From 0a99d04b4b4a88031642880bf25488b206b6b8fc Mon Sep 17 00:00:00 2001
From: Jordan Pellizzari <jpellizzari21@gmail.com>
Date: Sun, 19 Feb 2017 18:39:30 -0800
Subject: [PATCH] Consolidated API requests into single helper; added CSRF
 header

---
 client/app/html/index.html                |   1 +
 client/app/scripts/utils/web-api-utils.js |  47 +++++++++++++++-------
 client/build/favicon.ico                  | Bin 741 -> 0 bytes
 3 files changed, 33 insertions(+), 15 deletions(-)
 delete mode 100644 client/build/favicon.ico
diff --git a/client/app/html/index.html b/client/app/html/index.html
index b9fd6f220..f7ab5ee9b 100644
--- a/client/app/html/index.html
+++ b/client/app/html/index.html
@@ -5,6 +5,7 @@
     <title>Weave Scope</title>
     <meta name="description" content="">
     <meta name="viewport" content="width=device-width, initial-scale=1">
+    <script language="javascript">window.__WEAVEWORKS_CSRF_TOKEN = "$__CSRF_TOKEN_PLACEHOLDER__";</script>
   </head>
   <body>
     <!--[if lt IE 10]>
diff --git a/client/app/scripts/utils/web-api-utils.js b/client/app/scripts/utils/web-api-utils.js
index 1b7cbe95c..485367dfb 100644
--- a/client/app/scripts/utils/web-api-utils.js
+++ b/client/app/scripts/utils/web-api-utils.js
@@ -1,6 +1,7 @@
 import debug from 'debug';
 import reqwest from 'reqwest';
 import trimStart from 'lodash/trimStart';
+import defaults from 'lodash/defaults';
 
 import { blurSearch, clearControlError, closeWebsocket, openWebsocket, receiveError,
   receiveApiDetails, receiveNodesDelta, receiveNodeDetails, receiveControlError,
@@ -15,6 +16,18 @@ const log = debug('scope:web-api-utils');
 const reconnectTimerInterval = 5000;
 const updateFrequency = '5s';
 const FIRST_RENDER_TOO_LONG_THRESHOLD = 100; // ms
+const csrfToken = (() => {
+  // Check for token at window level or parent level (for iframe);
+  /* eslint-disable no-underscore-dangle */
+  const token = window.__WEAVEWORKS_CSRF_TOKEN || parent.__WEAVEWORKS_CSRF_TOKEN;
+  /* eslint-enable no-underscore-dangle */
+  if (!token || token === '$__CSRF_TOKEN_PLACEHOLDER__') {
+    // Authfe did not replace the token in the static html.
+    return null;
+  }
+
+  return token;
+})();
 
 let socket;
 let reconnectTimer = 0;
@@ -122,7 +135,18 @@ function createWebsocket(topologyUrl, optionsQuery, dispatch) {
   };
 }
 
-/* keep URLs relative */
+/**
+  * XHR wrapper. Applies a CSRF token (if it exists) and content-type to all requests.
+  * Any opts that get passed in will override the defaults.
+  */
+function doRequest(opts) {
+  const config = defaults(opts, { contentType: 'application/json' });
+  if (csrfToken) {
+    config.headers = Object.assign({}, config.headers, { 'X-CSRF-Token': csrfToken });
+  }
+
+  reqwest(config);
+}
 
 /**
  * Gets nodes for all topologies (for search)
@@ -147,9 +171,8 @@ export function getTopologies(options, dispatch) {
   clearTimeout(topologyTimer);
   const optionsQuery = buildOptionsQuery(options);
   const url = `${getApiPath()}/api/topology?${optionsQuery}`;
-  reqwest({
+  doRequest({
     url,
-    type: 'json',
     success: (res) => {
       dispatch(receiveTopologies(res));
       topologyTimer = setTimeout(() => {
@@ -191,9 +214,8 @@ export function getNodeDetails(topologyUrlsById, currentTopologyId, options, nod
     }
     const url = urlComponents.join('');
 
