-
Notifications
You must be signed in to change notification settings - Fork 2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
SONAR-9919 obfuscate credentials in webhook delivery logs
- Loading branch information
Showing
6 changed files
with
212 additions
and
7 deletions.
There are no files selected for viewing
103 changes: 103 additions & 0 deletions
103
server/sonar-server-common/src/main/java/org/sonar/server/webhook/HttpUrlHelper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| /* | ||
| * SonarQube | ||
| * Copyright (C) 2009-2018 SonarSource SA | ||
| * mailto:info AT sonarsource DOT com | ||
| * | ||
| * This program is free software; you can redistribute it and/or | ||
| * modify it under the terms of the GNU Lesser General Public | ||
| * License as published by the Free Software Foundation; either | ||
| * version 3 of the License, or (at your option) any later version. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
| * Lesser General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU Lesser General Public License | ||
| * along with this program; if not, write to the Free Software Foundation, | ||
| * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. | ||
| */ | ||
| package org.sonar.server.webhook; | ||
|
|
||
| import com.google.common.base.Supplier; | ||
| import java.util.Objects; | ||
| import java.util.stream.Stream; | ||
| import javax.annotation.CheckForNull; | ||
| import javax.annotation.Nullable; | ||
| import okhttp3.HttpUrl; | ||
|
|
||
| import static com.google.common.base.Preconditions.checkState; | ||
| import static org.apache.commons.lang.StringUtils.repeat; | ||
|
|
||
| final class HttpUrlHelper { | ||
| private HttpUrlHelper() { | ||
| // prevents instantiation | ||
| } | ||
|
|
||
| /** | ||
| * According to inline comment in {@link okhttp3.HttpUrl.Builder#parse(HttpUrl base, String input)}: | ||
| * <blockquote> | ||
| * Username, password and port are optional. | ||
| * [username[:password]@]host[:port] | ||
| * </blockquote> | ||
| * <p> | ||
| * This function replaces the chars of the username and the password from the {@code originalUrl} by '*' chars | ||
| * based on username and password parsed in {@code parsedUrl}. | ||
| */ | ||
| public static String toEffectiveUrl(String originalUrl, HttpUrl parsedUrl) { | ||
| String username = parsedUrl.username(); | ||
| String password = parsedUrl.password(); | ||
| if (username.isEmpty() && password.isEmpty()) { | ||
| return originalUrl; | ||
| } | ||
|
|
||
| if (!username.isEmpty() && !password.isEmpty()) { | ||
| String encodedUsername = parsedUrl.encodedUsername(); | ||
| String encodedPassword = parsedUrl.encodedPassword(); | ||
| return Stream.<Supplier<String>>of( | ||
| () -> replaceOrDie(originalUrl, username, password), | ||
| () -> replaceOrDie(originalUrl, encodedUsername, encodedPassword), | ||
| () -> replaceOrDie(originalUrl, encodedUsername, password), | ||
| () -> replaceOrDie(originalUrl, username, encodedPassword)) | ||
| .map(Supplier::get) | ||
| .filter(Objects::nonNull) | ||
| .findFirst() | ||
| .orElse(originalUrl); | ||
| } | ||
| if (!username.isEmpty()) { | ||
| return Stream.<Supplier<String>>of( | ||
| () -> replaceOrDie(originalUrl, username, null), | ||
| () -> replaceOrDie(originalUrl, parsedUrl.encodedUsername(), null)) | ||
| .map(Supplier::get) | ||
| .filter(Objects::nonNull) | ||
| .findFirst() | ||
| .orElse(originalUrl); | ||
| } | ||
| checkState(password.isEmpty(), "having a password without a username should never occur"); | ||
| return originalUrl; | ||
| } | ||
|
|
||
| @CheckForNull | ||
| private static String replaceOrDie(String original, String username, @Nullable String password) { | ||
| return replaceOrDieImpl(original, authentStringOf(username, password), obfuscatedAuthentStringOf(username, password)); | ||
| } | ||
|
|
||
| private static String authentStringOf(String username, @Nullable String password) { | ||
