Add reCAPTCHA to package uploads (#8948)

Author: drewgillies

src/AccountDeleter/EmptyFeatureFlagService.cs

@@ -285,5 +285,10 @@ public bool ProxyGravatarEnSubdomain()
         {
             throw new NotImplementedException();
         }
+
+        public bool IsRecaptchaEnabledForUploads()
+        {
+            throw new NotImplementedException();
+        }
     }
 }

src/GitHubVulnerabilities2Db/Fakes/FakeFeatureFlagService.cs

@@ -284,5 +284,10 @@ public bool IsRecentPackagesNoIndexEnabled()
         {
             throw new NotImplementedException();
         }
+
+        public bool IsRecaptchaEnabledForUploads()
+        {
+            throw new NotImplementedException();
+        }
     }
 }

src/NuGetGallery.Services/Configuration/FeatureFlagService.cs

@@ -55,6 +55,7 @@ public class FeatureFlagService : IFeatureFlagService
         private const string DisplayTargetFrameworkFeatureName = GalleryPrefix + "DisplayTargetFramework";
         private const string ComputeTargetFrameworkFeatureName = GalleryPrefix + "ComputeTargetFramework";
         private const string RecentPackagesNoIndexFeatureName = GalleryPrefix + "RecentPackagesNoIndex";
+        private const string RecaptchaEnabledForUploadsName = GalleryPrefix + "RecaptchaForUploads";
 
         private const string ODataV1GetAllNonHijackedFeatureName = GalleryPrefix + "ODataV1GetAllNonHijacked";
         private const string ODataV1GetAllCountNonHijackedFeatureName = GalleryPrefix + "ODataV1GetAllCountNonHijacked";
@@ -374,5 +375,10 @@ public bool IsRecentPackagesNoIndexEnabled()
         {
             return _client.IsEnabled(RecentPackagesNoIndexFeatureName, defaultValue: false);
         }
+
+        public bool IsRecaptchaEnabledForUploads()
+        {
+            return _client.IsEnabled(RecaptchaEnabledForUploadsName, defaultValue: false);
+        }
     }
 }

src/NuGetGallery.Services/Configuration/IFeatureFlagService.cs

@@ -301,5 +301,10 @@ public interface IFeatureFlagService
         /// Whether or not recent packages has no index applied to block search engine indexing.
         /// </summary>
         bool IsRecentPackagesNoIndexEnabled();
+
+        /// <summary>
+        /// Whether or not we have reCAPTCHA enabled for package uploads
+        /// </summary>
+        bool IsRecaptchaEnabledForUploads();
     }
 }

src/NuGetGallery/App_Data/Files/Content/flags.json

@@ -31,7 +31,8 @@
     "NuGetGallery.MarkdigMdRendering": "Enabled",
     "NuGetGallery.ImageAllowlist": "Enabled",
     "NuGetGallery.ShowReportAbuseSafetyChanges": "Enabled",
-    "NuGetGallery.ComputeTargetFramework": "Enabled"
+    "NuGetGallery.ComputeTargetFramework": "Enabled",
+    "NuGetGallery.RecaptchaForUploads": "Disabled"
   },
   "Flights": {
     "NuGetGallery.TyposquattingFlight": {

src/NuGetGallery/App_Start/DefaultDependenciesModule.cs

@@ -20,6 +20,7 @@
 using Autofac;
 using Autofac.Core;
 using Autofac.Extensions.DependencyInjection;
+using Autofac.Integration.Mvc;
 using Elmah;
 using Microsoft.ApplicationInsights.Extensibility;
 using Microsoft.ApplicationInsights.Extensibility.Implementation;
@@ -47,8 +48,8 @@
 using NuGetGallery.Cookies;
 using NuGetGallery.Diagnostics;
 using NuGetGallery.Features;
+using NuGetGallery.Filters;
 using NuGetGallery.Frameworks;
-using NuGetGallery.Helpers;
 using NuGetGallery.Infrastructure;
 using NuGetGallery.Infrastructure.Authentication;
 using NuGetGallery.Infrastructure.Lucene;
@@ -509,6 +510,8 @@ protected override void Load(ContainerBuilder builder)
 
             RegisterCookieComplianceService(configuration, loggerFactory);
 
+            RegisterCustomMvcFilters(builder, configuration);
+
             builder.RegisterType<CookieExpirationService>()
                 .As<ICookieExpirationService>()
                 .SingleInstance();
@@ -860,6 +863,17 @@ private static void RegisterFeatureFlagsService(ContainerBuilder builder, Config
                 .SingleInstance();
         }
 
