Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ELY-2144] null 'error page' can cause NPE from web component #1734

Open
wants to merge 1 commit into
base: 1.x
Choose a base branch
from
Open

[ELY-2144] null 'error page' can cause NPE from web component #1734

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 3 additions & 1 deletion http/form/src/main/java/org/wildfly/security/http/form/FormAuthenticationMechanism.java
View file
Open in desktop
Expand Up @@ -395,7 +395,9 @@ private String getCompleteRedirectLocation(HttpServerRequest request, String loc
sb.append(':').append(port);
}
sb.append(contextPath);
sb.append(location);
if (location != null) {
sb.append(location);
}

return sb.toString();
}
Expand Down
3 changes: 3 additions & 0 deletions http/form/src/main/java/org/wildfly/security/http/form/FormMechanismFactory.java
View file
Open in desktop
Expand Up @@ -51,6 +51,9 @@ public FormMechanismFactory() {
public FormMechanismFactory(final Provider provider) {
}

public FormMechanismFactory(final Provider... providers) {
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where does this change come from? It seems unrelated to the Jira being addressed - is GitHub showing something it shouldn't or has this come in from a rebase?


/**
* @see org.wildfly.security.http.HttpServerAuthenticationMechanismFactory#getMechanismNames(java.util.Map)
*/
Expand Down
83 changes: 83 additions & 0 deletions tests/base/src/test/java/org/wildfly/security/http/form/FormAuthenticationMechanismTest.java
View file
Open in desktop
@@ -0,0 +1,83 @@
/*
* JBoss, Home of Professional Open Source.
* Copyright 2022 Red Hat, Inc., and individual contributors
* as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

package org.wildfly.security.http.form;

import mockit.integration.junit4.JMockit;
import org.junit.Assert;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.wildfly.security.http.HttpConstants;
import org.wildfly.security.http.HttpServerAuthenticationMechanism;
import org.wildfly.security.http.impl.AbstractBaseHttpTest;

import java.net.URI;
import java.util.HashMap;
import java.util.Map;

/**
* Test of server side of the Form HTTP mechanism.
*
* @author <a href="mailto:pberan@redhat.com">Petr Beran</a>
*/
@RunWith(JMockit.class)
public class FormAuthenticationMechanismTest extends AbstractBaseHttpTest {

/**
* Tests proper redirect in case of invalid credentials if the error page is missing
*/
@Test
public void testFormWithoutErrorPage() throws Exception {
Map<String, String> properties = new HashMap<>();
properties.put(HttpConstants.CONFIG_REALM, "Realm");
properties.put(HttpConstants.CONFIG_CONTEXT_PATH, "/application");
properties.put(HttpConstants.CONFIG_LOGIN_PAGE, "/login.jsp");
HttpServerAuthenticationMechanism mechanism = formFactory.createAuthenticationMechanism(HttpConstants.FORM_NAME,
properties, getCallbackHandler("username", "Realm", "password"));

TestingHttpServerRequest request = new TestingHttpServerRequest(HttpConstants.POST, new String[]{"", "password"},
new URI("http://localhost:8080/application/j_security_check"));
mechanism.evaluateRequest(request);
TestingHttpServerResponse response = request.getResponse();

Assert.assertEquals(response.getStatusCode(), HttpConstants.FOUND);
Assert.assertEquals("http://localhost:8080/application", response.getLocation());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @petrberan , sorry for the delay in my review. IIUC, if the authentication fails and there is no error page to redirect to, we will redirect to the context path after this change right?

Not sure if this is correct approach or we should redirect to the login page instead, which could be handled here

@fjuma WDYT?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Skyllarr @petrberan What was the behaviour before with WildFly and legacy security?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @petrberan , do you happen to know what was the legacy security behaviour?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Completely missed this thread, sorry about that @fjuma . As for the behaviour, I can't say I know. I'll try looking into it tomorrow.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Finally caught up with this issue after the work on 7.4.14 and got some findings @fjuma @Skyllarr

I reproduced the issue on Wildfly 9 (aka before Elytron) using the modified servlet-security quickstart, where I changed the authentication to FORM and copied error and login pages from ELY-921. There it worked just fine, once I removed the error page I got an NPE as well. Meaning that the behavior between WFLY 9 and now hasn't changed.

