Develop Reference

Cloud Storage for Firebase: How to recover a pdf

I have a pdf stored in Cloud Storage and I'm trying to take this file to send it through email.
I'm trying to recover it but I receive back an error about access deniend:
Uncaught (in promise): FirebaseError: Firebase Storage: User does not
have permission to access
My code:
const storageRef = firebase.storage().ref();
var forestRef = storageRef.child('/uploads/' + offerId + '/' + offerId + '.pdf');
forestRef.getDownloadURL()
.then(function (url) {
console.log("url ", url)
var xhr = new XMLHttpRequest();
xhr.responseType = 'blob';
xhr.onload = function (event) {
var blob = xhr.response;
};
xhr.open('GET', url);
})
I think that the problem should be that I'm not using the access token but I don't know how to recover it. ( I have tried to use also the getMetadata, but the result is the same)
Edit:
I have also the url with token

The files in firebase storage follow a specific url format. use the following format. The url generated from getDownloadURL() will have token associated with it causing the link to expire after few days.
https://firebasestorage.googleapis.com/v0/b/<PROJECT-NAME>.appspot.com/o/<PATH>%2F<TOFILE>?alt=media
So your url string for /uploads/${offerId}/${offerId}.pdf will be :
https://firebasestorage.googleapis.com/v0/b/<PROJECT-NAME>.appspot.com/o/uploads%2F${offerId}%2F${offerId}.pdf?alt=media
Thus by string manipulations you can create the file urls.

While download URLs provide public, read-only access to files in Cloud Storage for Firebase, calling getDownloadURL to generate such a URL requires that you have read permission on that file.
The error message indicates that the code does not meet your security rules, i.e. that there is no user signed in when you run this code.
If that is not what you expect, I recommend checking that right before you call the Storage API:
const storageRef = firebase.storage().ref();
var forestRef = storageRef.child('/uploads/' + offerId + '/' + offerId + '.pdf');
if (!firebase.auth().currentUser) throw new "No user signed in, can't get download URL";
forestRef.getDownloadURL()
...

AWS Upload with multipart/form-data Invalid

I am sending a file to the presignedPOST url to upload to AWS S3 and in other resources I've found, to send a file with form-data is to switch to multipart/form-data to send a file.
This is the form data I've created is this:
fields['file'] = new File([this.get_compressed_photo],manifest.photo, {type: "image/jpeg"});
var form = new FormData();
for(let field in fields){
form.append(field+"", fields[field]);
}
try {
response = await axios.post(my_url, form, {
headers : {
"Content-Type" : "multipart/form-data",
}
});
}catch(error){
console.log(error);
}
this is the field in the form in the PARAMs for the request:
Content-Disposition: form-data; name="file"; filename="file_name.jpg"
Content-Type: image/jpeg
function() {
[native code]
}
Is something going wrong here?
UPDATE:
AWS does respond, but not with an error that is relevant to the file. I'm not sure if this means that the file is still valid, but just looking at the value for the image file, I'm not sure how.
<Error><Code>SignatureDoesNotMatch</Code>....
I'm using the aws-sdk and creating the presignedPOST url like so:
....
let path = process.env.PATH + identifier + "/" + file_name;
var url = false;
try{
const url = await s3.createPresignedPost({
Bucket: process.env.BUCKET,
Expires: (60 * 5),
Fields : {
key: path,
AWSAccessKeyId: process.env.KEY,
},
});
return url;
}catch(error){
return false;
}
....
Do I still need to add a signature to this?

I just wasted a day trying to get multipart POSTs to S3 working with AWS signature v4.
The POST kept failing with a 403 Forbidden response with SignatureDoesNotMatch. I was 100% certain my signature was correct as I was using the AWS SDK to generate it, and I knew my keys were correct.
I had my POST field name for the signature as 'Signature' rather than 'x-amz-signature' as per the docs, because changing it to 'x-amz-signature' just resulted in a 400 response instead of the 403, with an error message saying I was missing the Signature field!
It then dawned on me that S3 was trying to verify my request as if it was signed using AWS signature version 2! The fix was to use 'x-amz-signature' as per the docs, but also to make sure the 'x-amz-algorithm' field in the multipart POST data was before all others! The AWS docs do not show it like this. Clearly S3 requires this field to come first so it knows what algorithm to use.
I ended up with the following order that now works:
x-amz-algorithm
x-amz-credential
policy
x-amz-date
x-amz-signature
...

I removed the unneeded AWSAccessKeyId in the fields object. In an example somewhere I saw that it was added so I added it initially.
Removing it makes it works like a charm and I think it messes up AWS's specific required order of the fields.
....
let path = process.env.PATH + identifier + "/" + file_name;
var url = false;
try{
const url = await s3.createPresignedPost({
Bucket: process.env.BUCKET,
Expires: (60 * 5),
Fields : {
key: path, // key is the only required field here
//AWSAccessKeyId: process.env.KEY, << I COMMENTED OUT THIS LINE
},
});
return url;
}catch(error){
return false;
}
....

