You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ol...@apache.org on 2023/07/07 18:56:01 UTC
[sling-org-apache-sling-clam] branch master updated (a48e319 -> ca0f4b1)
This is an automated email from the ASF dual-hosted git repository.
olli pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-clam.git
from a48e319 SLING-11709 - Set up Jira autolinks to all Sling Github projects
new 8f48c2c SLING-11254 Make additional authorization on HTTP scan endpoint mandatory
new a2731e1 update test dependencies
new a16d47b SLING-10891 Enable code checks with Checkstyle
new 2c164f8 SLING-10892 Enable code checks with PMD
new ca0f4b1 SLING-10893 Enable code checks with SpotBugs
The 5 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
pom.xml | 22 +++++--------
.../clam/http/internal/ClamJcrScanServlet.java | 13 +++-----
.../internal/ClamJcrScanServletConfiguration.java | 6 ++--
.../sling/clam/http/internal/RequestUtil.java | 20 ++++++++++++
.../sling/clam/it/tests/ClamJcrScanServletIT.java | 37 +++-------------------
.../sling/clam/it/tests/ClamTestSupport.java | 10 ++++--
6 files changed, 47 insertions(+), 61 deletions(-)
[sling-org-apache-sling-clam] 01/05: SLING-11254 Make additional authorization on HTTP scan endpoint mandatory
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-clam.git
commit 8f48c2c54ee21427f4d39b1ac94158653ebe6dc9
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Fri Jul 7 20:27:02 2023 +0200
SLING-11254 Make additional authorization on HTTP scan endpoint mandatory
undo, no consent for Commons Permissions
---
pom.xml | 6 ----
.../clam/http/internal/ClamJcrScanServlet.java | 13 +++-----
.../internal/ClamJcrScanServletConfiguration.java | 6 ++--
.../sling/clam/http/internal/RequestUtil.java | 20 ++++++++++++
.../sling/clam/it/tests/ClamJcrScanServletIT.java | 37 +++-------------------
.../sling/clam/it/tests/ClamTestSupport.java | 10 ++++--
6 files changed, 39 insertions(+), 53 deletions(-)
diff --git a/pom.xml b/pom.xml
index 86008cd..56f083d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -281,12 +281,6 @@
<version>1.2.0</version>
<scope>provided</scope>
</dependency>
- <dependency>
- <groupId>org.apache.sling</groupId>
- <artifactId>org.apache.sling.commons.permissions</artifactId>
- <version>1.0.0-SNAPSHOT</version>
- <scope>provided</scope>
- </dependency>
<dependency>
<groupId>org.apache.sling</groupId>
<artifactId>org.apache.sling.event</artifactId>
diff --git a/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServlet.java b/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServlet.java
index 4cd9bb1..3cbc9f5 100644
--- a/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServlet.java
+++ b/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServlet.java
@@ -19,6 +19,8 @@
package org.apache.sling.clam.http.internal;
import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
import java.util.Set;
import java.util.regex.Pattern;
@@ -32,7 +34,6 @@ import org.apache.sling.api.SlingHttpServletResponse;
import org.apache.sling.api.resource.Resource;
import org.apache.sling.api.servlets.SlingAllMethodsServlet;
import org.apache.sling.clam.jcr.NodeDescendingJcrPropertyDigger;
-import org.apache.sling.commons.permissions.PermissionsService;
import org.jetbrains.annotations.NotNull;
import org.osgi.framework.Constants;
import org.osgi.service.component.annotations.Activate;
@@ -46,6 +47,7 @@ import org.osgi.service.metatype.annotations.Designate;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import static org.apache.sling.clam.http.internal.RequestUtil.isAuthorized;
import static org.apache.sling.clam.http.internal.RequestUtil.maxDepth;
import static org.apache.sling.clam.http.internal.RequestUtil.maxLength;
import static org.apache.sling.clam.http.internal.RequestUtil.path;
@@ -76,12 +78,6 @@ public final class ClamJcrScanServlet extends SlingAllMethodsServlet {
)
private volatile NodeDescendingJcrPropertyDigger digger;
- @Reference(
- policy = ReferencePolicy.DYNAMIC,
- policyOption = ReferencePolicyOption.GREEDY
- )
- private volatile PermissionsService permissionsService;
-
