diff options
| author | Aurelien <100427063+aurelien-poscia-sonarsource@users.noreply.github.com> | 2022-03-29 17:58:59 +0200 |
|---|---|---|
| committer | sonartech <sonartech@sonarsource.com> | 2022-03-29 20:03:37 +0000 |
| commit | 73d29134eb139947c9e79c6a3330a32e145bda6c (patch) | |
| tree | 57a156ee0b2142016a9813f4c905a80ddacd0df2 /server/sonar-webserver-auth/src/test | |
| parent | 53c133445166cdd2d26e9088f1f69f679b6f9783 (diff) | |
| download | sonarqube-73d29134eb139947c9e79c6a3330a32e145bda6c.tar.gz sonarqube-73d29134eb139947c9e79c6a3330a32e145bda6c.zip | |
SONAR-16181 fix SSF-227
Diffstat (limited to 'server/sonar-webserver-auth/src/test')
2 files changed, 59 insertions, 7 deletions
diff --git a/server/sonar-webserver-auth/src/test/java/org/sonar/server/authentication/CredentialsAuthenticationTest.java b/server/sonar-webserver-auth/src/test/java/org/sonar/server/authentication/CredentialsAuthenticationTest.java index e883f59fc55..340a2fc3d3c 100644 --- a/server/sonar-webserver-auth/src/test/java/org/sonar/server/authentication/CredentialsAuthenticationTest.java +++ b/server/sonar-webserver-auth/src/test/java/org/sonar/server/authentication/CredentialsAuthenticationTest.java @@ -23,6 +23,7 @@ import java.util.Optional; import javax.servlet.http.HttpServletRequest; import org.junit.Rule; import org.junit.Test; +import org.mockito.Mockito; import org.sonar.api.config.internal.MapSettings; import org.sonar.api.utils.System2; import org.sonar.db.DbClient; @@ -36,7 +37,7 @@ import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.verify; -import static org.mockito.Mockito.verifyZeroInteractions; +import static org.mockito.Mockito.verifyNoInteractions; import static org.mockito.Mockito.when; import static org.sonar.db.user.UserTesting.newUserDto; import static org.sonar.server.authentication.event.AuthenticationEvent.Method.BASIC; @@ -58,7 +59,7 @@ public class CredentialsAuthenticationTest { private AuthenticationEvent authenticationEvent = mock(AuthenticationEvent.class); private MapSettings settings = new MapSettings().setProperty("sonar.internal.pbkdf2.iterations", "1"); private CredentialsExternalAuthentication externalAuthentication = mock(CredentialsExternalAuthentication.class); - private CredentialsLocalAuthentication localAuthentication = new CredentialsLocalAuthentication(dbClient, settings.asConfig()); + private CredentialsLocalAuthentication localAuthentication = Mockito.spy(new CredentialsLocalAuthentication(dbClient, settings.asConfig())); private CredentialsAuthentication underTest = new CredentialsAuthentication(dbClient, authenticationEvent, externalAuthentication, localAuthentication); @Test @@ -90,7 +91,7 @@ public class CredentialsAuthenticationTest { .hasFieldOrPropertyWithValue("source", Source.local(BASIC)) .hasFieldOrPropertyWithValue("login", LOGIN); - verifyZeroInteractions(authenticationEvent); + verifyNoInteractions(authenticationEvent); } @@ -104,7 +105,7 @@ public class CredentialsAuthenticationTest { executeAuthenticate(BASIC); verify(externalAuthentication).authenticate(new Credentials(LOGIN, PASSWORD), request, BASIC); - verifyZeroInteractions(authenticationEvent); + verifyNoInteractions(authenticationEvent); } @Test @@ -120,7 +121,7 @@ public class CredentialsAuthenticationTest { .hasFieldOrPropertyWithValue("source", Source.local(BASIC_TOKEN)) .hasFieldOrPropertyWithValue("login", LOGIN); - verifyZeroInteractions(authenticationEvent); + verifyNoInteractions(authenticationEvent); } @Test @@ -138,7 +139,7 @@ public class CredentialsAuthenticationTest { .hasFieldOrPropertyWithValue("source", Source.local(BASIC)) .hasFieldOrPropertyWithValue("login", LOGIN); - verifyZeroInteractions(authenticationEvent); + verifyNoInteractions(authenticationEvent); } @Test @@ -156,8 +157,20 @@ public class CredentialsAuthenticationTest { .hasFieldOrPropertyWithValue("source", Source.local(BASIC_TOKEN)) .hasFieldOrPropertyWithValue("login", LOGIN); - verifyZeroInteractions(authenticationEvent); + verifyNoInteractions(authenticationEvent); + } + + @Test + public void fail_to_authenticate_unknown_user_after_forcing_hash() { + assertThatThrownBy(() -> executeAuthenticate(BASIC)) + .hasMessage("No active user for login") + .isInstanceOf(AuthenticationException.class) + .hasFieldOrPropertyWithValue("source", Source.local(BASIC)) + .hasFieldOrPropertyWithValue("login", LOGIN); + + verify(localAuthentication).generateHashToAvoidEnumerationAttack(); + verifyNoInteractions(authenticationEvent); } private UserDto executeAuthenticate(AuthenticationEvent.Method method) { diff --git a/server/sonar-webserver-auth/src/test/java/org/sonar/server/authentication/PBKDF2FunctionTest.java b/server/sonar-webserver-auth/src/test/java/org/sonar/server/authentication/PBKDF2FunctionTest.java new file mode 100644 index 00000000000..218a3550885 --- /dev/null +++ b/server/sonar-webserver-auth/src/test/java/org/sonar/server/authentication/PBKDF2FunctionTest.java @@ -0,0 +1,39 @@ +/* + * SonarQube + * Copyright (C) 2009-2022 SonarSource SA + * mailto:info AT sonarsource DOT com + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 3 of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +package org.sonar.server.authentication; + +import org.junit.Test; + +import static org.assertj.core.api.Assertions.assertThat; + +public class PBKDF2FunctionTest { + + private static final int GENERATION_ITERATIONS = 1000; + + private final CredentialsLocalAuthentication.PBKDF2Function pbkdf2Function = new CredentialsLocalAuthentication.PBKDF2Function(GENERATION_ITERATIONS); + + @Test + public void encryptPassword_returnsCorrectEncryptedPassword() { + String encryptedPassword = pbkdf2Function.encryptPassword("salt", "test_password"); + assertThat(encryptedPassword) + .isEqualTo("%d$%s", GENERATION_ITERATIONS, "Yz4QzaROW6N9dqr47NtsDgVJERKC3gTec4rMHonb885IVvTb6OYelaAvMXxoc5QT+4SAjiEmDKaUa2cAC9Ne8Q=="); + } + +} |