diff --git a/src/main/java/de/thm/arsnova/controller/WelcomeController.java b/src/main/java/de/thm/arsnova/controller/WelcomeController.java index d8bd4d41d0003e28e1ffd619be62302f82e9beb0..0893bf0eced5733a6c6f4aff5869bbff83d6e659 100644 --- a/src/main/java/de/thm/arsnova/controller/WelcomeController.java +++ b/src/main/java/de/thm/arsnova/controller/WelcomeController.java @@ -36,6 +36,7 @@ import org.springframework.web.client.RestTemplate; import org.springframework.web.servlet.View; import org.springframework.web.servlet.view.RedirectView; +import de.thm.arsnova.exceptions.BadRequestException; import de.thm.arsnova.exceptions.NoContentException; /** @@ -61,8 +62,14 @@ public class WelcomeController extends AbstractController { @RequestMapping(value = "/checkframeoptionsheader", method = RequestMethod.GET) @ResponseStatus(HttpStatus.OK) public void checkFrameOptionsHeader( - @RequestParam(required = true) final String url + @RequestParam(required = true) final String url, + final HttpServletRequest request ) { + /* Block requests from the server itself to prevent DoS attacks caused by request loops */ + if ("127.0.0.1".equals(request.getRemoteAddr())) { + throw new BadRequestException(); + } + RestTemplate restTemplate = new RestTemplate(); SimpleClientHttpRequestFactory rf = (SimpleClientHttpRequestFactory) restTemplate.getRequestFactory(); rf.setConnectTimeout(2000);