Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor error messages #2

Merged
merged 1 commit into from
Dec 23, 2024
+43 −62
Merged

refactor error messages #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions utils/src/main/java/org/owasp/dependencycheck/utils/CredentialHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,21 +13,21 @@
import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;

public class CredentialHelper {
public static Credentials getCredentials(String messageScope, String theUser, char[] thePass, char[] theToken, char[] theAuth) throws InvalidSettingException {
public static Credentials getCredentials(String theUser, char[] thePass, char[] theToken, char[] theAuth) throws InvalidSettingException {
Credentials _creds = null;

// create a basic auth for user and password, if provided
if (theUser != null && !theUser.isBlank()) {
if(thePass == null || thePass.length == 0)
throw new InvalidSettingException("No password provided for user " + theUser + " for " + messageScope);
throw new InvalidSettingException("no password provided for user " + theUser);
try {
_creds = new UsernamePasswordCredentials(theUser, thePass);
} catch (Exception e) {
throw new InvalidSettingException("Invalid authentication provided: invalid user or password");
throw new InvalidSettingException("invalid user or password");
}
}

// create a bearer token, if provided, takes precedence over user/password/token
// create a bearer token, if provided, takes precedence over user/password
if (theToken != null && theToken.length > 0) {
_creds = new BearerToken(new String(theToken));
}
Expand All @@ -39,8 +39,8 @@ public static Credentials getCredentials(String messageScope, String theUser, ch
} else if(startsWith(theAuth, StandardAuthScheme.BEARER)) {
_creds = getBearerCredentialsFromAuthHeader(theAuth);
} else
throw new InvalidSettingException("Invalid authentication provided: unknown authentication scheme. "
+ "Supported authentication schemes: "
throw new InvalidSettingException("unknown authentication scheme. "
+ "Supported authentication schemes are "
+ StandardAuthScheme.BASIC + " and " + StandardAuthScheme.BEARER);
}
return _creds;
Expand All @@ -65,7 +65,7 @@ protected static Credentials getBearerCredentialsFromAuthHeader(char[] authHeade
throw new InvalidSettingException("empty bearer token");
return new BearerToken(token);
} catch (Exception e) {
throw new InvalidSettingException("Invalid authentication provided: " + e.getMessage());
throw new InvalidSettingException(e.getMessage());
}
}

Expand All @@ -86,7 +86,7 @@ protected static Credentials getBasicCredentialsFromAuthHeader(char[] authHeader
getBasicPassword(authHeader, StandardAuthScheme.BASIC.length() + 1)
);
} catch (Exception e) {
throw new InvalidSettingException("Invalid authentication provided: " + e.getMessage());
throw new InvalidSettingException(e.getMessage());
}
}

Expand All @@ -101,9 +101,9 @@ protected static Credentials getBasicCredentialsFromAuthHeader(char[] authHeader
*/
protected static byte[] toBytes(char[] in, int start) throws InvalidSettingException {
if (in == null || in.length == 0)
throw new InvalidSettingException("Invalid authentication provided");
throw new InvalidSettingException("empty authentication provided");
if(start >= in.length)
throw new InvalidSettingException("Invalid authentication provided");
throw new InvalidSettingException("invalid authentication provided - too short");
char[] chars = new char[in.length - start];
for(int i = start; i < in.length; i++) {
chars[i-start] = in[i];
Expand All @@ -125,9 +125,9 @@ protected static byte[] toBytes(char[] in, int start) throws InvalidSettingExcep
*/
protected static String getBasicUser(char[] in, int start) throws InvalidSettingException {
if (in == null || in.length == 0)
throw new InvalidSettingException("Invalid authentication string");
throw new InvalidSettingException("invalid authentication string for the username");
if(start >= in.length)
throw new InvalidSettingException("authentication string too short");
throw new InvalidSettingException("authentication string too short for the username");
byte[] src = toBytes(in, start);
if(src == null || src.length ==0)
return null;
Expand All @@ -137,7 +137,7 @@ protected static String getBasicUser(char[] in, int start) throws InvalidSetting
if(decoded[i]!=':') user += (char) decoded[i];
else return user;
}
throw new InvalidSettingException("unable to find user");
throw new InvalidSettingException("unable to find the username");
}

