Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ParameterLimitValve to enforce request parameter limits for specific URLs #753

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Add ParameterLimitValve to enforce request parameter limits for specific URLs #753

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
007605a
Add ParameterLimitValve to enforce request parameter limits
dsoumis Sep 12, 2024
603a999
Merge branch 'apache:main' into implement_parameterlimitvalve
dsoumis Sep 12, 2024
3bc0bd8
- Fixed how ParameterLimitValve enforces the limit, by enforcing it a…
dsoumis Sep 26, 2024
ec0fdd6
Refactor failing tests after Request's constructor change
dsoumis Sep 27, 2024
56468a6
Merge branch 'main' into implement_parameterlimitvalve
dsoumis Oct 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion test/org/apache/catalina/session/TestPersistentManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ public Manager getManager() {
context.setParent(host);

Connector connector = EasyMock.createNiceMock(Connector.class);
EasyMock.replay(connector);
Request req = new Request(connector, null) {
@Override
public Context getContext() {
Expand All @@ -116,7 +117,6 @@ public Context getContext() {
};
req.setRequestedSessionId("invalidSession");
HttpServletRequest request = new RequestFacade(req);
EasyMock.replay(connector);
requestCachingSessionListener.request = request;

manager.setContext(context);
Expand Down
70 changes: 55 additions & 15 deletions test/org/apache/catalina/valves/TestSSLValve.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@
import java.util.logging.Level;

import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;

import org.apache.catalina.Globals;
Expand All @@ -36,8 +35,21 @@ public class TestSSLValve {

public static class MockRequest extends Request {

public MockRequest() {
super(EasyMock.createMock(Connector.class), new org.apache.coyote.Request());
private static MockRequest single_instance = null;

public MockRequest(Connector connector) {
super(connector, new org.apache.coyote.Request());
}

public static MockRequest getInstance()
{
if (single_instance == null) {
Connector connector = EasyMock.createNiceMock(Connector.class);
EasyMock.replay(connector);
single_instance = new MockRequest(connector);
}

return single_instance;
}

@Override
Expand Down Expand Up @@ -90,22 +102,30 @@ public void addHeader(String header, String value) {
"yoTBqEpJloWksrypqp3iL4PAL5+KkB2zp66+MVAg8LcEDFJggBBJCtv4SCWV7ZOB",
"WLu8gep+XCwSn0Wb6D3eFs4DoIiMvQ6g2rS/pk7o5eWj", "-----END CERTIFICATE-----" };

private SSLValve valve = new SSLValve();

private MockRequest mockRequest = new MockRequest();
private Valve mockNext = EasyMock.createMock(Valve.class);
private final SSLValve valve = new SSLValve();

private MockRequest mockRequest;
private final Valve mockNext = EasyMock.createMock(Valve.class);

@Before
public void setUp() throws Exception {
setUp(null);
}

public void setUp(Connector connector) throws Exception {
valve.setNext(mockNext);
if (connector == null) {
mockRequest = MockRequest.getInstance();
} else {
EasyMock.replay(connector);
mockRequest = new MockRequest(connector);
}
mockNext.invoke(mockRequest, null);
EasyMock.replay(mockNext);
}


@Test
public void testSslHeader() {
public void testSslHeader() throws Exception {
setUp();
final String headerName = "myheader";
final String headerValue = "BASE64_HEADER_VALUE";
mockRequest.setHeader(headerName, headerValue);
Expand All @@ -115,7 +135,8 @@ public void testSslHeader() {


@Test
public void testSslHeaderNull() {
public void testSslHeaderNull() throws Exception {
setUp();
final String headerName = "myheader";
mockRequest.setHeader(headerName, null);

Expand All @@ -124,7 +145,8 @@ public void testSslHeaderNull() {


@Test
public void testSslHeaderNullModHeader() {
public void testSslHeaderNullModHeader() throws Exception {
setUp();
final String headerName = "myheader";
final String nullModHeaderValue = "(null)";
mockRequest.setHeader(headerName, nullModHeaderValue);
Expand All @@ -135,12 +157,14 @@ public void testSslHeaderNullModHeader() {

@Test
public void testSslHeaderNullName() throws Exception {
setUp();
Assert.assertNull(valve.mygetHeader(mockRequest, null));
}


@Test
public void testSslHeaderMultiples() throws Exception {
setUp();
final String headerName = "myheader";
final String headerValue = "BASE64_HEADER_VALUE";
mockRequest.addHeader(headerName, headerValue);
Expand All @@ -152,6 +176,7 @@ public void testSslHeaderMultiples() throws Exception {

@Test
public void testSslClientCertHeaderSingleSpace() throws Exception {
setUp();
String singleSpaced = certificateSingleLine(" ");
mockRequest.setHeader(valve.getSslClientCertHeader(), singleSpaced);

Expand All @@ -163,6 +188,7 @@ public void testSslClientCertHeaderSingleSpace() throws Exception {

@Test
public void testSslClientCertHeaderMultiSpace() throws Exception {
setUp();
String singleSpaced = certificateSingleLine(" ");
mockRequest.setHeader(valve.getSslClientCertHeader(), singleSpaced);

