source.dussan.org Git - sonarqube.git/blob

   1 /*
   2  * SonarQube
   3  * Copyright (C) 2009-2023 SonarSource SA
   4  * mailto:info AT sonarsource DOT com
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 3 of the License, or (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public License
  17  * along with this program; if not, write to the Free Software Foundation,
  18  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  19  */
  20 package org.sonar.server.authentication.event;
  21
  22 import com.google.common.base.Joiner;
  23 import java.util.Arrays;
  24 import java.util.Collections;
  25 import java.util.List;
  26 import org.junit.Before;
  27 import org.junit.Rule;
  28 import org.junit.Test;
  29 import org.slf4j.event.Level;
  30 import org.sonar.api.server.http.HttpRequest;
  31 import org.sonar.api.testfixtures.log.LogTester;
  32 import org.sonar.api.utils.log.LoggerLevel;
  33
  34 import static java.util.Arrays.asList;
  35 import static org.assertj.core.api.Assertions.assertThat;
  36 import static org.assertj.core.api.Assertions.assertThatThrownBy;
  37 import static org.mockito.Mockito.mock;
  38 import static org.mockito.Mockito.verifyNoInteractions;
  39 import static org.mockito.Mockito.when;
  40 import static org.sonar.server.authentication.event.AuthenticationEvent.Method;
  41 import static org.sonar.server.authentication.event.AuthenticationEvent.Source;
  42 import static org.sonar.server.authentication.event.AuthenticationException.newBuilder;
  43
  44 public class AuthenticationEventImplTest {
  45   private static final String LOGIN_129_CHARS = "012345678901234567890123456789012345678901234567890123456789" +
  46     "012345678901234567890123456789012345678901234567890123456789012345678";
  47
  48   @Rule
  49   public LogTester logTester = new LogTester();
  50
  51   private final AuthenticationEventImpl underTest = new AuthenticationEventImpl();
  52
  53   @Before
  54   public void setUp() {
  55     logTester.setLevel(LoggerLevel.DEBUG);
  56   }
  57
  58   @Test
  59   public void login_success_fails_with_NPE_if_request_is_null() {
  60     logTester.setLevel(LoggerLevel.INFO);
  61
  62     Source sso = Source.sso();
  63     assertThatThrownBy(() -> underTest.loginSuccess(null, "login", sso))
  64       .isInstanceOf(NullPointerException.class)
  65       .hasMessage("request can't be null");
  66   }
  67
  68   @Test
  69   public void login_success_fails_with_NPE_if_source_is_null() {
  70     logTester.setLevel(LoggerLevel.INFO);
  71
  72     assertThatThrownBy(() -> underTest.loginSuccess(mock(HttpRequest.class), "login", null))
  73       .isInstanceOf(NullPointerException.class)
  74       .hasMessage("source can't be null");
  75   }
  76
  77   @Test
  78   public void login_success_does_not_interact_with_request_if_log_level_is_above_DEBUG() {
  79     HttpRequest request = mock(HttpRequest.class);
  80     logTester.setLevel(LoggerLevel.INFO);
  81
  82     underTest.loginSuccess(request, "login", Source.sso());
  83
  84     assertThat(logTester.logs()).isEmpty();
  85   }
  86
  87   @Test
  88   public void login_success_message_is_sanitized() {
  89     logTester.setLevel(LoggerLevel.DEBUG);
  90
  91     underTest.loginSuccess(mockRequest("1.2.3.4"), "login with \n malicious line \r return", Source.sso());
  92
  93     assertThat(logTester.logs()).isNotEmpty()
  94       .contains("login success [method|SSO][provider|SSO|sso][IP|1.2.3.4|][login|login with _ malicious line _ return]");
  95   }
  96
  97   @Test
  98   public void login_success_creates_DEBUG_log_with_empty_login_if_login_argument_is_null() {
  99     underTest.loginSuccess(mockRequest(), null, Source.sso());
 100
 101     verifyLog("login success [method|SSO][provider|SSO|sso][IP||][login|]");
 102   }
 103
 104   @Test