private ClamJcrScanServletConfiguration configuration;
private Pattern pattern;
@@ -126,9 +122,10 @@ public final class ClamJcrScanServlet extends SlingAllMethodsServlet {
@Override
@SuppressWarnings({"checkstyle:IllegalCatch", "checkstyle:ReturnCount", "checkstyle:ExecutableStatementCount"})
protected void doPost(@NotNull final SlingHttpServletRequest request, @NotNull final SlingHttpServletResponse response) throws ServletException, IOException {
+ final List<String> groups = Arrays.asList(configuration.scan_authorized_groups());
boolean isAuthorized = false;
try {
- isAuthorized = permissionsService.hasPermission(request.getUserPrincipal(), configuration.scan_permission());
+ isAuthorized = isAuthorized(request, groups);
} catch (Exception e) {
logger.error(e.getMessage(), e);
}
diff --git a/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServletConfiguration.java b/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServletConfiguration.java
index 1605d13..be42e58 100644
--- a/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServletConfiguration.java
+++ b/src/main/java/org/apache/sling/clam/http/internal/ClamJcrScanServletConfiguration.java
@@ -42,10 +42,10 @@ import org.osgi.service.metatype.annotations.Option;
String[] sling_auth_requirements() default {"/system/clam-jcr-scan"};
@AttributeDefinition(
- name = "scan permission",
- description = "Permission required for scanning"
+ name = "scan authorized groups",
+ description = "User groups authorized for scanning"
)
- String scan_permission() default "sling/clam/scan";
+ String[] scan_authorized_groups() default {"sling-clam-scan"};
@AttributeDefinition(
name = "default property types",
diff --git a/src/main/java/org/apache/sling/clam/http/internal/RequestUtil.java b/src/main/java/org/apache/sling/clam/http/internal/RequestUtil.java
index c29096f..dcb3ddb 100644
--- a/src/main/java/org/apache/sling/clam/http/internal/RequestUtil.java
+++ b/src/main/java/org/apache/sling/clam/http/internal/RequestUtil.java
@@ -19,9 +19,13 @@
package org.apache.sling.clam.http.internal;
import java.util.Arrays;
+import java.util.Collection;
+import java.util.Iterator;
import java.util.Set;
import java.util.regex.Pattern;
+import org.apache.jackrabbit.api.security.user.Authorizable;
+import org.apache.jackrabbit.api.security.user.Group;
import org.apache.sling.api.SlingHttpServletRequest;
import org.jetbrains.annotations.NotNull;
@@ -100,4 +104,20 @@ public final class RequestUtil {
}
}
+ @SuppressWarnings({"java:S112", "checkstyle:ReturnCount"})
+ static boolean isAuthorized(@NotNull final SlingHttpServletRequest request, @NotNull final Collection<String> authorizedGroups) throws Exception {
+ final Authorizable authorizable = request.getResourceResolver().adaptTo(Authorizable.class);
+ if (authorizable == null) {
+ return false;
+ }
+ final Iterator<Group> groups = authorizable.memberOf();
+ while (groups.hasNext()) {
+ final String id = groups.next().getID();
+ if (authorizedGroups.contains(id)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
}
diff --git a/src/test/java/org/apache/sling/clam/it/tests/ClamJcrScanServletIT.java b/src/test/java/org/apache/sling/clam/it/tests/ClamJcrScanServletIT.java
index d95c227..6811a51 100644
--- a/src/test/java/org/apache/sling/clam/it/tests/ClamJcrScanServletIT.java
+++ b/src/test/java/org/apache/sling/clam/it/tests/ClamJcrScanServletIT.java
@@ -38,7 +38,6 @@ import org.ops4j.pax.exam.util.Filter;
import static io.restassured.RestAssured.given;
import static java.util.concurrent.TimeUnit.MINUTES;
import static java.util.concurrent.TimeUnit.SECONDS;
-import static org.apache.sling.testing.paxexam.SlingOptions.slingCommonsPermissionsSling;
import static org.apache.sling.testing.paxexam.SlingOptions.slingJcrJackrabbitUsermanager;
import static org.apache.sling.testing.paxexam.SlingOptions.slingResourcePresence;
import static org.apache.sling.testing.paxexam.SlingOptions.slingStarterContent;
@@ -56,14 +55,6 @@ public class ClamJcrScanServletIT extends ClamTestSupport {
private static final String URL_TEMPLATE = "http://localhost:%s/system/clam-jcr-scan";
