001/*
002 *  (C) Copyright 2000-2003 Yale University. All rights reserved.
003 *
004 *  THIS SOFTWARE IS PROVIDED "AS IS," AND ANY EXPRESS OR IMPLIED
005 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
006 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE EXPRESSLY
007 *  DISCLAIMED. IN NO EVENT SHALL YALE UNIVERSITY OR ITS EMPLOYEES BE
008 *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
009 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED, THE COSTS OF
010 *  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA OR
011 *  PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
012 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
013 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
014 *  SOFTWARE, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH
015 *  DAMAGE.
016 *
017 *  Redistribution and use of this software in source or binary forms,
018 *  with or without modification, are permitted, provided that the
019 *  following conditions are met:
020 *
021 *  1. Any redistribution must include the above copyright notice and
022 *  disclaimer and this list of conditions in any related documentation
023 *  and, if feasible, in the redistributed software.
024 *
025 *  2. Any redistribution must include the acknowledgment, "This product
026 *  includes software developed by Yale University," in any related
027 *  documentation and, if feasible, in the redistributed software.
028 *
029 *  3. The names "Yale" and "Yale University" must not be used to endorse
030 *  or promote products derived from this software.
031 */
032
033package edu.yale.its.tp.cas.util;
034
035import java.io.BufferedReader;
036import java.io.IOException;
037import java.io.InputStreamReader;
038import java.net.URL;
039import java.net.URLConnection;
040
041/**
042 * A class housing some utility functions exposing secure URL validation and content retrieval. The rules are intended
043 * to be about as restrictive as a common browser with respect to server-certificate validation.
044 */
045public class SecureURL {
046
047    /**
048     * For testing only...
049     */
050    public static void main(String args[]) throws IOException {
051        System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
052        System.out.println(SecureURL.retrieve(args[0]));
053    }
054
055    /**
056     * Retrieve the contents from the given URL as a String, assuming the URL's server matches what we expect it to
057     * match.
058     */
059
060    public static String retrieve(String url) throws IOException {
061        return retrieve(url, true);
062    }
063
064    public static String retrieve(String url, Boolean force_https) throws IOException {
065        BufferedReader r = null;
066        try {
067            URL u = new URL(url);
068            if ((!u.getProtocol().equals("https")) && (force_https))
069                throw new IOException("only 'https' URLs are valid for this method");
070            URLConnection uc = u.openConnection();
071            uc.setRequestProperty("Connection", "close");
072            r = new BufferedReader(new InputStreamReader(uc.getInputStream()));
073            String line;
074            StringBuffer buf = new StringBuffer();
075            while ((line = r.readLine()) != null)
076                buf.append(line + "\n");
077            return buf.toString();
078        } finally {
079            try {
080                if (r != null)
081                    r.close();
082            } catch (IOException ex) {
083                // ignore
084            }
085        }
086    }
087}