| if (password == null) { | ||
| return username + "@"; | ||
| } | ||
| return username + ":" + password + "@"; | ||
| } | ||
|
|
||
| private static String obfuscatedAuthentStringOf(String userName, @Nullable String password) { | ||
| return authentStringOf(repeat("*", userName.length()), password == null ? null : repeat("*", password.length())); | ||
| } | ||
|
|
||
| private static String replaceOrDieImpl(String original, String target, String replacement) { | ||
| String res = original.replace(target, replacement); | ||
| if (!res.equals(original)) { | ||
| return res; | ||
| } | ||
| return null; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
74 changes: 74 additions & 0 deletions
74
server/sonar-server-common/src/test/java/org/sonar/server/webhook/HttpUrlHelperTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| /* | ||
| * SonarQube | ||
| * Copyright (C) 2009-2018 SonarSource SA | ||
| * mailto:info AT sonarsource DOT com | ||
| * | ||
| * This program is free software; you can redistribute it and/or | ||
| * modify it under the terms of the GNU Lesser General Public | ||
| * License as published by the Free Software Foundation; either | ||
| * version 3 of the License, or (at your option) any later version. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
| * Lesser General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU Lesser General Public License | ||
| * along with this program; if not, write to the Free Software Foundation, | ||
| * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. | ||
| */ | ||
| package org.sonar.server.webhook; | ||
|
|
||
| import com.tngtech.java.junit.dataprovider.DataProvider; | ||
| import com.tngtech.java.junit.dataprovider.DataProviderRunner; | ||
| import com.tngtech.java.junit.dataprovider.UseDataProvider; | ||
| import java.util.ArrayList; | ||
| import java.util.Arrays; | ||
| import java.util.List; | ||
| import okhttp3.HttpUrl; | ||
| import org.junit.Test; | ||
| import org.junit.runner.RunWith; | ||
|
|
||
| import static org.apache.commons.lang.StringUtils.repeat; | ||
| import static org.assertj.core.api.Assertions.assertThat; | ||
|
|
||
| @RunWith(DataProviderRunner.class) | ||
| public class HttpUrlHelperTest { | ||
|
|
||
| @Test | ||
| @UseDataProvider("toEffectiveUrlUseCases") | ||
| public void verify_toEffectiveUrl(String originalUrl, String expectedUrl) { | ||
| assertThat(HttpUrlHelper.toEffectiveUrl(originalUrl, HttpUrl.parse(originalUrl))).isEqualTo(expectedUrl); | ||
| } | ||
|
|
||
| @DataProvider | ||
| public static Object[][] toEffectiveUrlUseCases() { | ||
| List<Object[]> rows = new ArrayList<>(); | ||
| for (String before : Arrays.asList("http://", "https://")) { | ||
| for (String host : Arrays.asList("foo", "127.0.0.1", "[2001:db8:85a3:0:0:8a2e:370:7334]", "[2001:0db8:85a3:0000:0000:8a2e:0370:7334]")) { | ||
| for (String port : Arrays.asList("", ":123")) { | ||
| for (String after : Arrays.asList("", "/", "/bar", "/bar/", "?", "?a=b", "?a=b&c=d")) { | ||
| for (String username : Arrays.asList("", "us", "a b", "a%20b")) { | ||
| for (String password : Arrays.asList("", "pwd", "pwd%20k", "pwd k", "c:d")) { | ||
| if (username.isEmpty()) { | ||
| String url = before + host + port + after; | ||
| rows.add(new Object[] {url, url}); | ||
| } else if (password.isEmpty()) { | ||
| String url = before + username + '@' + host + port + after; | ||
| String expected = before + repeat("*", username.length()) + '@' + host + port + after; | ||
| rows.add(new Object[] {url, expected}); | ||
| } else { | ||
| String url = before + username + ':' + password + '@' + host + port + after; | ||
| String expected = before + repeat("*", username.length()) + ':' + repeat("*", password.length()) + '@' + host + port + after; | ||
| rows.add(new Object[] {url, expected}); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| return rows.toArray(new Object[0][]); | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters