BAH-4789: Fix Form Builder pagination CORS error from absolute next links

src/common/utils/paginationUtils.js

@@ -0,0 +1,35 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public License,
+ * v. 2.0. If a copy of the MPL was not distributed with this file, You can
+ * obtain one at https://www.bahmni.org/license/mplv2hd.
+ *
+ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS
+ * graphic logo is a trademark of OpenMRS Inc.
+ */
+
+// OpenMRS builds absolute pagination links from the request it sees behind the proxy
+// (e.g. http://localhost/openmrs/...), which need not match the origin of the browser.
+// Only the path and query of the `next` link are kept so that the request is made to the
+// current origin. Returns undefined when there is no next page and throws for an invalid link.
+export function getNextPageUrl(response) {
+  const links = Array.isArray(response && response.links) ? response.links : [];
+  const nextLink = links.find((link) => link.rel === 'next');
+  if (!nextLink) {
+    return undefined;
+  }
+  let nextUrl;
+  try {
+    if (!nextLink.uri) {
+      throw new Error('missing uri');
+    }
+    nextUrl = new URL(nextLink.uri, window.location.origin);
+  } catch (e) {
+    throw new Error(`Invalid pagination link: ${nextLink.uri}`);
+  }
+  // A path starting with two slashes would be read as a network-path reference to another host
+  if ((nextUrl.protocol !== 'http:' && nextUrl.protocol !== 'https:')
+    || /^[\\/]{2}/.test(nextUrl.pathname)) {
+    throw new Error(`Invalid pagination link: ${nextLink.uri}`);
+  }
+  return `${nextUrl.pathname}${nextUrl.search}`;
+}

src/form-builder/components/FormBuilderContainer.jsx

@@ -18,6 +18,7 @@
 import get from 'lodash/get';
 import map from 'lodash/map';
 import sortBy from 'lodash/sortBy';
+import { getNextPageUrl } from 'common/utils/paginationUtils';
 import formHelper from '../helpers/formHelper';
 import { fetchAllowedDomains } from '../helpers/hyperlinkValidationHelper';
 import { connect } from 'react-redux';
@@ -48,36 +49,34 @@
   }
 
   getFormData() {
     const initialForms = [];
     const forms = [];
     const queryParams = '?=';
     const fetchFormsUrl = `${formBuilderConstants.formUrl}?v=custom:(id,uuid,name,version,published,auditInfo)`;
     return httpInterceptor.get(fetchFormsUrl)
-      .then((initialForms) => {
-        this.collectAllForms(initialForms, forms);
-      })
+      .then((initialForms) => this.collectAllForms(initialForms, forms))
       .catch((error) => {
         this.showErrors(error);
         this.setState({ loading: false });
       });
   }
 
-  collectAllForms(initialForms, forms) {
+  collectAllForms(initialForms, forms, requestedUrls = []) {
     forms.push(...initialForms.results);
     if (forms.length === formBuilderConstants.dataLimit) {
       this.setState({ data: this.orderFormByVersion(forms), loading: false });
-      return;
+      return Promise.resolve();
     }
-    if (initialForms.links !== undefined && initialForms.links.length > 0 && initialForms.links.find(link => link.rel === 'next') !== undefined) {
-      httpInterceptor.get(initialForms.links[0].uri)
-        .then((privileges) => this.collectAllForms(privileges, forms))
-        .catch((error) => {
-          this.showErrors(error);
-          this.setState({ loading: false });
-        });
-    } else {
+    const nextUrl = getNextPageUrl(initialForms);
+    if (!nextUrl) {
       this.setState({ data: this.orderFormByVersion(forms), loading: false });
+      return Promise.resolve();
+    }
+    if (requestedUrls.includes(nextUrl)) {
+      throw new Error('Unable to load all forms: repeated pagination link');
     }
+    return httpInterceptor.get(nextUrl)
+      .then((nextForms) => this.collectAllForms(nextForms, forms, [...requestedUrls, nextUrl]));
   }
 
   getDefaultLocale() {

src/form-builder/components/FormPrivilegeTable.jsx

@@ -18,6 +18,7 @@ import { selectSource, setChangedProperty } from 'form-builder/actions/control';
 import { commonConstants } from 'common/constants';
 import filter from 'lodash/filter';
 import { httpInterceptor } from 'common/utils/httpInterceptor';
+import { getNextPageUrl } from 'common/utils/paginationUtils';
 import Select from 'react-select';
 import { UrlHelper } from 'form-builder/helpers/UrlHelper';
 import sortBy from 'lodash/sortBy';
@@ -107,13 +108,8 @@ export default class FormPrivilegeTable extends Component {
       this.setState({ availablePrivileges: this.arrangePrivileges(allPrivileges), loading: false });
       return;
     }
-    if (initialPrivileges.links !== undefined && initialPrivileges.links.length > 0) {
-      const nextLink = initialPrivileges.links.find(link => link.rel === 'next');
-      if (!nextLink) {
-        this.setState({ availablePrivileges: this.arrangePrivileges(allPrivileges), loading: false });
-        return;
-      }
-      const nextUri = this.getNextPaginationRequestUrl(nextLink.uri);
+    const nextUri = getNextPageUrl(initialPrivileges);
+    if (nextUri) {
       httpInterceptor.get(nextUri)
         .then((privileges) => this.collectAllPrivileges(privileges, allPrivileges));
     } else {
@@ -301,17 +297,6 @@ export default class FormPrivilegeTable extends Component {
     return formPrivilegeObj;
   }
 
