value:

<x xmlns="jabber:x:data" type="result">
  <field var="FORM_TYPE" type="hidden">
    <value>urn:xmpp:http:upload:0</value>
  </field>
  <field var="max-file-size"/>
</x>

Replacing UUID with something more secure

The code currently uses UUID identifiers to refer to uploads. UUIDs were chosen as they have two qualities:

  • They're unique, preventing duplicates
  • They are random (and therefore used to prevent people from guessing a value)

It seems that the last part might is not necessarily provide as much security as that was assumed when creating this code. UUID's implementation does not add that much randomness into its value. See https://neilmadden.blog/2018/08/30/moving-away-from-uuids/

It should be considered to replace (or augment) the usage of UUID to improve the security aspect of things. Care should be taken to not compromise the uniqueness-aspect of the identifier that's used.

Getting port as part of upload and download uri

When I request a solt to upload the file, its returning slot download and upload uri with port.
I have done proxy-path config for those ports because I dont want to expose those ports to public,
But getSlot method returning with ports.

Please see the response object below

{
"type": "slot",
"download": "**https://communicationqa.dhi-edu.com:**7443**/**httpfileupload/ZmbOvMB8HQI5Bjfzp1W5MzFmQ0Y/018902.pdf",
"upload": {
"url": "**https://communicationqa.dhi-edu.com:7443**/httpfileupload/ZmbOvMB8HQI5Bjfzp1W5MzFmQ0Y/018902.pdf"
}
}

Please help how to avoid ports as part of download and upload uri

Content length issue

When I try to upload the file using put method, it is throwing the bellow exception

2024.01.09 15:57:05 INFO [Jetty-QTP-BOSH-1115]: nl.goodbytes.xmpp.xep0363.Servlet - Processing PUT request... (127.0.0.1 submitting to /httpfileupload/HSOuN8Kx-9C1qlzkpxFlx_AY8Kc/Screenshot%202023-12-30%20at%2010-25-04%20DataEntryPortal.png)

2024.01.09 15:57:05 INFO [Jetty-QTP-BOSH-1115]: nl.goodbytes.xmpp.xep0363.Servlet - ... responded with BAD_REQUEST. Content length in request (2) does not correspond with slot size (213592).

NPE when starting without malwarescanner

In version 1.6.0, an optional malware scanner can be configured.

If this is not configured, then the launcher throws this NullPointerException upon startup:

[main] INFO nl.goodbytes.xmpp.xep0363.Launcher - Starting malware scanner...
[main] ERROR nl.goodbytes.xmpp.xep0363.Launcher - An unexpected exception occurred!
java.lang.NullPointerException: Cannot invoke "nl.goodbytes.xmpp.xep0363.MalwareScanner.initialize()" because "this.malwareScanner" is null
	at nl.goodbytes.xmpp.xep0363.MalwareScannerManager.initialize(MalwareScannerManager.java:45)
	at nl.goodbytes.xmpp.xep0363.Launcher.start(Launcher.java:406)
	at nl.goodbytes.xmpp.xep0363.Launcher.main(Launcher.java:306)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.