+        private static void RegisterCustomMvcFilters(ContainerBuilder builder, ConfigurationService configuration)
+        {
+#pragma warning disable CS4014 // VerifyPackage is not awaited because this is attachment, not execution
+            builder
+                .Register(context => new ValidateRecaptchaResponseForUploadsAttribute(context.Resolve<IFeatureFlagService>()))
+                .AsActionFilterFor<PackagesController>(controller => controller.VerifyPackage(default(VerifyPackageRequest)));
+#pragma warning restore CS4014 // VerifyPackage is not awaited because this is attachment, not execution
+
+            builder.RegisterFilterProvider();
+        }
+
         private static void RegisterMessagingService(ContainerBuilder builder, ConfigurationService configuration)
         {
             if (configuration.Current.AsynchronousEmailServiceEnabled)

src/NuGetGallery/Controllers/PackagesController.cs

@@ -326,6 +326,7 @@ private async Task<ActionResult> UploadSymbolsPackageInternal(SubmitPackageReque
             var verifyRequest = new VerifyPackageRequest(packageMetadata, accountsAllowedOnBehalfOf, existingPackageRegistration);
             verifyRequest.IsSymbolsPackage = true;
             verifyRequest.HasExistingAvailableSymbols = packageForUploadingSymbols.IsLatestSymbolPackageAvailable();
+            verifyRequest.RecaptchaEnabled = false; // No need for recaptcha for symbols packages
 
             model.InProgressUpload = verifyRequest;
 
@@ -373,6 +374,7 @@ private async Task<ActionResult> UploadPackageInternal(SubmitPackageRequest mode
             verifyRequest.LicenseFileContents = await GetLicenseFileContentsOrNullAsync(packageMetadata, packageArchiveReader);
             verifyRequest.LicenseExpressionSegments = GetLicenseExpressionSegmentsOrNull(packageMetadata.LicenseMetadata);
             verifyRequest.ReadmeFileContents = await GetReadmeFileContentsOrNullAsync(packageMetadata, packageArchiveReader);
+            verifyRequest.RecaptchaEnabled = _featureFlagService.IsRecaptchaEnabledForUploads();
 
             model.InProgressUpload = verifyRequest;
             return View(model);
@@ -2405,6 +2407,7 @@ public virtual ActionResult CancelPendingOwnershipRequest(string id, string requ
             return Redirect(Url.ManagePackageOwnership(id));
         }
 
+        /// Note that for Recaptcha filtering we attach ValidateRecaptchaResponseForUploadsAttribute directly here: <see cref="DefaultDependenciesModule.RegisterCustomMvcFilters" />.
         [UIAuthorize]
         [HttpPost]
         [RequiresAccountConfirmation("upload a package")]

src/NuGetGallery/Filters/ValidateRecaptchaResponseAttribute.cs

@@ -12,7 +12,7 @@
 namespace NuGetGallery.Filters
 {
     [AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited = true, AllowMultiple = true)]
-    public sealed class ValidateRecaptchaResponseAttribute : ActionFilterAttribute
+    public class ValidateRecaptchaResponseAttribute : ActionFilterAttribute
     {
         private const string RecaptchaResponseId = "g-recaptcha-response";
         private const string RecaptchaValidationUrl = "https://www.google.com/recaptcha/api/siteverify?secret={0}&response={1}";

src/NuGetGallery/Filters/ValidateRecaptchaResponseForUploadsAttribute.cs

@@ -0,0 +1,24 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Web.Mvc;
+
+namespace NuGetGallery.Filters
+{
+    [AttributeUsage(AttributeTargets.Method)]
+    public sealed class ValidateRecaptchaResponseForUploadsAttribute : ValidateRecaptchaResponseAttribute
+    {
+        private readonly IFeatureFlagService _featureFlagService;
+
+        public ValidateRecaptchaResponseForUploadsAttribute(IFeatureFlagService featureFlagService) => _featureFlagService = featureFlagService;
+
+        public override void OnActionExecuting(ActionExecutingContext filterContext)
+        {
+            if (_featureFlagService.IsRecaptchaEnabledForUploads())
+            {
+                base.OnActionExecuting(filterContext);
+            }
+        }
+    }
+}

src/NuGetGallery/NuGetGallery.csproj

@@ -220,6 +220,7 @@
     <Compile Include="Extensions\CakeBuildManagerExtensions.cs" />
     <Compile Include="Extensions\ImageExtensions.cs" />
     <Compile Include="Filters\AdminActionAttribute.cs" />
+    <Compile Include="Filters\ValidateRecaptchaResponseForUploadsAttribute.cs" />
     <Compile Include="Helpers\AdminHelper.cs" />
     <Compile Include="Helpers\ValidationHelper.cs" />
     <Compile Include="Helpers\ViewModelExtensions\DeleteAccountListPackageItemViewModelFactory.cs" />