source.dussan.org Git - sonarqube.git/blob

   1 /*
   2  * SonarQube
   3  * Copyright (C) 2009-2023 SonarSource SA
   4  * mailto:info AT sonarsource DOT com
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 3 of the License, or (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public License
  17  * along with this program; if not, write to the Free Software Foundation,
  18  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  19  */
  20 package org.sonar.server.authentication.event;
  21
  22 import com.google.common.base.Joiner;
  23 import java.util.Arrays;
  24 import java.util.Collections;
  25 import java.util.List;
  26 import java.util.stream.Collectors;
  27 import org.junit.Before;
  28 import org.junit.Rule;
  29 import org.junit.Test;
  30 import org.slf4j.event.Level;
  31 import org.sonar.api.server.http.HttpRequest;
  32 import org.sonar.api.testfixtures.log.LogTester;
  33 import org.sonar.api.utils.log.LoggerLevel;
  34
  35 import static java.util.Arrays.asList;
  36 import static org.assertj.core.api.Assertions.assertThat;
  37 import static org.assertj.core.api.Assertions.assertThatThrownBy;
  38 import static org.mockito.Mockito.mock;
  39 import static org.mockito.Mockito.verifyNoInteractions;
  40 import static org.mockito.Mockito.when;
  41 import static org.sonar.server.authentication.event.AuthenticationEvent.Method;
  42 import static org.sonar.server.authentication.event.AuthenticationEvent.Source;
  43 import static org.sonar.server.authentication.event.AuthenticationException.newBuilder;
  44
  45 public class AuthenticationEventImplTest {
  46   private static final String LOGIN_129_CHARS = "012345678901234567890123456789012345678901234567890123456789" +
  47     "012345678901234567890123456789012345678901234567890123456789012345678";
  48
  49   @Rule
  50   public LogTester logTester = new LogTester();
  51
  52   private final AuthenticationEventImpl underTest = new AuthenticationEventImpl();
  53
  54   @Before
  55   public void setUp() {
  56     logTester.setLevel(LoggerLevel.DEBUG);
  57   }
  58
  59   @Test
  60   public void login_success_fails_with_NPE_if_request_is_null() {
  61     logTester.setLevel(LoggerLevel.INFO);
  62
  63     Source sso = Source.sso();
  64     assertThatThrownBy(() -> underTest.loginSuccess(null, "login", sso))
  65       .isInstanceOf(NullPointerException.class)
  66       .hasMessage("request can't be null");
  67   }
  68
  69   @Test
  70   public void login_success_fails_with_NPE_if_source_is_null() {
  71     logTester.setLevel(LoggerLevel.INFO);
  72
  73     assertThatThrownBy(() -> underTest.loginSuccess(mock(HttpRequest.class), "login", null))
  74       .isInstanceOf(NullPointerException.class)
  75       .hasMessage("source can't be null");
  76   }
  77
  78   @Test
  79   public void login_success_does_not_interact_with_request_if_log_level_is_above_DEBUG() {
  80     HttpRequest request = mock(HttpRequest.class);
  81     logTester.setLevel(LoggerLevel.INFO);
  82
  83     underTest.loginSuccess(request, "login", Source.sso());
  84
  85     verifyNoInteractions(request);
  86   }
  87
  88   @Test
  89   public void login_success_creates_DEBUG_log_with_empty_login_if_login_argument_is_null() {
  90     underTest.loginSuccess(mockRequest(), null, Source.sso());
  91
  92     verifyLog("login success [method|SSO][provider|SSO|sso][IP||][login|]");
  93   }
  94
  95   @Test
  96   public void login_success_creates_DEBUG_log_with_method_provider_and_login() {
  97     underTest.loginSuccess(mockRequest(), "foo", Source.realm(Method.BASIC, "some provider name"));
  98
  99     verifyLog("login success [method|BASIC][provider|REALM|some provider name][IP||][login|foo]");
 100   }
 101
 102   @Test
 103   public void login_success_prevents_log_flooding_on_login_starting_from_128_chars() {
 104     underTest.loginSuccess(mockRequest(), LOGIN_129_CHARS, Source.realm(Method.BASIC, "some provider name"));
 105
 106     verifyLog("login success [method|BASIC][provider|REALM|some provider name][IP||][login|012345678901234567890123456789012345678901234567890123456789" +
 107       "01234567890123456789012345678901234567890123456789012345678901234567...(129)]");
 108   }
 109
 110   @Test
 111   public void login_success_logs_remote_ip_from_request() {
 112     underTest.loginSuccess(mockRequest("1.2.3.4"), "foo", Source.realm(Method.EXTERNAL, "bar"));
 113
 114     verifyLog("login success [method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|][login|foo]");
 115   }
 116
 117   @Test
 118   public void login_success_logs_X_Forwarded_For_header_from_request() {
 119     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 120     underTest.loginSuccess(request, "foo", Source.realm(Method.EXTERNAL, "bar"));
 121
 122     verifyLog("login success [method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5][login|foo]");
 123   }
 124