- private static final String AUTHORIZED_USER_USERNAME = "alice";
-
- private static final String AUTHORIZED_USER_PASSWORD = "foo";
-
- private static final String UNAUTHORIZED_USER_USERNAME = "bob";
-
- private static final String UNAUTHORIZED_USER_PASSWORD = "bar";
-
@Configuration
public Option[] configuration() {
return options(
@@ -74,27 +65,7 @@ public class ClamJcrScanServletIT extends ClamTestSupport {
.put("path", "/content/starter/img/sling-logo.svg")
.asOption(),
slingStarterContent(),
- slingJcrJackrabbitUsermanager(),
- factoryConfiguration("org.apache.sling.jcr.repoinit.RepositoryInitializer")
- .put("scripts", new String[]{
- "create group sling-clam-scan\n" +
- String.format("create user %s with password %s\n", UNAUTHORIZED_USER_USERNAME, UNAUTHORIZED_USER_PASSWORD) +
- String.format("create user %s with password %s\n", AUTHORIZED_USER_USERNAME, AUTHORIZED_USER_PASSWORD) +
- String.format("add %s to group sling-clam-scan\n", AUTHORIZED_USER_USERNAME) +
- "create path (sling:Folder) /libs/sling/permissions/sling/clam/scan\n" +
- "set ACL for sling-clam-scan\nallow jcr:read on /libs/sling/permissions/sling/clam/scan\nend\n"
- })
- .asOption(),
- // Sling Commons Permissions Sling
- slingCommonsPermissionsSling(),
- factoryConfiguration("org.apache.sling.commons.permissions.sling.internal.SlingPermissionsService")
- .put("path", "/libs/sling/permissions")
- .asOption(),
- factoryConfiguration("org.apache.sling.jcr.base.internal.LoginAdminWhitelist.fragment")
- .put("whitelist.bundles", new String[]{
- "org.apache.sling.commons.permissions.sling"
- })
- .asOption()
+ slingJcrJackrabbitUsermanager()
);
}
@@ -113,7 +84,7 @@ public class ClamJcrScanServletIT extends ClamTestSupport {
final String url = String.format(URL_TEMPLATE, httpPort());
given()
.auth()
- .basic(UNAUTHORIZED_USER_USERNAME, UNAUTHORIZED_USER_PASSWORD)
+ .basic(ADMIN_USERNAME, ADMIN_PASSWORD)
.param("path", "/content/starter")
.when()
.post(url)
@@ -126,7 +97,7 @@ public class ClamJcrScanServletIT extends ClamTestSupport {
final String url = String.format(URL_TEMPLATE, httpPort());
given()
.auth()
- .basic(AUTHORIZED_USER_USERNAME, AUTHORIZED_USER_PASSWORD)
+ .basic(USER_USERNAME, USER_PASSWORD)
.param("path", "/content/starter")
.when()
.post(url)
@@ -142,7 +113,7 @@ public class ClamJcrScanServletIT extends ClamTestSupport {
final String url = String.format(URL_TEMPLATE, httpPort());
given()
.auth()
- .basic(AUTHORIZED_USER_USERNAME, AUTHORIZED_USER_PASSWORD)
+ .basic(USER_USERNAME, USER_PASSWORD)
.param("path", "/content/starter")
.when()
.post(url)
diff --git a/src/test/java/org/apache/sling/clam/it/tests/ClamTestSupport.java b/src/test/java/org/apache/sling/clam/it/tests/ClamTestSupport.java
index 5ffa35e..3a000db 100644
--- a/src/test/java/org/apache/sling/clam/it/tests/ClamTestSupport.java
+++ b/src/test/java/org/apache/sling/clam/it/tests/ClamTestSupport.java
@@ -40,7 +40,6 @@ import org.osgi.framework.BundleContext;
import static org.apache.sling.testing.paxexam.SlingOptions.awaitility;
import static org.apache.sling.testing.paxexam.SlingOptions.restassured;
import static org.apache.sling.testing.paxexam.SlingOptions.slingCommonsClam;
-import static org.apache.sling.testing.paxexam.SlingOptions.slingCommonsPermissions;
import static org.apache.sling.testing.paxexam.SlingOptions.slingEvent;
import static org.apache.sling.testing.paxexam.SlingOptions.slingQuickstartOakTar;
import static org.apache.sling.testing.paxexam.SlingOptions.testcontainers;
@@ -66,6 +65,10 @@ public abstract class ClamTestSupport extends TestSupport {
static final String ADMIN_PASSWORD = "admin";
+ static final String USER_USERNAME = "bob";
+
+ static final String USER_PASSWORD = "foo";
+
protected ModifiableCompositeOption baseConfiguration() {
return composite(
super.baseConfiguration(),
@@ -75,13 +78,14 @@ public abstract class ClamTestSupport extends TestSupport {
factoryConfiguration("org.apache.sling.jcr.repoinit.RepositoryInitializer")
.put("scripts", new String[]{"create service user sling-clam with path system/sling\ncreate path (sling:Folder) /var/clam/results(sling:OrderedFolder)\nset principal ACL for sling-clam\nallow jcr:read on /\nallow rep:write on /var/clam\nend"})
