Skip to content
This repository has been archived by the owner on Dec 10, 2023. It is now read-only.

[JENKINS-68708] CrowdSecurityRealm: Prevent trim() calls on null strings #98

Merged
merged 1 commit into from
Aug 8, 2022
Merged

[JENKINS-68708] CrowdSecurityRealm: Prevent trim() calls on null strings #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions src/main/java/de/theit/jenkins/crowd/CrowdSecurityRealm.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@

import jenkins.model.Jenkins;

import org.apache.commons.lang.StringUtils;
import org.kohsuke.stapler.DataBoundConstructor;
import org.kohsuke.stapler.QueryParameter;
import org.kohsuke.stapler.StaplerRequest;
Expand Down Expand Up @@ -211,10 +212,10 @@ public CrowdSecurityRealm(String url, String applicationName, Secret password, S
this.socketTimeout = socketTimeout;
this.httpTimeout = httpTimeout;
this.httpMaxConnections = httpMaxConnections;
this.url = url.trim();
this.applicationName = applicationName.trim();
this.url = StringUtils.trimToEmpty(url);
this.applicationName = StringUtils.trimToEmpty(applicationName);
this.password = password;
this.group = group.trim();
this.group = StringUtils.trimToEmpty(group);
this.nestedGroups = nestedGroups;
this.sessionValidationInterval = sessionValidationInterval;
this.useSSO = useSSO;
Expand Down Expand Up @@ -260,7 +261,7 @@ public CrowdSecurityRealm(String url, String applicationName, String password, S
String cookieTokenkey, Boolean useProxy, String httpProxyHost, String httpProxyPort,
String httpProxyUsername, String httpProxyPassword, String socketTimeout,
String httpTimeout, String httpMaxConnections, CacheConfiguration cache) {
this(url, applicationName, Secret.fromString(password.trim()), group, nestedGroups, sessionValidationInterval,
this(url, applicationName, Secret.fromString(password), group, nestedGroups, sessionValidationInterval,
useSSO,
cookieDomain, cookieTokenkey, useProxy, httpProxyHost, httpProxyPort, httpProxyUsername,
Secret.fromString(httpProxyPassword), socketTimeout, httpTimeout, httpMaxConnections, cache);
Expand Down
147 changes: 147 additions & 0 deletions src/test/java/de/theit/jenkins/crowd/CrowdSecurityRealmTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,147 @@
package de.theit.jenkins.crowd;

import de.theit.jenkins.crowd.CrowdSecurityRealm.CacheConfiguration;

import hudson.util.Secret;

import org.assertj.core.api.Assertions;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.JenkinsRule;

public class CrowdSecurityRealmTest {

// Needed for getDescriptor().save() in the compatibility constructor
@Rule public JenkinsRule jenkinsRule = new JenkinsRule();

@Test
public void testCrowdSecurityRealmConstructorWithTypicalData() {
String url = "https://crowd2/";
String applicationName = "Jenkins";
Secret password = Secret.fromString("crowd_password");
String group = "restricted_users";
boolean nestedGroups = true;
int sessionValidationInterval = 2;
boolean useSSO = true;
String cookieDomain = "cookie_domain";
String cookieTokenkey = "token_key";
boolean useProxy = true;
String httpProxyHost = "proxy_host";
String httpProxyPort = "8080";
String httpProxyUsername = "proxy_user";
Secret httpProxyPassword = Secret.fromString("proxy_password");
String socketTimeout = "20000";
String httpTimeout = "5000";
String httpMaxConnections = "20";
CacheConfiguration cache = new CacheConfiguration(20, 300);
CrowdSecurityRealm realm = new CrowdSecurityRealm(
url,
applicationName,
password,
group,
nestedGroups,
sessionValidationInterval,
useSSO,
cookieDomain,
cookieTokenkey,
useProxy,
httpProxyHost,
httpProxyPort,
httpProxyUsername,
httpProxyPassword,
socketTimeout,
httpTimeout,
httpMaxConnections,
cache);

Assertions.assertThat(realm.getCacheSize()).isEqualTo(20);
Assertions.assertThat(realm.getCacheTTL()).isEqualTo(300);
}

@Test
public void testCrowdSecurityRealmConstructorWithNullData() {
String url = null;
String applicationName = null;
Secret password = null;
String group = null;
boolean nestedGroups = false;
int sessionValidationInterval = 0;
boolean useSSO = false;
String cookieDomain = null;
String cookieTokenkey = null;
boolean useProxy = false;
String httpProxyHost = null;
String httpProxyPort = null;
String httpProxyUsername = null;
Secret httpProxyPassword = null;
String socketTimeout = null;
String httpTimeout = null;
String httpMaxConnections = null;
CacheConfiguration cache = null;
CrowdSecurityRealm realm = new CrowdSecurityRealm(
url,
applicationName,
password,
group,
nestedGroups,
sessionValidationInterval,
useSSO,
cookieDomain,
cookieTokenkey,
useProxy,
httpProxyHost,
httpProxyPort,
httpProxyUsername,
httpProxyPassword,
socketTimeout,
httpTimeout,
httpMaxConnections,
cache);

Assertions.assertThat(realm.getCacheSize()).isNull();
Assertions.assertThat(realm.getCacheTTL()).isNull();
}

@Test
public void testCrowdSecurityRealmDeprecatedConstructorWithNullData() {
String url = null;
String applicationName = null;
String password = null;
String group = null;
boolean nestedGroups = false;
int sessionValidationInterval = 0;
boolean useSSO = false;
String cookieDomain = null;
String cookieTokenkey = null;
boolean useProxy = false;
String httpProxyHost = null;
String httpProxyPort = null;
String httpProxyUsername = null;
String httpProxyPassword = null;
String socketTimeout = null;
String httpTimeout = null;
String httpMaxConnections = null;
CrowdSecurityRealm realm = new CrowdSecurityRealm(
url,
applicationName,
password,
group,
nestedGroups,
sessionValidationInterval,
useSSO,
cookieDomain,
cookieTokenkey,
useProxy,
httpProxyHost,
httpProxyPort,
httpProxyUsername,
httpProxyPassword,
socketTimeout,
httpTimeout,
httpMaxConnections);

Assertions.assertThat(realm.getCacheSize()).isNull();
Assertions.assertThat(realm.getCacheTTL()).isNull();
}

}