 125   @Test
 126   public void login_success_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 127     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 128     underTest.loginSuccess(request, "foo", Source.realm(Method.EXTERNAL, "bar"));
 129
 130     verifyLog("login success [method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4][login|foo]");
 131   }
 132
 133   @Test
 134   public void login_failure_fails_with_NPE_if_request_is_null() {
 135     logTester.setLevel(LoggerLevel.INFO);
 136
 137     AuthenticationException exception = newBuilder().setSource(Source.sso()).build();
 138     assertThatThrownBy(() -> underTest.loginFailure(null, exception))
 139       .isInstanceOf(NullPointerException.class)
 140       .hasMessage("request can't be null");
 141   }
 142
 143   @Test
 144   public void login_failure_fails_with_NPE_if_AuthenticationException_is_null() {
 145     logTester.setLevel(LoggerLevel.INFO);
 146
 147     assertThatThrownBy(() -> underTest.loginFailure(mock(HttpRequest.class), null))
 148       .isInstanceOf(NullPointerException.class)
 149       .hasMessage("AuthenticationException can't be null");
 150   }
 151
 152   @Test
 153   public void login_failure_does_not_interact_with_arguments_if_log_level_is_above_DEBUG() {
 154     HttpRequest request = mock(HttpRequest.class);
 155     AuthenticationException exception = mock(AuthenticationException.class);
 156     logTester.setLevel(LoggerLevel.INFO);
 157
 158     underTest.loginFailure(request, exception);
 159
 160     verifyNoInteractions(request, exception);
 161   }
 162
 163   @Test
 164   public void login_failure_creates_DEBUG_log_with_empty_login_if_AuthenticationException_has_no_login() {
 165     AuthenticationException exception = newBuilder().setSource(Source.sso()).setMessage("message").build();
 166     underTest.loginFailure(mockRequest(), exception);
 167
 168     verifyLog("login failure [cause|message][method|SSO][provider|SSO|sso][IP||][login|]");
 169   }
 170
 171   @Test
 172   public void login_failure_creates_DEBUG_log_with_empty_cause_if_AuthenticationException_has_no_message() {
 173     AuthenticationException exception = newBuilder().setSource(Source.sso()).setLogin("FoO").build();
 174     underTest.loginFailure(mockRequest(), exception);
 175
 176     verifyLog("login failure [cause|][method|SSO][provider|SSO|sso][IP||][login|FoO]");
 177   }
 178
 179   @Test
 180   public void login_failure_creates_DEBUG_log_with_method_provider_and_login() {
 181     AuthenticationException exception = newBuilder()
 182       .setSource(Source.realm(Method.BASIC, "some provider name"))
 183       .setMessage("something got terribly wrong")
 184       .setLogin("BaR")
 185       .build();
 186     underTest.loginFailure(mockRequest(), exception);
 187
 188     verifyLog("login failure [cause|something got terribly wrong][method|BASIC][provider|REALM|some provider name][IP||][login|BaR]");
 189   }
 190
 191   @Test
 192   public void login_failure_prevents_log_flooding_on_login_starting_from_128_chars() {
 193     AuthenticationException exception = newBuilder()
 194       .setSource(Source.realm(Method.BASIC, "some provider name"))
 195       .setMessage("pop")
 196       .setLogin(LOGIN_129_CHARS)
 197       .build();
 198     underTest.loginFailure(mockRequest(), exception);
 199
 200     verifyLog("login failure [cause|pop][method|BASIC][provider|REALM|some provider name][IP||][login|012345678901234567890123456789012345678901234567890123456789" +
 201       "01234567890123456789012345678901234567890123456789012345678901234567...(129)]");
 202   }
 203
 204   @Test
 205   public void login_failure_logs_remote_ip_from_request() {
 206     AuthenticationException exception = newBuilder()
 207       .setSource(Source.realm(Method.EXTERNAL, "bar"))
 208       .setMessage("Damn it!")
 209       .setLogin("Baaad")
 210       .build();
 211     underTest.loginFailure(mockRequest("1.2.3.4"), exception);
 212
 213     verifyLog("login failure [cause|Damn it!][method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|][login|Baaad]");
 214   }
 215
 216   @Test
 217   public void login_failure_logs_X_Forwarded_For_header_from_request() {
 218     AuthenticationException exception = newBuilder()
 219       .setSource(Source.realm(Method.EXTERNAL, "bar"))
 220       .setMessage("Hop la!")
 221       .setLogin("foo")
 222       .build();
 223     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 224     underTest.loginFailure(request, exception);
 225
 226     verifyLog("login failure [cause|Hop la!][method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5][login|foo]");
 227   }
 228
 229   @Test
 230   public void login_failure_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 231     AuthenticationException exception = newBuilder()
 232       .setSource(Source.realm(Method.EXTERNAL, "bar"))
 233       .setMessage("Boom!")
