Server whitelist

common/src/main/resources/net/adoptopenjdk/icedteaweb/i18n/Messages.properties

@@ -1103,7 +1103,13 @@ CPInvalidPort=Invalid port number given.\n[Valid port numbers are 1-65535]
 CPInvalidPortTitle=Error on input.
 
 # Control Panel - ServerwhitelistPanel
-SWPInvalidURL=Server not in whitelist.
+SWPInvalidURL=Server URL not in whitelist.
+SWPCol0Header=Specified Whitelist
+SWPCol1Header=Validated Whitelist
+SWPVALIDATEHOST=* allowed only in host''s first part and as only character.
+SWPVALIDATEIPHOST=* not allowed in IP address.
+SWPINVALIDIPHOST=Invalid IP address.
+SWPINVALIDWLURL=Invalid Whitelist Url.
 
 # command line control panel
 CLNoInfo=No information available (is this a valid option?).

common/src/main/resources/net/adoptopenjdk/icedteaweb/i18n/Messages_de.properties

@@ -956,7 +956,13 @@ CPInvalidPort=Ung\u00FCltige Anschlussnummer eingegeben.\n[G\u00FCltige Anschlus
 CPInvalidPortTitle=Eingabefehler
 
 # Control Panel - ServerwhitelistPanel
-SWPInvalidURL=Server nicht in Whitelist.
+SWPInvalidURL=Server URL nicht in Whitelist.
+SWPCol0Header=Angegebene Whitelist
+SWPCol1Header=Validierte Whitelist
+SWPVALIDATEHOST=* Nur im ersten Teil des Hosts und als einziges Zeichen zul\u00E4ssig. 
+SWPVALIDATEIPHOST=* in IP-Adresse nicht zul\u00E4ssig.
+SWPINVALIDIPHOST=Ung\u00FCltige IP-Adresse.
+SWPINVALIDWLURL=Ung\u00FCltige Whitelist-URL.
 
 # command line control panel
 CLNoInfo=Keine Informationen verf\u00FCgbar (ist dies eine g\u00FCltige Option?).

core/src/main/java/net/adoptopenjdk/icedteaweb/client/controlpanel/ControlPanel.java

@@ -53,6 +53,7 @@
 import java.awt.Component;
 import java.awt.Dimension;
 import java.awt.FlowLayout;
+import java.awt.Font;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Comparator;
@@ -231,6 +232,7 @@ private JPanel createMainSettingsPanel(final ControlPanelStyle style) {
 
 
         final JList<String> settingsList = new JList<>(panels.keySet().toArray(new String[0]));
+        settingsList.setFont(new Font(settingsList.getFont().getName(), Font.BOLD, settingsList.getFont().getSize()));
         settingsList.addListSelectionListener(e -> cardLayout.show(settingsPanel, settingsList.getSelectedValue()));
         settingsList.setSelectedIndex(0);
         DefaultListCellRenderer cellRenderer = new DefaultListCellRenderer() {

core/src/main/java/net/adoptopenjdk/icedteaweb/client/controlpanel/panels/ServerWhitelistPanel.java

@@ -20,22 +20,34 @@
 import net.adoptopenjdk.icedteaweb.Assert;
 import net.adoptopenjdk.icedteaweb.client.controlpanel.NamedBorderPanel;
 import net.adoptopenjdk.icedteaweb.i18n.Translator;
+import net.adoptopenjdk.icedteaweb.jdk89access.SunMiscLauncher;
 import net.sourceforge.jnlp.config.DeploymentConfiguration;
+import net.sourceforge.jnlp.util.whitelist.UrlWhiteListUtils;
+import net.sourceforge.jnlp.util.whitelist.WhitelistEntry;
 
-import javax.swing.JList;
+import javax.swing.BorderFactory;
+import javax.swing.ImageIcon;
 import javax.swing.JScrollPane;
+import javax.swing.JTable;
+import javax.swing.SwingConstants;
+import javax.swing.table.AbstractTableModel;
+import javax.swing.table.DefaultTableCellRenderer;
+import javax.swing.table.TableColumnModel;
+import javax.swing.table.TableModel;
 import java.awt.BorderLayout;
+import java.awt.Component;
 import java.util.List;
-import java.util.Vector;
 
