Skip to content

Commit

Permalink
fix PlainAuthenticationHandlerFactory base64 decode behaviour (#143)
Browse files Browse the repository at this point in the history
  • Loading branch information
davidmoten authored Jan 16, 2025
1 parent 8f00b1c commit 25ed5c9
Show file tree
Hide file tree
Showing 2 changed files with 40 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,17 @@ public Optional<String> auth(String clientInput, MessageContext context) throws
}
}

byte[] decodedSecret = Base64.getDecoder().decode(secret);
if (decodedSecret == null)
byte[] decodedSecret;
try {
decodedSecret = Base64.getDecoder().decode(secret);
} catch (IllegalArgumentException e) {
decodedSecret = null;
}

if (decodedSecret == null) {
throw new RejectException(501, /*5.5.4*/
"Invalid command argument, not a valid Base64 string");
}

/*
* RFC4616: The client presents the authorization identity (identity
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
package org.subethamail.smtp;

import static org.junit.Assert.assertEquals;

import org.junit.Assert;
import org.junit.Test;
import org.mockito.Mockito;
import org.subethamail.smtp.auth.LoginFailedException;
import org.subethamail.smtp.auth.PlainAuthenticationHandlerFactory;
import org.subethamail.smtp.auth.UsernamePasswordValidator;

public class PlainAuthenticationHandlerFactoryTest {

@Test
public void testBadBase64String() throws RejectException {
UsernamePasswordValidator validator = (username, password, c) -> {
if (!username.equals("fred") || !password.equals("blah")) {
throw new LoginFailedException();
}
};
AuthenticationHandler auth = new PlainAuthenticationHandlerFactory(validator).create();
MessageContext context = Mockito.mock(MessageContext.class);
try {
auth.auth("AUTH PLAIN b", context);
Assert.fail();
} catch (RejectException e) {
assertEquals("Invalid command argument, not a valid Base64 string", e.getMessage());
}
}

}

0 comments on commit 25ed5c9

Please sign in to comment.