.asOption(),
+ factoryConfiguration("org.apache.sling.jcr.repoinit.RepositoryInitializer")
+ .put("scripts", new String[]{"create user bob with password foo\ncreate group sling-clam-scan\nadd bob to group sling-clam-scan"})
+ .asOption(),
factoryConfiguration("org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended")
.put("user.mapping", new String[]{"org.apache.sling.clam=[sling-clam]", "org.apache.sling.clam:result-writer=[sling-clam]"})
.asOption(),
// Sling Commons Clam
slingCommonsClam(),
- // Sling Commons Permissions
- slingCommonsPermissions(),
// testing
newConfiguration("org.apache.sling.jcr.base.internal.LoginAdminWhitelist")
.put("whitelist.bundles.regexp", "PAXEXAM-PROBE-.*")
[sling-org-apache-sling-clam] 02/05: update test dependencies
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-clam.git
commit a2731e1f5953968a49ddbf760d1fde14dc207a91
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Fri Jul 7 20:49:59 2023 +0200
update test dependencies
---
pom.xml | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/pom.xml b/pom.xml
index 56f083d..627da35 100644
--- a/pom.xml
+++ b/pom.xml
@@ -369,25 +369,25 @@
<dependency>
<groupId>io.rest-assured</groupId>
<artifactId>rest-assured</artifactId>
- <version>5.2.0</version>
+ <version>5.3.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.awaitility</groupId>
<artifactId>awaitility</artifactId>
- <version>3.1.6</version>
+ <version>4.2.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>testcontainers</artifactId>
- <version>1.17.6</version>
+ <version>1.18.3</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.icegreen</groupId>
<artifactId>greenmail</artifactId>
- <version>2.0.0-alpha-3</version>
+ <version>2.0.0</version>
<scope>test</scope>
</dependency>
<dependency>
[sling-org-apache-sling-clam] 03/05: SLING-10891 Enable code checks with Checkstyle
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-clam.git
commit a16d47b044e1b7a1da2c2f8d38beb2d717308141
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Fri Jul 7 20:50:42 2023 +0200
SLING-10891 Enable code checks with Checkstyle
update plugins
---
pom.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index 627da35..f21d6d0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -85,12 +85,12 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
- <version>3.2.1</version>
+ <version>3.3.0</version>
<dependencies>
<dependency>
<groupId>com.puppycrawl.tools</groupId>
<artifactId>checkstyle</artifactId>
- <version>10.7.0</version>
+ <version>10.12.1</version>
</dependency>
<dependency>
<groupId>de.bildschirmarbeiter</groupId>
[sling-org-apache-sling-clam] 04/05: SLING-10892 Enable code checks with PMD
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-clam.git
commit 2c164f87851f344f2dadfe8ef970462a9eccc69e
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Fri Jul 7 20:51:10 2023 +0200
SLING-10892 Enable code checks with PMD
update plugin
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index f21d6d0..9d6b5ca 100644
--- a/pom.xml
+++ b/pom.xml
@@ -115,7 +115,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
- <version>3.20.0</version>
+ <version>3.21.0</version>
<configuration>
<targetJdk>${sling.java.version}</targetJdk>
<excludeFromFailureFile>pmd-exclude.properties</excludeFromFailureFile>
[sling-org-apache-sling-clam] 05/05: SLING-10893 Enable code checks with SpotBugs
Posted by ol...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
olli pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-clam.git
commit ca0f4b1dba84346d2efed76c3073c3f85b4688a2
Author: Oliver Lietz <ol...@apache.org>
AuthorDate: Fri Jul 7 20:51:37 2023 +0200
SLING-10893 Enable code checks with SpotBugs
update plugin
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 9d6b5ca..0746857 100644
--- a/pom.xml
+++ b/pom.xml
@@ -132,7 +132,7 @@
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
- <version>4.7.3.0</version>
+ <version>4.7.3.5</version>
<configuration>
<excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
<plugins>