-    reqwest({
+    doRequest({
       url,
-      type: 'json',
       success: (res) => {
         // make sure node is still selected
         if (nodeMap.has(res.node.id)) {
@@ -218,9 +240,8 @@ export function getNodeDetails(topologyUrlsById, currentTopologyId, options, nod
 export function getApiDetails(dispatch) {
   clearTimeout(apiDetailsTimer);
   const url = `${getApiPath()}/api`;
-  reqwest({
+  doRequest({
     url,
-    type: 'json',
     success: (res) => {
       dispatch(receiveApiDetails(res));
       apiDetailsTimer = setTimeout(() => {
@@ -241,10 +262,9 @@ export function doControlRequest(nodeId, control, dispatch) {
   clearTimeout(controlErrorTimer);
   const url = `${getApiPath()}/api/control/${encodeURIComponent(control.probeId)}/`
     + `${encodeURIComponent(control.nodeId)}/${control.id}`;
-  reqwest({
+  doRequest({
     method: 'POST',
     url,
-    type: 'json',
     success: (res) => {
       dispatch(receiveControlSuccess(nodeId));
       if (res) {
@@ -279,10 +299,9 @@ export function doResizeTty(pipeId, control, cols, rows) {
   const url = `${getApiPath()}/api/control/${encodeURIComponent(control.probeId)}/`
     + `${encodeURIComponent(control.nodeId)}/${control.id}`;
 
-  return reqwest({
+  return doRequest({
     method: 'POST',
     url,
-    type: 'json',
     data: JSON.stringify({pipeID: pipeId, width: cols.toString(), height: rows.toString()}),
   })
     .fail((err) => {
@@ -293,10 +312,9 @@ export function doResizeTty(pipeId, control, cols, rows) {
 
 export function deletePipe(pipeId, dispatch) {
   const url = `${getApiPath()}/api/pipe/${encodeURIComponent(pipeId)}`;
-  reqwest({
+  doRequest({
     method: 'DELETE',
     url,
-    type: 'json',
     success: () => {
       log('Closed the pipe!');
     },
@@ -310,10 +328,9 @@ export function deletePipe(pipeId, dispatch) {
 
 export function getPipeStatus(pipeId, dispatch) {
   const url = `${getApiPath()}/api/pipe/${encodeURIComponent(pipeId)}/check`;
-  reqwest({
+  doRequest({
     method: 'GET',
     url,
-    type: 'json',
     complete: (res) => {
       const status = {
         204: 'PIPE_ALIVE',
diff --git a/client/build/favicon.ico b/client/build/favicon.ico
deleted file mode 100644
index 2d15c780889b9db340d2ce1e5690caf0b66851ac..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 741
zcmeAS@N?(olHy`uVBq!ia0vp^3LwnE3?yBabR7dyk|nMYCBgY=CFO}lsSJ)O`AMk?
zp1FzXsX?iUDV2pMQ*D5Xjs^IHxc*<-V}JMm|4T>rfB9cm*Y|(-icOn#|NruF{=5JG
z!_@!Zz4E^=e^a>o{~YJ}Q@ZtU{ZF;9<G=d<{h$BmzyG(h3%haS?x#;*^lifOpZ#C|
z@&Esswf~QAS1X%#=FBDk2miafXDTi|@&Co6_{aa}7Zq-}{-plJ|Mq1oRr@xirk4LN
z4?3D1Ib+6Bi6gJipFH|$MnnJW|M^aC|2NE%zy5#n+*vZaA6lPzyL9OWpN5(L6HT>u
z-`~Ig_?vxO)aLAa-kEP?<jrvD|9@}E|NsBTeej$P^pR6ZkY6y6OBrBr5fcC!#+dHu
z;uunKD`)caq-F&XH^b0J9b5ZcCYx-oet%c%```Fgcer_1?5!6$msrciynBw@HMs*v
zN(}$XY`Va)`j%{YOQiyv^})5NYt^<1a3;2FpLJ?$3wt7G_Sv_RGgRk9K5qZd(cZQH
z(xF2Cii>j|7wj~=CRpLQ<A;k}^7Cb?F)JUkrfpEvOWXE9>tC%-^`V9xF^4(ayVe`N
zYJ4_tZ#(mmr^aq?HDxL;h@Q&s`PKjU`pH{|*xmjv{$X8I?|Epgm_;r3(d3?s`9UH-
zI$D~V1v|nwsj|jRF0f})cCq*vW+o?j;_>7UtZokTbT>XU=t*C)n9qM|!|~HXHTha$
z5(l}zc{<F~zW3uA&!-<McNF|Z?HRXCIHbxY?!;~MYUMLKwaU0+wUW$(;TCg)u5k0o
zKJ@#%=dXW~t>T5--bF7sCtiM|b#j5afkD&co95ns>*XX8Z||LLEO_Q1N9g}gZHf{H
k+xI2J{ugVHXJlh=J9t&!A#mYVV3;#_y85}Sb4q9e0NaU-qW}N^