Upload image using Javascript port

Hi I'm trying to upload image via the Java script port. Logging seems to work and it seems the server is not receiving the "file" object. Here is my code (note this works via simulator):
Display.getInstance().openGallery(new ActionListener() {
#Override
public void actionPerformed(ActionEvent evt) {
picture = (String) evt.getSource();
if (picture != null) {
String url = "...";
MultipartRequest request = new MultipartRequest();
request.setUrl(url);
try {
request.addData("file", picture, "image/png");
request.setFilename("file", "myPicture.png");
request.setPost(true);
request.addArgument("submit", "yes");
NetworkManager.getInstance().addToQueueAndWait(request);
Log.p("initVars(..) MultipartRequest error code: "
+ request.getResponseCode(), Log.DEBUG);
String data = new String(request.getResponseData());
Log.p(data, Log.DEBUG);
} catch (IOException err) {
err.printStackTrace();
}
}
}
}, Display.GALLERY_IMAGE);

If the JavaScript deployed on the same server as the upload destination?
Assuming you are in the same server try using the build hint: javascript.inject_proxy=false. This will disable the proxy servlet and create direct communication to the JavaScript port.
If you are not in the same server make sure you are using the WAR distribution with the proxy servlet within so it can redirect your upload.

AuthorizedHandler Blocked wrong request! url: /socket.io/

I'm using mrniko/netty-socketio (Java) to start a websocket server like this:
config = new Configuration();
config.setHostname("localhost");
config.setPort(8001);
server = new SocketIOServer(config);
server.addListeners(serviceClass);
server.start();
Then I'm using (the recommended) socketio/socket.io-client (JavaScript) to try to connect to the websocket server like this (all on the same server):
var socket = io("http://localhost:8001");
The connection is "blocked" at the server with the server printing:
8239 [nioEventLoopGroup-5-1] WARN com.corundumstudio.socketio.handler.AuthorizeHandler - Blocked wrong request! url: /socket.io/, ip: /127.0.0.1:48915
28889 [nioEventLoopGroup-5-2] WARN com.corundumstudio.socketio.handler.AuthorizeHandler - Blocked wrong request! url: /socket.io/, ip: /127.0.0.1:48916
Which occurs endlessly, as the client continues to retry the connection.
I can't seem to get the server to accept the connection. I've tried:
var socket = io("ws://localhost:8001");
But that gives the same outcome. I've also tried putting a trailing slash after the URL for both cases - makes no difference. I've also tried all combinations of using "localhost" or "127.0.0.1" at both the server and client, and so on.
The JavaScript page itself is being served up from a http server on localhost:8000. This does not appear to be a cross site issue as that gives an entirely different error at the browser.
Does anyone know what is going wrong and how to fix it?

In my case network monitoring accesses that port every 10 seconds. I had temporarily changed log4j.properties to ERROR level logging, but wanted to provide networking a path to use that would not cause excessive warn logging. Not sure if this was the best approach, but this is what I ended up doing.
config.setAllowCustomRequests(true);
By allowing custom requests the piece of code displaying the warning was bypassed in Authorizehandler.
I created a custom pipeline, that allowed me to switch out the wrongUrlHandler with a custom one to allow a safe path to use for monitoring.
public class CustomSocketIOChannelInitializer extends SocketIOChannelInitializer {
CustomWrongUrlHandler customWrongUrlHandler = null;
public CustomSocketIOChannelInitializer(Configuration configuration) {
customWrongUrlHandler = new CustomWrongUrlHandler(configuration);
}
protected void initChannel(Channel ch) throws Exception {
ChannelPipeline pipeline = ch.pipeline();
addSslHandler(pipeline);
addSocketioHandlers(pipeline);
// Replace wrong url handler with our custom one to allow network monitoring without logging warnings.
pipeline.replace(SocketIOChannelInitializer.WRONG_URL_HANDLER, "CUSTOM_WRONG_URL_HANDLER", customWrongUrlHandler);
}
This is my custom handler:
#Sharable
public class CustomWrongUrlHandler extends ChannelInboundHandlerAdapter {
private final Logger log = LoggerFactory.getLogger(getClass());
Configuration configuration = null;
/**
* #param configuration
*/
public CustomWrongUrlHandler(Configuration configuration) {
this.configuration = configuration;
}
#Override
public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
if (msg instanceof FullHttpRequest) {
FullHttpRequest req = (FullHttpRequest) msg;
Channel channel = ctx.channel();
QueryStringDecoder queryDecoder = new QueryStringDecoder(req.getUri());
// Don't log when port is pinged for monitoring. Must use context that starts with /ping.
if (configuration.isAllowCustomRequests() && queryDecoder.path().startsWith("/ping")) {
HttpResponse res = new DefaultHttpResponse(HTTP_1_1, HttpResponseStatus.BAD_REQUEST);
channel.writeAndFlush(res).addListener(ChannelFutureListener.CLOSE);
req.release();
//log.info("Blocked wrong request! url: {}, ip: {}", queryDecoder.path(), channel.remoteAddress());
return;
}
// This is the last channel handler in the pipe so if it is not ping then log warning.
HttpResponse res = new DefaultHttpResponse(HTTP_1_1, HttpResponseStatus.BAD_REQUEST);
ChannelFuture f = channel.writeAndFlush(res);
f.addListener(ChannelFutureListener.CLOSE);
req.release();
log.warn("Blocked wrong socket.io-context request! url: {}, params: {}, ip: {}", channel.remoteAddress() + " " + queryDecoder.path(), queryDecoder.parameters());
}
}
}
CustomSocketIOChannelInitializer customSocketIOChannelInitializer = new CustomSocketIOChannelInitializer(config);
server.setPipelineFactory(customSocketIOChannelInitializer);