 105   public void login_success_creates_DEBUG_log_with_method_provider_and_login() {
 106     underTest.loginSuccess(mockRequest(), "foo", Source.realm(Method.BASIC, "some provider name"));
 107
 108     verifyLog("login success [method|BASIC][provider|REALM|some provider name][IP||][login|foo]");
 109   }
 110
 111   @Test
 112   public void login_success_prevents_log_flooding_on_login_starting_from_128_chars() {
 113     underTest.loginSuccess(mockRequest(), LOGIN_129_CHARS, Source.realm(Method.BASIC, "some provider name"));
 114
 115     verifyLog("login success [method|BASIC][provider|REALM|some provider name][IP||][login|012345678901234567890123456789012345678901234567890123456789" +
 116       "01234567890123456789012345678901234567890123456789012345678901234567...(129)]");
 117   }
 118
 119   @Test
 120   public void login_success_logs_remote_ip_from_request() {
 121     underTest.loginSuccess(mockRequest("1.2.3.4"), "foo", Source.realm(Method.EXTERNAL, "bar"));
 122
 123     verifyLog("login success [method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|][login|foo]");
 124   }
 125
 126   @Test
 127   public void login_success_logs_X_Forwarded_For_header_from_request() {
 128     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 129     underTest.loginSuccess(request, "foo", Source.realm(Method.EXTERNAL, "bar"));
 130
 131     verifyLog("login success [method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5][login|foo]");
 132   }
 133
 134   @Test
 135   public void login_success_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 136     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 137     underTest.loginSuccess(request, "foo", Source.realm(Method.EXTERNAL, "bar"));
 138
 139     verifyLog("login success [method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4][login|foo]");
 140   }
 141
 142   @Test
 143   public void login_failure_fails_with_NPE_if_request_is_null() {
 144     logTester.setLevel(LoggerLevel.INFO);
 145
 146     AuthenticationException exception = newBuilder().setSource(Source.sso()).build();
 147     assertThatThrownBy(() -> underTest.loginFailure(null, exception))
 148       .isInstanceOf(NullPointerException.class)
 149       .hasMessage("request can't be null");
 150   }
 151
 152   @Test
 153   public void login_failure_fails_with_NPE_if_AuthenticationException_is_null() {
 154     logTester.setLevel(LoggerLevel.INFO);
 155
 156     assertThatThrownBy(() -> underTest.loginFailure(mock(HttpRequest.class), null))
 157       .isInstanceOf(NullPointerException.class)
 158       .hasMessage("AuthenticationException can't be null");
 159   }
 160
 161   @Test
 162   public void login_failure_does_not_interact_with_arguments_if_log_level_is_above_DEBUG() {
 163     HttpRequest request = mock(HttpRequest.class);
 164     AuthenticationException exception = mock(AuthenticationException.class);
 165     logTester.setLevel(LoggerLevel.INFO);
 166
 167     underTest.loginFailure(request, exception);
 168
 169     verifyNoInteractions(request, exception);
 170   }
 171
 172   @Test
 173   public void login_failure_creates_DEBUG_log_with_empty_login_if_AuthenticationException_has_no_login() {
 174     AuthenticationException exception = newBuilder().setSource(Source.sso()).setMessage("message").build();
 175     underTest.loginFailure(mockRequest(), exception);
 176
 177     verifyLog("login failure [cause|message][method|SSO][provider|SSO|sso][IP||][login|]");
 178   }
 179
 180   @Test
 181   public void login_failure_creates_DEBUG_log_with_empty_cause_if_AuthenticationException_has_no_message() {
 182     AuthenticationException exception = newBuilder().setSource(Source.sso()).setLogin("FoO").build();
 183     underTest.loginFailure(mockRequest(), exception);
 184
 185     verifyLog("login failure [cause|][method|SSO][provider|SSO|sso][IP||][login|FoO]");