Expand All @@ -174,6 +200,7 @@ public void testSslClientCertHeaderMultiSpace() throws Exception {

@Test
public void testSslClientCertHeaderTab() throws Exception {
setUp();
String singleSpaced = certificateSingleLine("\t");
mockRequest.setHeader(valve.getSslClientCertHeader(), singleSpaced);

Expand All @@ -185,6 +212,7 @@ public void testSslClientCertHeaderTab() throws Exception {

@Test
public void testSslClientCertHeaderEscaped() throws Exception {
setUp();
String cert = certificateEscaped();
mockRequest.setHeader(valve.getSslClientEscapedCertHeader(), cert);

Expand All @@ -196,6 +224,7 @@ public void testSslClientCertHeaderEscaped() throws Exception {

@Test
public void testSslClientCertNull() throws Exception {
setUp();
TesterLogValidationFilter f = TesterLogValidationFilter.add(null, "", null,
"org.apache.catalina.valves.SSLValve");

Expand All @@ -209,6 +238,7 @@ public void testSslClientCertNull() throws Exception {

@Test
public void testSslClientCertShorter() throws Exception {
setUp();
mockRequest.setHeader(valve.getSslClientCertHeader(), "shorter than hell");

TesterLogValidationFilter f = TesterLogValidationFilter.add(null, "", null,
Expand All @@ -224,6 +254,7 @@ public void testSslClientCertShorter() throws Exception {

@Test
public void testSslClientCertIgnoredBegin() throws Exception {
setUp();
String[] linesBegin = Arrays.copyOf(CERTIFICATE_LINES, CERTIFICATE_LINES.length);
linesBegin[0] = "3fisjcme3kdsakasdfsadkafsd3";
String begin = certificateSingleLine(linesBegin, " ");
Expand All @@ -237,6 +268,7 @@ public void testSslClientCertIgnoredBegin() throws Exception {

@Test
public void testSslClientCertBadFormat() throws Exception {
setUp();
String[] linesDeleted = Arrays.copyOf(CERTIFICATE_LINES, CERTIFICATE_LINES.length / 2);
String deleted = certificateSingleLine(linesDeleted, " ");
mockRequest.setHeader(valve.getSslClientCertHeader(), deleted);
Expand All @@ -254,8 +286,10 @@ public void testSslClientCertBadFormat() throws Exception {

@Test
public void testClientCertProviderNotFound() throws Exception {
EasyMock.expect(mockRequest.getConnector().getProperty("clientCertProvider")).andStubReturn("wontBeFound");
EasyMock.replay(mockRequest.getConnector());
Connector connector = EasyMock.createNiceMock(Connector.class);
EasyMock.expect(connector.getProperty("clientCertProvider")).andStubReturn("wontBeFound");
setUp(connector);

mockRequest.setHeader(valve.getSslClientCertHeader(), certificateSingleLine(" "));

TesterLogValidationFilter f = TesterLogValidationFilter.add(Level.SEVERE, null,
Expand All @@ -270,6 +304,7 @@ public void testClientCertProviderNotFound() throws Exception {

@Test
public void testSslSecureProtocolHeaderPresent() throws Exception {
setUp();
String protocol = "secured-with";
mockRequest.setHeader(valve.getSslSecureProtocolHeader(), protocol);

Expand All @@ -281,6 +316,7 @@ public void testSslSecureProtocolHeaderPresent() throws Exception {

@Test
public void testSslCipherHeaderPresent() throws Exception {
setUp();
String cipher = "ciphered-with";
mockRequest.setHeader(valve.getSslCipherHeader(), cipher);

Expand All @@ -292,6 +328,7 @@ public void testSslCipherHeaderPresent() throws Exception {

@Test
public void testSslSessionIdHeaderPresent() throws Exception {
setUp();
String session = "ssl-session";
mockRequest.setHeader(valve.getSslSessionIdHeader(), session);

Expand All @@ -303,6 +340,7 @@ public void testSslSessionIdHeaderPresent() throws Exception {

@Test
public void testSslCipherUserKeySizeHeaderPresent() throws Exception {
setUp();
Integer keySize = Integer.valueOf(452);
mockRequest.setHeader(valve.getSslCipherUserKeySizeHeader(), String.valueOf(keySize));

Expand All @@ -314,12 +352,14 @@ public void testSslCipherUserKeySizeHeaderPresent() throws Exception {

@Test(expected = NumberFormatException.class)
public void testSslCipherUserKeySizeHeaderBadFormat() throws Exception {
setUp();
mockRequest.setHeader(valve.getSslCipherUserKeySizeHeader(), "not-an-integer");

try {
valve.invoke(mockRequest, null);
} catch (NumberFormatException e) {
Assert.assertNull(mockRequest.getAttribute(Globals.KEY_SIZE_ATTR));
mockRequest.setHeader(valve.getSslCipherUserKeySizeHeader(), null);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Due to the random ordering of the execution of the tests, I had to reset the header at this point because other tests were throwing NumberFormatException.

throw e;
}
}
Expand Down Expand Up @@ -363,4 +403,4 @@ private void assertCertificateParsed() throws Exception {
Assert.assertNotNull(certificates[0]);
Assert.assertEquals(0, f.getMessageCount());
}
}
}
Loading