Spring 4 / ExtJs 6 File Upload - ExtJs connection refused error when file size limit exceed

I have a file upload form that's working correctly except when I send a file that is larger than the size that I've configured in Spring.
I've used the same code before on another application that was written in Spring, the difference is I was using ExtJs 4.2, now using ExtJs 6.0. As well the old app used Spring security 3, the new one 4.
The Spring side has been configured to block files that exceed 3MB.
From WebMvcConfig.java:
#Bean(name="multipartResolver")
public CommonsMultipartResolver commonsMultipartResolver()
{
ToolkitCommonsMultipartResolver resolver = new ToolkitCommonsMultipartResolver();
resolver.setMaxUploadSize(Constants.UPLOAD_MAX_FILE_SIZE);
return resolver;
}
From ToolkitCommonsMultipartResolver:
public class ToolkitCommonsMultipartResolver extends CommonsMultipartResolver {
#SuppressWarnings({ "rawtypes", "unchecked" })
#Override
protected MultipartParsingResult parseRequest(final HttpServletRequest request) {
String encoding = determineEncoding(request);
FileUpload fileUpload = prepareFileUpload(encoding);
List fileItems;
try {
fileItems = ((ServletFileUpload) fileUpload).parseRequest(request);
}
catch (FileUploadBase.SizeLimitExceededException ex) {
System.out.println("******* MultipartParsingResult limit exceeded");
request.setAttribute("fileSizeExceeded", ex);
fileItems = Collections.EMPTY_LIST;
}
catch (FileUploadException ex) {
throw new MultipartException("Could not parse multipart servlet request", ex);
}
return parseFileItems(fileItems, encoding);
}
}
My custom Controller:
#PreAuthorize("hasAuthority('ACTIVITY_CREATE_UPDATE')")
#RequestMapping(value = "/activity/editActivity", method = RequestMethod.POST, consumes="multipart/form-data", produces=MediaType.TEXT_HTML_VALUE )
public #ResponseBody String editActivity(#Valid ActivityBean bean, BindingResult result, HttpServletRequest request) {
//WebMvcConfig.commonsMultipartResolver will throw exception if file size exceeds the max size
//Passed as a request attribute
Object exception = request.getAttribute("fileSizeExceeded");
if (exception != null && FileUploadBase.SizeLimitExceededException.class.equals(exception.getClass()))
{
log.info("File too large");
String msg = "The file you sent has exceeded the maximum upload size of " + (Constants.UPLOAD_MAX_FILE_SIZE / 1000000L) + " MB.";
return "{\"success\" : false, \"msg\" : \"" + msg + "\"}";
}
...other code to process request
}
}
Spring security http tag has the following code to allow frame content to be displayed from the server (X-Frame-Options). Before I added this code all the responses were blocked (save was successful or not):
<headers>
<frame-options policy="SAMEORIGIN"/>
</headers>
Spring will return success: false with the message I've setup in the controller. In chrome, I see connection aborted (net::ERR_CONNECTION_ABORTED). Deep in ExtJs code I found the method onComplete:
/**
* Callback handler for the upload function. After we've submitted the form via the
* iframe this creates a bogus response object to simulate an XHR and populates its
* responseText from the now-loaded iframe's document body (or a textarea inside the
* body). We then clean up by removing the iframe.
* #private
*/
onComplete: function()
Inside onComplete() there is a call after the upload
doc = me.getDoc();
This method tries to access the content returned from the server in the iFrame is blocked. It seems as though the Spring security header isn't working in this case. There is a catch (e) that is throwing the error:
Uncaught DOMException: Blocked a frame with origin "http://localhost:8080" from accessing a cross-origin frame.(…)
Does anyone know how to resolve this issue? I can disable the Muitipart resolver and accept the complete file, and do size validation in my custom code. It makes more sense to block the file upload first if it exceeds the size. Is this a Spring security 4 or ExtJs6 issue?