Skip to content

Commit 31d07f2

Browse files
author
Anders Breid
authored
Fix bug where LDAP password was displayed when fetching EI information (#389)
* Fix bug where LDAP password was displayed when fetching EI information
1 parent 5e45b23 commit 31d07f2

File tree

3 files changed

+193
-15
lines changed

3 files changed

+193
-15
lines changed

‎src/main/java/com/ericsson/ei/controller/model/ParseInstanceInfoEI.java

Lines changed: 35 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,28 +16,32 @@
1616
*/
1717
package com.ericsson.ei.controller.model;
1818

19+
import java.io.IOException;
20+
import java.util.List;
21+
import java.util.Properties;
22+
23+
import javax.annotation.PostConstruct;
24+
25+
import org.json.JSONArray;
26+
import org.springframework.beans.factory.annotation.Autowired;
27+
import org.springframework.beans.factory.annotation.Value;
28+
import org.springframework.core.env.Environment;
29+
import org.springframework.stereotype.Component;
30+
1931
import com.ericsson.ei.erqueryservice.ERQueryService;
2032
import com.ericsson.ei.handlers.ObjectHandler;
2133
import com.ericsson.ei.handlers.RmqHandler;
2234
import com.ericsson.ei.notifications.EmailSender;
2335
import com.ericsson.ei.notifications.InformSubscriber;
2436
import com.ericsson.ei.subscription.SubscriptionHandler;
37+
import com.ericsson.ei.utils.SafeLdapServer;
2538
import com.ericsson.ei.waitlist.WaitListStorageHandler;
26-
import lombok.Getter;
2739

28-
import org.springframework.beans.factory.annotation.Autowired;
29-
import org.springframework.beans.factory.annotation.Value;
30-
import org.springframework.stereotype.Component;
31-
32-
import java.io.IOException;
33-
import java.util.List;
34-
import java.util.Properties;
35-
36-
import javax.annotation.PostConstruct;
40+
import lombok.Getter;
3741

3842
/**
39-
* Parsing all classes which contains value annotation in eiffel-intelligence plugin.
40-
* Needed for generate Json file with information about backend instance.
43+
* Parsing all classes which contains value annotation in eiffel-intelligence plugin. Needed for
44+
* generate Json file with information about backend instance.
4145
*/
4246
@Component
4347
public class ParseInstanceInfoEI {
@@ -106,7 +110,8 @@ public class ParseInstanceInfoEI {
106110
@PostConstruct
107111
public void init() throws IOException {
108112
Properties properties = new Properties();
109-
properties.load(ParseInstanceInfoEI.class.getResourceAsStream("/default-application.properties"));
113+
properties.load(
114+
ParseInstanceInfoEI.class.getResourceAsStream("/default-application.properties"));
110115
version = properties.getProperty("version");
111116
applicationName = properties.getProperty("artifactId");
112117
}
@@ -156,8 +161,23 @@ private class LdapValues {
156161
private String enabled;
157162

158163
@Getter
159-
@Value("${ldap.server.list}")
160-
private String servers;
164+
private String ldapServerList;
165+
166+
@Autowired
167+
private Environment env;
168+
169+
/**
170+
* Extracts ldap.server.list content and creates a new safe to display ldap server list.
171+
*
172+
* @throws IOException
173+
*/
174+
@PostConstruct
175+
public void init() throws IOException {
176+
final String ldapServers = env.getProperty("ldap.server.list");
177+
final JSONArray serverList = SafeLdapServer.createLdapSettingsArray(ldapServers);
178+
ldapServerList = serverList.toString(2);
179+
}
180+
161181
}
162182