-  getNextPaginationRequestUrl(uri) {
-    if (uri.indexOf('http') === -1) {
-      return uri;
-    }
-    const parsedUrl = new URL(uri);
-    if (parsedUrl.protocol != window.location.protocol) {
-      parsedUrl.protocol = window.location.protocol;
-    }
-    return parsedUrl.toString();
-  }
-
   removeSelectedPrivilege(e) {
     let array = this.state.availablePrivileges.filter((item) => item.label !== e);
     this.setState({

test/common/utils/paginationUtils.spec.js

@@ -0,0 +1,91 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public License,
+ * v. 2.0. If a copy of the MPL was not distributed with this file, You can
+ * obtain one at https://www.bahmni.org/license/mplv2hd.
+ *
+ * Copyright (C) OpenMRS Inc. OpenMRS is a registered trademark and the OpenMRS
+ * graphic logo is a trademark of OpenMRS Inc.
+ */
+
+import { expect } from 'chai';
+import { getNextPageUrl } from 'common/utils/paginationUtils';
+
+describe('paginationUtils', () => {
+  describe('getNextPageUrl', () => {
+    it('should drop the origin of an absolute http link and keep path and encoded query', () => {
+      const uri = 'http://localhost/openmrs/ws/rest/v1/form?v=custom%3A%28id%2Cuuid%2Cname%29' +
+        '&limit=2&startIndex=2';
+      expect(getNextPageUrl({ links: [{ rel: 'next', uri }] }))
+        .to.eql('/openmrs/ws/rest/v1/form?v=custom%3A%28id%2Cuuid%2Cname%29&limit=2&startIndex=2');
+    });
+
+    it('should return the path and query of a link on the current origin', () => {
+      const uri = `${window.location.origin}/openmrs/ws/rest/v1/form?limit=2&startIndex=4`;
+      expect(getNextPageUrl({ links: [{ rel: 'next', uri }] }))
+        .to.eql('/openmrs/ws/rest/v1/form?limit=2&startIndex=4');
+    });
+
+    it('should keep a relative link unchanged', () => {
+      expect(getNextPageUrl({ links: [{ rel: 'next', uri: '/openmrs/ws/rest/v1/form?limit=2' }] }))
+        .to.eql('/openmrs/ws/rest/v1/form?limit=2');
+    });
+
+    it('should pick the link with rel next when it is not the first link', () => {
+      const response = { links: [
+        { rel: 'prev', uri: 'http://localhost/openmrs/ws/rest/v1/form?limit=2&' },
+        { rel: 'next', uri: 'http://localhost/openmrs/ws/rest/v1/form?limit=2&startIndex=6' },
+      ] };
+      expect(getNextPageUrl(response)).to.eql('/openmrs/ws/rest/v1/form?limit=2&startIndex=6');
+    });
+
+    it('should return undefined when there is no next link', () => {
+      expect(getNextPageUrl({ results: [] })).to.eql(undefined);
+      expect(getNextPageUrl({ links: [] })).to.eql(undefined);
+      expect(getNextPageUrl({ links: [{ rel: 'prev', uri: '/a' }] })).to.eql(undefined);
+      expect(getNextPageUrl(undefined)).to.eql(undefined);
+    });
+
+    it('should throw for a next link that is missing or invalid', () => {
+      expect(() => getNextPageUrl({ links: [{ rel: 'next' }] })).to.throw('Invalid pagination');
+      expect(() => getNextPageUrl({ links: [{ rel: 'next', uri: 'http://' }] }))
+        .to.throw('Invalid pagination');
+      expect(() => getNextPageUrl({ links: [{ rel: 'next', uri: 'ftp://localhost/openmrs' }] }))
+        .to.throw('Invalid pagination');
+    });
+
+    it('should throw for a next link whose path could resolve to another host', () => {
+      ['http://localhost//evil.com/a', 'http://localhost/\\evil.com/a', 'http://localhost///evil.com']
+        .forEach((uri) => {
+          expect(() => getNextPageUrl({ links: [{ rel: 'next', uri }] }))
+            .to.throw('Invalid pagination');
+        });
+    });
+
+    it('should keep only path and query of a protocol-relative link to another host', () => {
+      const uri = '//evil.example/openmrs/ws/rest/v1/form?limit=2&startIndex=2';
+      expect(getNextPageUrl({ links: [{ rel: 'next', uri }] }))
+        .to.eql('/openmrs/ws/rest/v1/form?limit=2&startIndex=2');
+    });
+
+    it('should throw for dot-segment and protocol-relative paths that normalise to //host', () => {
+      ['http://localhost/.//evil.com/a', 'http://localhost/a/..//evil.com/a']
+        .forEach((uri) => {
+          expect(() => getNextPageUrl({ links: [{ rel: 'next', uri }] }))
+            .to.throw('Invalid pagination');
+        });
+    });
+
+    it('should never return a value that resolves to another origin', () => {
+      ['http://other.example/openmrs/a?x=1', '//evil.example/a', '///evil.com/a', 'https://evil.example:8443/a?b=%2F%2F']
+        .forEach((uri) => {
+          const result = getNextPageUrl({ links: [{ rel: 'next', uri }] });
+          expect(new URL(result, window.location.origin).origin).to.eql(window.location.origin);
+        });
+    });
+
+    it('should ignore links that are not an array', () => {
+      expect(getNextPageUrl({ links: {} })).to.eql(undefined);
+      expect(getNextPageUrl({ links: 'next' })).to.eql(undefined);
+    });
+  });
+});