-import static net.sourceforge.jnlp.config.ConfigurationConstants.KEY_SECURITY_SERVER_WHITELIST;
+import static net.adoptopenjdk.icedteaweb.i18n.Translator.R;
 
 /**
  * This provides a way for the user to display the server white list defined in <code>deployment.properties</code>.
  */
 @SuppressWarnings("serial")
 public class ServerWhitelistPanel extends NamedBorderPanel {
 
+    private static final ImageIcon WARNING_ICON = SunMiscLauncher.getSecureImageIcon("net/sourceforge/jnlp/resources/warn16.png");
+
     /**
      * This creates a new instance of the server white list panel.
      *
@@ -46,9 +58,95 @@ public ServerWhitelistPanel(final DeploymentConfiguration config) {
 
         Assert.requireNonNull(config, "config");
 
-        final List<String> whitelist = config.getPropertyAsList(KEY_SECURITY_SERVER_WHITELIST);
-        final JList<String> jList = new JList<>(new Vector<>(whitelist));
-        jList.setFixedCellHeight(20);
-        add(new JScrollPane(jList), BorderLayout.CENTER);
+        final List<WhitelistEntry> whitelist = UrlWhiteListUtils.getApplicationUrlWhiteList();
+
+        final JTable table = new JTable(createTableModel(whitelist));
+        table.getTableHeader().setReorderingAllowed(false);
+        table.setFillsViewportHeight(true);
+        table.setAutoResizeMode(JTable.AUTO_RESIZE_ALL_COLUMNS);
+        table.setAutoCreateRowSorter(true);
+
+        final TableColumnModel colModel = table.getColumnModel();
+        colModel.getColumn(0).setPreferredWidth(100);
+        colModel.getColumn(1).setPreferredWidth(250);
+
+        table.getColumnModel().getColumn(1).setCellRenderer(new EffectiveWhitelistCellRenderer());
+        final JScrollPane scrollPane = new JScrollPane(table);
+        scrollPane.setBorder(BorderFactory.createEmptyBorder(10, 10, 10, 10));
+        add(scrollPane, BorderLayout.CENTER);
+    }
+
+    private TableModel createTableModel(final List<WhitelistEntry> whitelist) {
+        final String[] colNames = {R("SWPCol0Header"), R("SWPCol1Header")};
+        return new AbstractTableModel() {
+            @Override
+            public int getRowCount() {
+                return whitelist.size();
+            }
+
+            public String getColumnName(int col) {
+                return colNames[col];
+            }
+
+            @Override
+            public int getColumnCount() {
+                return colNames.length;
+            }
+
+            @Override
+            public Object getValueAt(int rowIndex, int columnIndex) {
+                WhitelistEntry whitelistEntry = whitelist.get(rowIndex);
+                switch (columnIndex) {
+                    case 0:
+                        return whitelistEntry.getRawWhitelistEntry();
+                    case 1:
+                        return new WhitelistEntryState(whitelistEntry);
+                    default:
+                        throw new IllegalArgumentException("column index > 1 - this should not happen");
+                }
+            }
+        };
+    }
+
+    private static class WhitelistEntryState {
+        private final WhitelistEntry entry;
+
+        public WhitelistEntryState(WhitelistEntry entry) {
+            this.entry = entry;
+        }
+
+        public boolean isValid() {
+            return entry.isValid();
+        }
+
+        public String getMessage() {
+            return isValid() ? entry.getEffectiveWhitelistEntry() : R("SWPINVALIDWLURL") + ": " + entry.getErrorMessage();
+        }
+    }
+
+    private static class EffectiveWhitelistCellRenderer extends DefaultTableCellRenderer {
+
+        private EffectiveWhitelistCellRenderer() {
+            setIconTextGap(5);
+            setVerticalTextPosition(SwingConstants.CENTER);
+        }
+
+        @Override
+        public Component getTableCellRendererComponent(JTable table, Object value, boolean isSelected, boolean hasFocus, int row, int column) {
+            super.getTableCellRendererComponent(table, value, isSelected, hasFocus, row, column);
+            final WhitelistEntryState wleState = (WhitelistEntryState) value;
+            if (wleState != null) {
+                setText(wleState.getMessage());
+                if (!wleState.isValid()) {
+                    setIcon(WARNING_ICON);
+                } else {
+                    setIcon(null);
+                }
+            } else {
+                setText(null);
+                setIcon(null);
+            }
+            return this;
+        }
     }
 }