163183
@Component

‎src/main/java/com/ericsson/ei/utils/SafeLdapServer.java

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
Copyright 2019 Ericsson AB.
3+
For a full list of individual contributors, please see the commit history.
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
*/
17+
package com.ericsson.ei.utils;
18+
19+
import org.apache.commons.lang3.StringUtils;
20+
import org.json.JSONArray;
21+
import org.json.JSONObject;
22+
23+
/**
24+
* This class should ensure the safety of an LDAP server list by creating a new JSONArray where the
25+
* objects inside does not have the key and value for password.
26+
*
27+
*/
28+
public class SafeLdapServer {
29+
30+
/**
31+
* By creating our own LDAP setting object to display we have control of what values are shown
32+
* to the user. This also makes it impossible to slip unwanted values by mistake if the user
33+
* configure the property with misspelled keys.
34+
*
35+
* @param String :
36+
* @return JSONArray
37+
*/
38+
public static JSONArray createLdapSettingsArray(String inputServerList) {
39+
if (StringUtils.isBlank(inputServerList)) {
40+
return new JSONArray();
41+
}
42+
JSONArray modifiedServerList = new JSONArray();
43+
44+
final JSONArray serverList = new JSONArray(inputServerList);
45+
serverList.forEach(item -> {
46+
JSONObject ldapServer = (JSONObject) item;
47+
JSONObject modifiedLdapServer = extractLdapValues(ldapServer);
48+
modifiedServerList.put(modifiedLdapServer);
49+
});
50+
return modifiedServerList;
51+
}
52+
53+
/**
54+
* Extracts the specified values from the input JSONObject to the returned JSONObject.
55+
*
56+
* @param JSONObject
57+
* @return JSONObject
58+
*/
59+
private static JSONObject extractLdapValues(JSONObject ldapServer) {
60+
JSONObject modifiedLdapServer = new JSONObject();
61+
modifiedLdapServer.put("user.filter", ldapServer.get("user.filter"));
62+
modifiedLdapServer.put("base.dn", ldapServer.get("base.dn"));
63+
modifiedLdapServer.put("username", ldapServer.get("username"));
64+
modifiedLdapServer.put("url", ldapServer.get("url"));
65+
return modifiedLdapServer;
66+
}
67+
}

‎src/test/java/com/ericsson/ei/utils/SafeLdapServerTest.java

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/*
2+
Copyright 2019 Ericsson AB.
3+
For a full list of individual contributors, please see the commit history.
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
*/
17+
package com.ericsson.ei.utils;
18+
19+
import static org.junit.Assert.assertEquals;
20+
import static org.junit.Assert.assertFalse;
21+
import static org.junit.Assert.assertTrue;
22+
23+
import java.util.Set;
24+
25+
import org.json.JSONArray;
26+
import org.json.JSONObject;
27+
import org.junit.Test;
28+
29+
public class SafeLdapServerTest {
30+
31+
private static final String PASSWORD_KEY = "password";
32+
private static final String URL_KEY = "url";
33+
private static final String URL_VALUE = "my-url";
34+
35+
private static final String SINGLE_LDAP_SERVER = "[{"
36+
+ " \"url\": \"" + URL_VALUE + "\","
37+
+ " \"base.dn\": \"\","
38+
+ " \"username\": \"\","
39+
+ " \"password\": \"\","
40+
+ " \"user.filter\": \"\""
41+
+ " }]";
42+
private static final String MULTIPLE_LDAP_SERVER = "[{"
43+
+ " \"url\": \"" + URL_VALUE + "\","
44+
+ " \"base.dn\": \"\","
45+
+ " \"username\": \"\","
46+
+ " \"password\": \"\","
47+
+ " \"user.filter\": \"\""
48+
+ " },"
49+
+ "{"
50+
+ " \"url\": \"" + URL_VALUE + "\","
51+
+ " \"base.dn\": \"\","
52+
+ " \"username\": \"\","
53+
+ " \"password\": \"\","
54+
+ " \"user.filter\": \"\""
55+
+ " }]";
56+
57+
@Test
58+
public void testSingleLdapServer() throws Exception {
59+
final JSONArray serverList = SafeLdapServer.createLdapSettingsArray(SINGLE_LDAP_SERVER);
60+
assertSafeLdapServerList(serverList);
61+
}
62+
63+
@Test
64+
public void testMultipleLdapServer() throws Exception {
65+
final JSONArray serverList = SafeLdapServer.createLdapSettingsArray(MULTIPLE_LDAP_SERVER);
66+
assertSafeLdapServerList(serverList);
67+
}
68+
69+
@Test
70+
public void testInputValueNull() throws Exception {
71+
final JSONArray serverList = SafeLdapServer.createLdapSettingsArray("");
72+
assertEquals("Safe LDAP server list should be empty", 0, serverList.length());
73+
}
74+
75+
@Test
76+
public void testInputValueEmpty() throws Exception {
77+
final JSONArray serverList = SafeLdapServer.createLdapSettingsArray("");
78+
assertEquals("Safe LDAP server list should be empty", 0, serverList.length());
79+
}
80+
81+
private void assertSafeLdapServerList(JSONArray serverList) {
82+
serverList.forEach(item -> {
83+
JSONObject ldapServer = (JSONObject) item;
84+
Set<String> keys = ldapServer.keySet();
85+
assertFalse("Safe LDAP object should not contain key password",
86+
keys.contains(PASSWORD_KEY));
87+
assertTrue("Safe LDAP object should contain key url", keys.contains(URL_KEY));
88+
assertEquals("Safe LDAP object url value", URL_VALUE, ldapServer.get(URL_KEY));
89+
});
90+
}
91+
}

0 commit comments

Comments
 (0)