/**
Expand All @@ -149,9 +149,9 @@ protected static String getBasicUser(char[] in, int start) throws InvalidSetting
*/
protected static char[] getBasicPassword(char[] in, int start) throws InvalidSettingException {
if (in == null || in.length == 0)
throw new InvalidSettingException("Invalid authentication string");
throw new InvalidSettingException("invalid authentication string for the pasword");
if(start >= in.length)
throw new InvalidSettingException("authentication string too short");
throw new InvalidSettingException("authentication string too short for the password");
byte[] src = toBytes(in, start);
if(src == null || src.length ==0)
return null;
Expand All @@ -161,7 +161,7 @@ protected static char[] getBasicPassword(char[] in, int start) throws InvalidSet
if(decoded[i] == ':') start = i + 1;
}
if(start == 0 || start >= decoded.length)
throw new InvalidSettingException("unable to find password");
throw new InvalidSettingException("unable to find the password");

char[] password = new char[decoded.length - start];
for(int i = start; i < decoded.length; i++) {
Expand Down
6 changes: 4 additions & 2 deletions utils/src/main/java/org/owasp/dependencycheck/utils/Downloader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,10 +318,12 @@ private void addConfiguredCredentials(Settings settings, CredentialsStore store,
}
try {
final URL parsedURL = new URL(theURL);
Credentials creds = CredentialHelper.getCredentials(parsedURL.toString(), theUser, thePass, theToken, theAuth);
Credentials creds = CredentialHelper.getCredentials(theUser, thePass, theToken, theAuth);
addCredentials(store, desc, parsedURL, creds);
} catch (MalformedURLException e) {
throw new InvalidSettingException(desc + " URL must be a valid URL", e);
} catch (InvalidSettingException e) {
throw new InvalidSettingException("Invalid configuration for " + desc, e);
}
}

Expand Down Expand Up @@ -493,7 +495,7 @@ public void fetchFile(URL url, File outputPath, boolean useProxy,
try {
final HttpClientContext context = HttpClientContext.create();
final BasicCredentialsProvider localCredentials = new BasicCredentialsProvider();
Credentials creds = CredentialHelper.getCredentials(url.toString(),settings.getString(userKey), settings.getString(passwordKey, "").toCharArray(),
Credentials creds = CredentialHelper.getCredentials(settings.getString(userKey), settings.getString(passwordKey, "").toCharArray(),
settings.getString(tokenKey, "").toCharArray(), settings.getString(authKey, "").toCharArray());
addCredentials(localCredentials, url.toString(), url, creds);
context.setCredentialsProvider(localCredentials);
Expand Down
67 changes: 23 additions & 44 deletions utils/src/test/java/org/owasp/dependencycheck/utils/CredentialHelperTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;

import java.net.URL;
import java.util.Base64;
import java.util.UUID;

Expand Down Expand Up @@ -79,35 +78,28 @@ public void testCredsBasic() throws Exception {
String password = "P1-" + UUID.randomUUID().toString();

// no auth
URL url = new URL("http://127.0.0.1/index.cgi");
checkBasicCreds(url, user, password, "", "", user, password);
url = new URL("https://127.0.0.1/index.cgi");
checkBasicCreds(url, user, password, "", "", user, password);
checkBasicCreds(user, password, "", "", user, password);
checkBasicCreds(user, password, "", "", user, password);

// user, password and auth
String user2 = "U2-" + UUID.randomUUID().toString();
String password2 = "P2-" + UUID.randomUUID().toString();
String b64 = StandardAuthScheme.BASIC + " "
+ Base64.getEncoder().encodeToString((user2+":"+password2).getBytes());
url = new URL("http://127.0.0.1/index.cgi");
checkBasicCreds(url, user, password, "", b64, user2, password2);
url = new URL("https://127.0.0.1/index.cgi");
checkBasicCreds(url, user, password, "", b64, user2, password2);
checkBasicCreds(user, password, "", b64, user2, password2);
checkBasicCreds(user, password, "", b64, user2, password2);

// only auth
url = new URL("http://127.0.0.1/index.cgi");
checkBasicCreds(url, null, null, "", b64, user2, password2);
url = new URL("https://127.0.0.1/index.cgi");
checkBasicCreds(url, null, null, "", b64, user2, password2);
checkBasicCreds(null, null, "", b64, user2, password2);
checkBasicCreds(null, null, "", b64, user2, password2);
}