 186   }
 187
 188   @Test
 189   public void login_failure_creates_DEBUG_log_with_method_provider_and_login() {
 190     AuthenticationException exception = newBuilder()
 191       .setSource(Source.realm(Method.BASIC, "some provider name"))
 192       .setMessage("something got terribly wrong")
 193       .setLogin("BaR")
 194       .build();
 195     underTest.loginFailure(mockRequest(), exception);
 196
 197     verifyLog("login failure [cause|something got terribly wrong][method|BASIC][provider|REALM|some provider name][IP||][login|BaR]");
 198   }
 199
 200   @Test
 201   public void login_failure_prevents_log_flooding_on_login_starting_from_128_chars() {
 202     AuthenticationException exception = newBuilder()
 203       .setSource(Source.realm(Method.BASIC, "some provider name"))
 204       .setMessage("pop")
 205       .setLogin(LOGIN_129_CHARS)
 206       .build();
 207     underTest.loginFailure(mockRequest(), exception);
 208
 209     verifyLog("login failure [cause|pop][method|BASIC][provider|REALM|some provider name][IP||][login|012345678901234567890123456789012345678901234567890123456789" +
 210       "01234567890123456789012345678901234567890123456789012345678901234567...(129)]");
 211   }
 212
 213   @Test
 214   public void login_failure_logs_remote_ip_from_request() {
 215     AuthenticationException exception = newBuilder()
 216       .setSource(Source.realm(Method.EXTERNAL, "bar"))
 217       .setMessage("Damn it!")
 218       .setLogin("Baaad")
 219       .build();
 220     underTest.loginFailure(mockRequest("1.2.3.4"), exception);
 221
 222     verifyLog("login failure [cause|Damn it!][method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|][login|Baaad]");
 223   }
 224
 225   @Test
 226   public void login_failure_logs_X_Forwarded_For_header_from_request() {
 227     AuthenticationException exception = newBuilder()
 228       .setSource(Source.realm(Method.EXTERNAL, "bar"))
 229       .setMessage("Hop la!")
 230       .setLogin("foo")
 231       .build();
 232     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 233     underTest.loginFailure(request, exception);
 234
 235     verifyLog("login failure [cause|Hop la!][method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5][login|foo]");
 236   }
 237
 238   @Test
 239   public void login_failure_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 240     AuthenticationException exception = newBuilder()
 241       .setSource(Source.realm(Method.EXTERNAL, "bar"))
 242       .setMessage("Boom!")
 243       .setLogin("foo")
 244       .build();
 245     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 246     underTest.loginFailure(request, exception);
 247
 248     verifyLog("login failure [cause|Boom!][method|EXTERNAL][provider|REALM|bar][IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4][login|foo]");
 249   }
 250
 251   @Test
 252   public void logout_success_fails_with_NPE_if_request_is_null() {
 253     logTester.setLevel(LoggerLevel.INFO);
 254
 255     assertThatThrownBy(() -> underTest.logoutSuccess(null, "foo"))
 256       .isInstanceOf(NullPointerException.class)
 257       .hasMessage("request can't be null");
 258   }
 259
 260   @Test
 261   public void logout_success_does_not_interact_with_request_if_log_level_is_above_DEBUG() {
 262     HttpRequest request = mock(HttpRequest.class);
 263     logTester.setLevel(LoggerLevel.INFO);
 264
 265     underTest.logoutSuccess(request, "foo");
 266
 267     verifyNoInteractions(request);
 268   }
 269
 270   @Test
 271   public void logout_success_creates_DEBUG_log_with_empty_login_if_login_argument_is_null() {
 272     underTest.logoutSuccess(mockRequest(), null);
 273
 274     verifyLog("logout success [IP||][login|]");
 275   }
 276
 277   @Test
 278   public void logout_success_creates_DEBUG_log_with_login() {