 234       .setLogin("foo")
 235       .build();
 236     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 237     underTest.loginFailure(request, exception);
 238
 239     verifyLog("login failure [cause|Boom!][method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4][login|foo]");
 240   }
 241
 242   @Test
 243   public void logout_success_fails_with_NPE_if_request_is_null() {
 244     logTester.setLevel(LoggerLevel.INFO);
 245
 246     assertThatThrownBy(() -> underTest.logoutSuccess(null, "foo"))
 247       .isInstanceOf(NullPointerException.class)
 248       .hasMessage("request can't be null");
 249   }
 250
 251   @Test
 252   public void logout_success_does_not_interact_with_request_if_log_level_is_above_DEBUG() {
 253     HttpRequest request = mock(HttpRequest.class);
 254     logTester.setLevel(LoggerLevel.INFO);
 255
 256     underTest.logoutSuccess(request, "foo");
 257
 258     verifyNoInteractions(request);
 259   }
 260
 261   @Test
 262   public void logout_success_creates_DEBUG_log_with_empty_login_if_login_argument_is_null() {
 263     underTest.logoutSuccess(mockRequest(), null);
 264
 265     verifyLog("logout success [IP||][login|]");
 266   }
 267
 268   @Test
 269   public void logout_success_creates_DEBUG_log_with_login() {
 270     underTest.logoutSuccess(mockRequest(), "foo");
 271
 272     verifyLog("logout success [IP||][login|foo]");
 273   }
 274
 275   @Test
 276   public void logout_success_logs_remote_ip_from_request() {
 277     underTest.logoutSuccess(mockRequest("1.2.3.4"), "foo");
 278
 279     verifyLog("logout success [IP|1.2.3.4|][login|foo]");
 280   }
 281
 282   @Test
 283   public void logout_success_logs_X_Forwarded_For_header_from_request() {
 284     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 285     underTest.logoutSuccess(request, "foo");
 286
 287     verifyLog("logout success [IP|1.2.3.4|2.3.4.5][login|foo]");
 288   }
 289
 290   @Test
 291   public void logout_success_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 292     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 293     underTest.logoutSuccess(request, "foo");
 294
 295     verifyLog("logout success [IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4][login|foo]");
 296   }
 297
 298   @Test
 299   public void logout_failure_with_NPE_if_request_is_null() {
 300     logTester.setLevel(LoggerLevel.INFO);
 301
 302     assertThatThrownBy(() -> underTest.logoutFailure(null, "bad csrf"))
 303       .isInstanceOf(NullPointerException.class)
 304       .hasMessage("request can't be null");
 305   }
 306
 307   @Test
 308   public void login_fails_with_NPE_if_error_message_is_null() {
 309     logTester.setLevel(LoggerLevel.INFO);
 310
 311     assertThatThrownBy(() -> underTest.logoutFailure(mock(HttpRequest.class), null))
 312       .isInstanceOf(NullPointerException.class)
 313       .hasMessage("error message can't be null");
 314   }
 315
 316   @Test
 317   public void logout_does_not_interact_with_request_if_log_level_is_above_DEBUG() {
 318     HttpRequest request = mock(HttpRequest.class);
 319     logTester.setLevel(LoggerLevel.INFO);
 320
 321     underTest.logoutFailure(request, "bad csrf");
 322
 323     verifyNoInteractions(request);
 324   }
 325
 326   @Test
 327   public void logout_creates_DEBUG_log_with_error() {
 328     underTest.logoutFailure(mockRequest(), "bad token");
 329
 330     verifyLog("logout failure [error|bad token][IP||]");
 331   }
 332
 333   @Test
 334   public void logout_logs_remote_ip_from_request() {
 335     underTest.logoutFailure(mockRequest("1.2.3.4"), "bad token");
 336
 337     verifyLog("logout failure [error|bad token][IP|1.2.3.4|]");
 338   }
 339
 340   @Test
 341   public void logout_logs_X_Forwarded_For_header_from_request() {
 342     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 343     underTest.logoutFailure(request, "bad token");
 344
 345     verifyLog("logout failure [error|bad token][IP|1.2.3.4|2.3.4.5]");
 346   }
 347
 348   @Test
 349   public void logout_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 350     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 351     underTest.logoutFailure(request, "bad token");
 352
 353     verifyLog("logout failure [error|bad token][IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4]");
 354   }
 355
 356   private void verifyLog(String expected) {
 357     assertThat(logTester.logs()).hasSize(1);
 358     assertThat(logTester.logs(Level.DEBUG))
 359       .containsOnly(expected);
 360   }
 361
 362   private static HttpRequest mockRequest() {
 363     return mockRequest("");
 364   }
 365
 366   private static HttpRequest mockRequest(String remoteAddr, List<String>... remoteIps) {
 367     HttpRequest res = mock(HttpRequest.class);
 368     when(res.getRemoteAddr()).thenReturn(remoteAddr);
 369     when(res.getHeaders("X-Forwarded-For"))
 370       .thenReturn(Collections.enumeration(
 371         Arrays.stream(remoteIps)
 372           .map(Joiner.on(",")::join)
 373           .collect(Collectors.toList())));
 374     return res;
 375   }
 376 }