I also find out why. The form-login-config in web.xml requires form-error-page attribute, which is missing in the reproducer for this issue. The behavior is not only consistent over releases, but requires invalid configuration.

I wasn't able to find out how is the behavior supposed to be in specs or anywhere else. As such, I believe we can define our own behavior in such a case.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @fjuma @Skyllarr can I ask for a review?

}

/**
* Tests proper redirect in case of invalid credentials if the error page is configured
*/
@Test
public void testFormWithErrorPage() throws Exception {
Map<String, String> properties = new HashMap<>();
properties.put(HttpConstants.CONFIG_REALM, "Realm");
properties.put(HttpConstants.CONFIG_CONTEXT_PATH, "/application");
properties.put(HttpConstants.CONFIG_LOGIN_PAGE, "/login.jsp");
properties.put(HttpConstants.CONFIG_ERROR_PAGE, "/error.jsp");
HttpServerAuthenticationMechanism mechanism = formFactory.createAuthenticationMechanism(HttpConstants.FORM_NAME,
properties, getCallbackHandler("username", "Realm", "password"));

TestingHttpServerRequest request = new TestingHttpServerRequest(HttpConstants.POST, new String[]{"", "password"},
new URI("http://localhost:8080/application/j_security_check"));
mechanism.evaluateRequest(request);
TestingHttpServerResponse response = request.getResponse();

Assert.assertEquals(response.getStatusCode(), HttpConstants.FOUND);
Assert.assertEquals("http://localhost:8080/application/error.jsp", response.getLocation());
}
}
21 changes: 20 additions & 1 deletion tests/base/src/test/java/org/wildfly/security/http/impl/AbstractBaseHttpTest.java
View file
Open in desktop
Expand Up @@ -78,6 +78,7 @@
import org.wildfly.security.http.digest.DigestMechanismFactory;
import org.wildfly.security.http.digest.NonceManager;
import org.wildfly.security.http.external.ExternalMechanismFactory;
import org.wildfly.security.http.form.FormMechanismFactory;
import org.wildfly.security.password.Password;
import org.wildfly.security.password.PasswordFactory;
import org.wildfly.security.password.interfaces.ClearPassword;
Expand All @@ -90,6 +91,7 @@
public class AbstractBaseHttpTest {

protected HttpServerAuthenticationMechanismFactory basicFactory = new BasicMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get());
protected HttpServerAuthenticationMechanismFactory formFactory = new FormMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get());
protected HttpServerAuthenticationMechanismFactory digestFactory = new DigestMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get());
protected final HttpServerAuthenticationMechanismFactory externalFactory = new ExternalMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get());
protected HttpServerAuthenticationMechanismFactory statefulBasicFactory = new org.wildfly.security.http.sfbasic.BasicMechanismFactory(ELYTRON_PASSWORD_PROVIDERS.get());
Expand Down Expand Up @@ -155,6 +157,16 @@ public TestingHttpServerRequest(String[] authorization, URI requestURI) {
this.cookies = new ArrayList<>();
}

public TestingHttpServerRequest(String requestMethod, String[] authorization, URI requestURI) {
if (authorization != null) {
requestHeaders.put(AUTHORIZATION, Arrays.asList(authorization));
}
this.remoteUser = null;
this.requestURI = requestURI;
this.cookies = new ArrayList<>();
this.requestMethod = requestMethod;
}

public TestingHttpServerRequest(String[] authorization, URI requestURI, List<HttpServerCookie> cookies) {
if (authorization != null) {
requestHeaders.put(AUTHORIZATION, Arrays.asList(authorization));
Expand Down Expand Up @@ -308,6 +320,13 @@ public List<String> getParameterValues(String name) {
}

public String getFirstParameterValue(String name) {
List<String> key = requestHeaders.get("Authorization");
if (name == "j_username"){
return key.get(0);
}
if (name == "j_password"){
return key.get(1);
}
throw new IllegalStateException();
}

Expand Down Expand Up @@ -434,7 +453,7 @@ public OutputStream getOutputStream() {
}

public boolean forward(String path) {
throw new IllegalStateException();
return false;
}
}

Expand Down