 279     underTest.logoutSuccess(mockRequest(), "foo");
 280
 281     verifyLog("logout success [IP||][login|foo]");
 282   }
 283
 284   @Test
 285   public void logout_success_logs_remote_ip_from_request() {
 286     underTest.logoutSuccess(mockRequest("1.2.3.4"), "foo");
 287
 288     verifyLog("logout success [IP|1.2.3.4|][login|foo]");
 289   }
 290
 291   @Test
 292   public void logout_success_logs_X_Forwarded_For_header_from_request() {
 293     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 294     underTest.logoutSuccess(request, "foo");
 295
 296     verifyLog("logout success [IP|1.2.3.4|2.3.4.5][login|foo]");
 297   }
 298
 299   @Test
 300   public void logout_success_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 301     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 302     underTest.logoutSuccess(request, "foo");
 303
 304     verifyLog("logout success [IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4][login|foo]");
 305   }
 306
 307   @Test
 308   public void logout_failure_with_NPE_if_request_is_null() {
 309     logTester.setLevel(LoggerLevel.INFO);
 310
 311     assertThatThrownBy(() -> underTest.logoutFailure(null, "bad csrf"))
 312       .isInstanceOf(NullPointerException.class)
 313       .hasMessage("request can't be null");
 314   }
 315
 316   @Test
 317   public void login_fails_with_NPE_if_error_message_is_null() {
 318     logTester.setLevel(LoggerLevel.INFO);
 319
 320     assertThatThrownBy(() -> underTest.logoutFailure(mock(HttpRequest.class), null))
 321       .isInstanceOf(NullPointerException.class)
 322       .hasMessage("error message can't be null");
 323   }
 324
 325   @Test
 326   public void logout_does_not_interact_with_request_if_log_level_is_above_DEBUG() {
 327     HttpRequest request = mock(HttpRequest.class);
 328     logTester.setLevel(LoggerLevel.INFO);
 329
 330     underTest.logoutFailure(request, "bad csrf");
 331
 332     verifyNoInteractions(request);
 333   }
 334
 335   @Test
 336   public void logout_creates_DEBUG_log_with_error() {
 337     underTest.logoutFailure(mockRequest(), "bad token");
 338
 339     verifyLog("logout failure [error|bad token][IP||]");
 340   }
 341
 342   @Test
 343   public void logout_logs_remote_ip_from_request() {
 344     underTest.logoutFailure(mockRequest("1.2.3.4"), "bad token");
 345
 346     verifyLog("logout failure [error|bad token][IP|1.2.3.4|]");
 347   }
 348
 349   @Test
 350   public void logout_logs_X_Forwarded_For_header_from_request() {
 351     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5"));
 352     underTest.logoutFailure(request, "bad token");
 353
 354     verifyLog("logout failure [error|bad token][IP|1.2.3.4|2.3.4.5]");
 355   }
 356
 357   @Test
 358   public void logout_logs_X_Forwarded_For_header_from_request_and_supports_multiple_headers() {
 359     HttpRequest request = mockRequest("1.2.3.4", asList("2.3.4.5", "6.5.4.3"), asList("9.5.6.7"), asList("6.3.2.4"));
 360     underTest.logoutFailure(request, "bad token");
 361
 362     verifyLog("logout failure [error|bad token][IP|1.2.3.4|2.3.4.5,6.5.4.3,9.5.6.7,6.3.2.4]");
 363   }
 364
 365   private void verifyLog(String expected) {
 366     assertThat(logTester.logs()).hasSize(1);
 367     assertThat(logTester.logs(Level.DEBUG))
 368       .containsOnly(expected);
 369   }
 370
 371   private static HttpRequest mockRequest() {
 372     return mockRequest("");
 373   }
 374
 375   private static HttpRequest mockRequest(String remoteAddr, List<String>... remoteIps) {
 376     HttpRequest res = mock(HttpRequest.class);
 377     when(res.getRemoteAddr()).thenReturn(remoteAddr);
 378     when(res.getHeaders("X-Forwarded-For"))
 379       .thenReturn(Collections.enumeration(
 380         Arrays.stream(remoteIps)
 381           .map(Joiner.on(",")::join)
 382           .toList()));
 383     return res;
 384   }
 385 }