From bd99dd749c80f82f53027cd547c011fc1a6c3503 Mon Sep 17 00:00:00 2001 From: petrberan Date: Mon, 25 Jul 2022 16:13:47 +0200 Subject: [PATCH] [ELY-2144] null 'error page' can cause NPE from web component --- .../form/FormAuthenticationMechanism.java | 4 +- .../http/form/FormMechanismFactory.java | 3 + .../form/FormAuthenticationMechanismTest.java | 83 +++++++++++++++++++ .../http/impl/AbstractBaseHttpTest.java | 21 ++++- 4 files changed, 109 insertions(+), 2 deletions(-) create mode 100644 tests/base/src/test/java/org/wildfly/security/http/form/FormAuthenticationMechanismTest.java diff --git a/http/form/src/main/java/org/wildfly/security/http/form/FormAuthenticationMechanism.java b/http/form/src/main/java/org/wildfly/security/http/form/FormAuthenticationMechanism.java index 608e55a62ee..b59fa7a2953 100644 --- a/http/form/src/main/java/org/wildfly/security/http/form/FormAuthenticationMechanism.java +++ b/http/form/src/main/java/org/wildfly/security/http/form/FormAuthenticationMechanism.java @@ -395,7 +395,9 @@ private String getCompleteRedirectLocation(HttpServerRequest request, String loc sb.append(':').append(port); } sb.append(contextPath); - sb.append(location); + if (location != null) { + sb.append(location); + } return sb.toString(); } diff --git a/http/form/src/main/java/org/wildfly/security/http/form/FormMechanismFactory.java b/http/form/src/main/java/org/wildfly/security/http/form/FormMechanismFactory.java index 4dda33af745..25d92e7bc1e 100644 --- a/http/form/src/main/java/org/wildfly/security/http/form/FormMechanismFactory.java +++ b/http/form/src/main/java/org/wildfly/security/http/form/FormMechanismFactory.java @@ -51,6 +51,9 @@ public FormMechanismFactory() { public FormMechanismFactory(final Provider provider) { } + public FormMechanismFactory(final Provider... providers) { + } + /** * @see org.wildfly.security.http.HttpServerAuthenticationMechanismFactory#getMechanismNames(java.util.Map) */ diff --git a/tests/base/src/test/java/org/wildfly/security/http/form/FormAuthenticationMechanismTest.java b/tests/base/src/test/java/org/wildfly/security/http/form/FormAuthenticationMechanismTest.java new file mode 100644 index 00000000000..b107589e50b --- /dev/null +++ b/tests/base/src/test/java/org/wildfly/security/http/form/FormAuthenticationMechanismTest.java @@ -0,0 +1,83 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2022 Red Hat, Inc., and individual contributors + * as indicated by the @author tags. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.wildfly.security.http.form; + +import mockit.integration.junit4.JMockit; +import org.junit.Assert; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.wildfly.security.http.HttpConstants; +import org.wildfly.security.http.HttpServerAuthenticationMechanism; +import org.wildfly.security.http.impl.AbstractBaseHttpTest; + +import java.net.URI; +import java.util.HashMap; +import java.util.Map; + +/** + * Test of server side of the Form HTTP mechanism. + * + * @author Petr Beran + */ +@RunWith(JMockit.class) +public class FormAuthenticationMechanismTest extends AbstractBaseHttpTest { + + /** + * Tests proper redirect in case of invalid credentials if the error page is missing + */ + @Test + public void testFormWithoutErrorPage() throws Exception { + Map properties = new HashMap<>(); + properties.put(HttpConstants.CONFIG_REALM, "Realm"); + properties.put(HttpConstants.CONFIG_CONTEXT_PATH, "/application"); + properties.put(HttpConstants.CONFIG_LOGIN_PAGE, "/login.jsp"); + HttpServerAuthenticationMechanism mechanism = formFactory.createAuthenticationMechanism(HttpConstants.FORM_NAME, + properties, getCallbackHandler("username", "Realm", "password")); + + TestingHttpServerRequest request = new TestingHttpServerRequest(HttpConstants.POST, new String[]{"", "password"}, + new URI("http://localhost:8080/application/j_security_check")); + mechanism.evaluateRequest(request); + TestingHttpServerResponse response = request.getResponse(); + + Assert.assertEquals(response.getStatusCode(), HttpConstants.FOUND); + Assert.assertEquals("http://localhost:8080/application", response.getLocation()); + } + + /** + * Tests proper redirect in case of invalid credentials if the error page is configured + */ + @Test + public void testFormWithErrorPage() throws Exception { + Map properties = new HashMap<>(); + properties.put(HttpConstants.CONFIG_REALM, "Realm"); + properties.put(HttpConstants.CONFIG_CONTEXT_PATH, "/application"); + properties.put(HttpConstants.CONFIG_LOGIN_PAGE, "/login.jsp"); + properties.put(HttpConstants.CONFIG_ERROR_PAGE, "/error.jsp"); + HttpServerAuthenticationMechanism mechanism = formFactory.createAuthenticationMechanism(HttpConstants.FORM_NAME, + properties, getCallbackHandler("username", "Realm", "password")); + + TestingHttpServerRequest request = new TestingHttpServerRequest(HttpConstants.POST, new String[]{"", "password"}, + new URI("http://localhost:8080/application/j_security_check")); + mechanism.evaluateRequest(request); + TestingHttpServerResponse response = request.getResponse(); + + Assert.assertEquals(response.getStatusCode(), HttpConstants.FOUND); + Assert.assertEquals("http://localhost:8080/application/error.jsp", response.getLocation()); + } +} diff --git a/tests/base/src/test/java/org/wildfly/security/http/impl/AbstractBaseHttpTest.java b/tests/base/src/test/java/org/wildfly/security/http/impl/AbstractBaseHttpTest.java index 52c7bde6181..2d16165f98f 100644 --- a/tests/base/src/test/java/org/wildfly/security/http/impl/AbstractBaseHttpTest.java +++ b/tests/base/src/test/java/org/wildfly/security/http/impl/AbstractBaseHttpTest.java @@ -78,6 +78,7 @@ import org.wildfly.security.http.digest.DigestMechanismFactory; import org.wildfly.security.http.digest.NonceManager; import org.wildfly.security.http.external.ExternalMechanismFactory; +import org.wildfly.security.http.form.FormMechanismFactory; import org.wildfly.security.password.Password; import org.wildfly.security.password.PasswordFactory; import org.wildfly.security.password.interfaces.ClearPassword; @@ -90,6 +91,7 @@ public class AbstractBaseHttpTest { protected HttpServerAuthenticationMechanismFactory basicFactory = new BasicMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get()); + protected HttpServerAuthenticationMechanismFactory formFactory = new FormMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get()); protected HttpServerAuthenticationMechanismFactory digestFactory = new DigestMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get()); protected final HttpServerAuthenticationMechanismFactory externalFactory = new ExternalMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get()); protected HttpServerAuthenticationMechanismFactory statefulBasicFactory = new org.wildfly.security.http.sfbasic.BasicMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get()); @@ -155,6 +157,16 @@ public TestingHttpServerRequest(String[] authorization, URI requestURI) { this.cookies = new ArrayList<>(); } + public TestingHttpServerRequest(String requestMethod, String[] authorization, URI requestURI) { + if (authorization != null) { + requestHeaders.put(AUTHORIZATION, Arrays.asList(authorization)); + } + this.remoteUser = null; + this.requestURI = requestURI; + this.cookies = new ArrayList<>(); + this.requestMethod = requestMethod; + } + public TestingHttpServerRequest(String[] authorization, URI requestURI, List cookies) { if (authorization != null) { requestHeaders.put(AUTHORIZATION, Arrays.asList(authorization)); @@ -308,6 +320,13 @@ public List getParameterValues(String name) { } public String getFirstParameterValue(String name) { + List key = requestHeaders.get("Authorization"); + if (name == "j_username"){ + return key.get(0); + } + if (name == "j_password"){ + return key.get(1); + } throw new IllegalStateException(); } @@ -434,7 +453,7 @@ public OutputStream getOutputStream() { } public boolean forward(String path) { - throw new IllegalStateException(); + return false; } }