@Test
public void testCredsBasicException() throws Exception {
// no password
URL url = new URL("https://127.0.0.1/index.cgi");
String pfx = "U-";
checkException(url, pfx+UUID.randomUUID().toString(), null, null, "no password", pfx);
checkException(url, null, null, UUID.randomUUID().toString(),
checkException(pfx+UUID.randomUUID().toString(), null, null, "no password", pfx);
checkException(null, null, UUID.randomUUID().toString(),
"supported", StandardAuthScheme.BASIC, StandardAuthScheme.BEARER);
}

Expand Down Expand Up @@ -144,37 +136,29 @@ public void testCredsTokenAuth() throws Exception {
String auth = StandardAuthScheme.BEARER + " " + token;

// with user / password
URL url = new URL("http://127.0.0.1/index.cgi");
checkTokenCreds(url, user, password, "", auth, token);
url = new URL("https://127.0.0.1/index.cgi");
checkTokenCreds(url, user, password, "", auth, token);
checkTokenCreds(user, password, "", auth, token);
checkTokenCreds(user, password, "", auth, token);

// without user / password
url = new URL("http://127.0.0.1/index.cgi");
checkTokenCreds(url, null, null, "", auth, token);
url = new URL("https://127.0.0.1/index.cgi");
checkTokenCreds(url, null, null, "", auth, token);
checkTokenCreds(null, null, "", auth, token);
checkTokenCreds(null, null, "", auth, token);
}


@Test
public void testCredsToken() throws Exception {
String token = "token-" + UUID.randomUUID();
URL url;


// without user / password
url = new URL("http://127.0.0.1/index.cgi");
checkTokenCreds(url, null, null, token, "", token);
url = new URL("https://127.0.0.1/index.cgi");
checkTokenCreds(url, null, null, token, "", token);
checkTokenCreds(null, null, token, "", token);
checkTokenCreds(null, null, token, "", token);
}

@Test
public void testCredsTokenException() throws Exception {
String auth = StandardAuthScheme.BEARER + " ";
URL url = new URL("https://127.0.0.1/index.cgi");
checkException(url, null, null, null, auth, "empty bearer token");
checkException(url, null, null, null, StandardAuthScheme.BEARER, "should start with");
checkException(null, null, null, auth, "empty bearer token");
checkException(null, null, null, StandardAuthScheme.BEARER, "should start with");
}


Expand All @@ -184,14 +168,13 @@ public void testCredsTokenException() throws Exception {
// private test methods
///////////////////////////////////////////////////

private void checkException(URL url, String user, String password, String token,
private void checkException(String user, String password, String token,
String auth, String ... messages) throws Exception {
if(password == null) password = "";
if(auth == null) auth = "";
if(token == null) token = "";
try {
CredentialHelper.getCredentials(url.toString(),
user, password.toCharArray(),
CredentialHelper.getCredentials(user, password.toCharArray(),
token.toCharArray(), auth.toCharArray());
throw new Exception("should have thrown an InvalidSettingException");
} catch(InvalidSettingException ok) {
Expand All @@ -206,15 +189,12 @@ private void checkException(URL url, String user, String password, String token,
}




private void checkTokenCreds(URL url, String user, String password, String token, String auth,
private void checkTokenCreds(String user, String password, String token, String auth,
String expectedToken) throws Exception {
if(password == null) password = "";
if(auth == null) auth = "";
if(token == null) token = "";
Credentials creds = CredentialHelper.getCredentials(url.toString(),
user, password.toCharArray(),
Credentials creds = CredentialHelper.getCredentials(user, password.toCharArray(),
token.toCharArray(), auth.toCharArray());

assertTrue(creds instanceof BearerToken);
Expand All @@ -223,13 +203,12 @@ private void checkTokenCreds(URL url, String user, String password, String token
}


private void checkBasicCreds(URL url, String user, String password,
private void checkBasicCreds(String user, String password,
String token, String auth,
String expectedUser, String expectedPassword) throws Exception {
if(password == null) password = "";
if(token == null) token = "";
Credentials creds = CredentialHelper.getCredentials(url.toString(),
user, password.toCharArray(),
Credentials creds = CredentialHelper.getCredentials(user, password.toCharArray(),
token.toCharArray(), auth.toCharArray());

assertTrue(creds instanceof UsernamePasswordCredentials);
Expand Down