forked from apache/druid
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[BackPort]: Upgrade pac4j-oidc to 4.5.7 to address CVE-2021-44878 (#185)
* Upgrade pac4j-oidc to 4.5.7 to address CVE-2021-44878 (apache#15522) * Upgrade org.pac4j:pac4j-oidc to 4.5.5 to address CVE-2021-44878 * add CVE suppression and notes, since vulnerability scan still shows this CVE * Add tests to improve coverage * pac4j: fix incompatible dependencies + authorization regression (apache#15753) - After upgrading the pac4j version in: apache#15522. We were not able to access the druid ui. - Upgraded the Nimbus libraries version to a compatible version to pac4j. - In the older pac4j version, when we return RedirectAction there we also update the webcontext Response status code and add the authentication URL to the header. But in the newer pac4j version, we just simply return the RedirectAction. So that's why it was not getting redirected to the generated authentication URL. - To fix the above, I have updated the NOOP_HTTP_ACTION_ADAPTER to JEE_HTTP_ACTION_ADAPTER and it updates the HTTP Response in context as per the HTTP Action. --------- Co-authored-by: Keerthana Srikanth <ksrikanth@confluent.io>
- Loading branch information
1 parent
6db7f5f
commit 62d8a38
Showing
7 changed files
with
208 additions
and
39 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
77 changes: 77 additions & 0 deletions
77
...sions-core/druid-pac4j/src/test/java/org/apache/druid/security/pac4j/Pac4jFilterTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.apache.druid.security.pac4j; | ||
|
|
||
| import org.junit.Assert; | ||
| import org.junit.Before; | ||
| import org.junit.Test; | ||
| import org.junit.runner.RunWith; | ||
| import org.mockito.Mock; | ||
| import org.mockito.Mockito; | ||
| import org.mockito.junit.MockitoJUnitRunner; | ||
| import org.pac4j.core.context.JEEContext; | ||
| import org.pac4j.core.exception.http.ForbiddenAction; | ||
| import org.pac4j.core.exception.http.FoundAction; | ||
| import org.pac4j.core.exception.http.HttpAction; | ||
| import org.pac4j.core.exception.http.WithLocationAction; | ||
| import org.pac4j.core.http.adapter.JEEHttpActionAdapter; | ||
|
|
||
| import javax.servlet.http.HttpServletRequest; | ||
| import javax.servlet.http.HttpServletResponse; | ||
|
|
||
| import static org.mockito.ArgumentMatchers.any; | ||
|
|
||
| @RunWith(MockitoJUnitRunner.class) | ||
| public class Pac4jFilterTest | ||
| { | ||
|
|
||
| @Mock | ||
| private HttpServletRequest request; | ||
| @Mock | ||
| private HttpServletResponse response; | ||
| private JEEContext context; | ||
|
|
||
| @Before | ||
| public void setUp() | ||
| { | ||
| context = new JEEContext(request, response); | ||
| } | ||
|
|
||
| @Test | ||
| public void testActionAdapterForRedirection() | ||
| { | ||
| HttpAction httpAction = new FoundAction("testUrl"); | ||
| Mockito.doReturn(httpAction.getCode()).when(response).getStatus(); | ||
| Mockito.doReturn(((WithLocationAction) httpAction).getLocation()).when(response).getHeader(any()); | ||
| JEEHttpActionAdapter.INSTANCE.adapt(httpAction, context); | ||
| Assert.assertEquals(response.getStatus(), 302); | ||
| Assert.assertEquals(response.getHeader("Location"), "testUrl"); | ||
| } | ||
|
|
||
| @Test | ||
| public void testActionAdapterForForbidden() | ||
| { | ||
| HttpAction httpAction = ForbiddenAction.INSTANCE; | ||
| Mockito.doReturn(httpAction.getCode()).when(response).getStatus(); | ||
| JEEHttpActionAdapter.INSTANCE.adapt(httpAction, context); | ||
| Assert.assertEquals(response.getStatus(), HttpServletResponse.SC_FORBIDDEN); | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.