core/src/main/java/net/adoptopenjdk/icedteaweb/resources/ResourceHandler.java

@@ -2,7 +2,6 @@
 
 
 import net.adoptopenjdk.icedteaweb.Assert;
-import net.adoptopenjdk.icedteaweb.StringUtils;
 import net.adoptopenjdk.icedteaweb.client.BasicExceptionDialog;
 import net.adoptopenjdk.icedteaweb.i18n.Translator;
 import net.adoptopenjdk.icedteaweb.logging.Logger;
@@ -12,19 +11,16 @@
 import net.adoptopenjdk.icedteaweb.resources.initializer.ResourceInitializer;
 import net.sourceforge.jnlp.cache.CacheUtil;
 import net.sourceforge.jnlp.runtime.JNLPRuntime;
-import net.sourceforge.jnlp.util.IpUtil;
+import net.sourceforge.jnlp.util.whitelist.UrlWhiteListUtils;
 
 import java.io.File;
 import java.net.URL;
-import java.util.List;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.Executor;
 import java.util.concurrent.Future;
-import java.util.stream.Collectors;
 
 import static net.adoptopenjdk.icedteaweb.resources.Resource.Status.DOWNLOADED;
 import static net.adoptopenjdk.icedteaweb.resources.Resource.Status.ERROR;
-import static net.sourceforge.jnlp.config.ConfigurationConstants.KEY_SECURITY_SERVER_WHITELIST;
 import static net.sourceforge.jnlp.util.UrlUtils.FILE_PROTOCOL;
 import static net.sourceforge.jnlp.util.UrlUtils.decodeUrlQuietly;
 
@@ -125,22 +121,10 @@ private void validateWithWhitelist() {
         final URL url = resource.getLocation();
         Assert.requireNonNull(url, "url");
 
-        final List<String> whitelist = JNLPRuntime.getConfiguration().getPropertyAsList(KEY_SECURITY_SERVER_WHITELIST)
-                .stream().filter(s -> !StringUtils.isBlank(s)).collect(Collectors.toList());
-
-        if (whitelist.isEmpty()) {
-            return; // empty whitelist == allow all connections
-        }
-
-        // if host is null or "" or it is localhost or loopback
-        if (IpUtil.isLocalhostOrLoopback(url)) {
-            return; // local server need not be in whitelist
-        }
-
-        final String urlString = url.getProtocol() + "://" + url.getHost() + ((url.getPort() != -1) ? ":" + url.getPort() : "");
-
-        if (!whitelist.contains(urlString)) {
-            BasicExceptionDialog.show(new SecurityException(Translator.R("SWPInvalidURL") + ": " + resource.getLocation()));
+        // Validate with whitelist specified in deployment.properties. localhost is considered valid.
+        final boolean found = UrlWhiteListUtils.isUrlInApplicationUrlWhitelist(url);
+        if (!found) {
+            BasicExceptionDialog.show(new SecurityException(Translator.R("SWPInvalidURL") + ": " + url));
             LOG.error("Resource URL not In Whitelist: {}", resource.getLocation());
             JNLPRuntime.exit(-1);
         }

core/src/main/java/net/sourceforge/jnlp/util/IpUtil.java

@@ -7,11 +7,11 @@
 import java.net.URL;
 
 public class IpUtil {
-    public static boolean isLocalhostOrLoopback(URL url) {
+    public static boolean isLocalhostOrLoopback(final URL url) {
         return isLocalhostOrLoopback(url.getHost());
     }
 
-    public static boolean isLocalhostOrLoopback(URI uri) {
+    public static boolean isLocalhostOrLoopback(final URI uri) {
         return isLocalhostOrLoopback(uri.getHost());
     }
 
@@ -20,7 +20,7 @@ public static boolean isLocalhostOrLoopback(URI uri) {
      * @return true if the given host string is blank or represents or resolves to the hostname or the IP address
      * of localhost or the loopback address.
      */
-    static boolean isLocalhostOrLoopback(String host) {
+    static boolean isLocalhostOrLoopback(final String host) {
         if (StringUtils.isBlank(host)) {
             return true; // java.net.InetAddress.getByName(host).isLoopbackAddress() returns true
         }