You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@fineract.apache.org by "DeathGun44 (via GitHub)" <gi...@apache.org> on 2026/09/26 14:15:38 UTC
[PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
DeathGun44 opened a new pull request, #6513:
URL: https://github.com/apache/fineract/pull/6513
## Description
Describe the changes made and why they were made. (Ignore if these details are present on the associated Apache Fineract JIRA ticket.)
## Checklist
Please make sure these boxes are checked before submitting your pull request - thanks!
- [ ] Write the commit message as per [our guidelines](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#pull-requests)
- [ ] Acknowledge that we will not review PRs that are not passing the build _("green")_ - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers.
- [ ] Create/update [unit or integration tests](https://fineract.apache.org/docs/current/#_testing) for verifying the changes made.
- [ ] Follow our [coding conventions](https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions).
- [ ] Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes
- [ ] [This PR must not be a "code dump"](https://cwiki.apache.org/confluence/display/FINERACT/Pull+Request+Size+Limit). Large changes can be made in a branch, with assistance. Ask for help on the [developer mailing list](https://fineract.apache.org/#contribute).
- [ ] If merging this PR resolves a JIRA issue, I will mark that issue as resolved and set "Fix Version/s" appropriately.
- [ ] I followed the [AI Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy).
Your assigned reviewer(s) will follow our [guidelines for code reviews](https://cwiki.apache.org/confluence/display/FINERACT/Code+Review+Guide).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
Posted by "adamsaghy (via GitHub)" <gi...@apache.org>.
adamsaghy commented on code in PR #6513:
URL: https://github.com/apache/fineract/pull/6513#discussion_r4153620591
##########
integration-tests/src/test/java/org/apache/fineract/integrationtests/common/CenterHelper.java:
##########
@@ -95,38 +93,6 @@ public static ArrayList<CenterDomain> listCentersOrdered(final RequestSpecificat
return new Gson().fromJson(jsonData, new TypeToken<ArrayList<CenterDomain>>() {}.getType());
}
- /**
Review Comment:
These changes are unrelated to this PR, no?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
Posted by "DeathGun44 (via GitHub)" <gi...@apache.org>.
DeathGun44 commented on code in PR #6513:
URL: https://github.com/apache/fineract/pull/6513#discussion_r4155573346
##########
integration-tests/src/test/java/org/apache/fineract/integrationtests/common/CenterHelper.java:
##########
@@ -95,38 +93,6 @@ public static ArrayList<CenterDomain> listCentersOrdered(final RequestSpecificat
return new Gson().fromJson(jsonData, new TypeToken<ArrayList<CenterDomain>>() {}.getType());
}
- /**
Review Comment:
Its only callers were the 4 CenterIntegrationTest tests migrated in the first commit, so after that it's dead REST Assured code. The migration itself is in the ticket's scope: those 4 tests were added with REST Assured to an already-migrated file (b509b85d10), which is what this rule now prevents, and migrating them keeps CenterIntegrationTest off the baseline.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
Posted by "adamsaghy (via GitHub)" <gi...@apache.org>.
adamsaghy merged PR #6513:
URL: https://github.com/apache/fineract/pull/6513
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
Posted by "DeathGun44 (via GitHub)" <gi...@apache.org>.
DeathGun44 commented on code in PR #6513:
URL: https://github.com/apache/fineract/pull/6513#discussion_r4155576121
##########
integration-tests/src/test/java/org/apache/fineract/integrationtests/common/CenterHelper.java:
##########
@@ -95,38 +93,6 @@ public static ArrayList<CenterDomain> listCentersOrdered(final RequestSpecificat
return new Gson().fromJson(jsonData, new TypeToken<ArrayList<CenterDomain>>() {}.getType());
}
- /**
Review Comment:
i have also mentioned about this in the jira ticket itself
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
Posted by "adamsaghy (via GitHub)" <gi...@apache.org>.
adamsaghy commented on code in PR #6513:
URL: https://github.com/apache/fineract/pull/6513#discussion_r4153553026
##########
integration-tests/src/test/java/org/apache/fineract/integrationtests/CenterIntegrationTest.java:
##########
@@ -133,38 +121,39 @@ public void testFullCenterCreation() {
public void testListCentersRejectsSqlInjectionInOrderBy() {
final String maliciousOrderBy = "id, (select password from m_appuser limit 1)-- -";
- final Object response = CenterHelper.listCentersRaw(maliciousOrderBy, "ASC", false, requestSpec, expectBadRequest);
- assertNotNull(response, "Expected a validation-error response body, not a silent 200 with leaked data");
+ assertEquals(BAD_REQUEST, centerHelper.listCentersExpectingError(maliciousOrderBy, "ASC", false).getStatus(),
+ "Expected a validation error, not a silent 200 with leaked data");
}
/** Same injection attempt against the paginated listing endpoint, which the patch modifies separately. */
@Test
public void testPaginatedListCentersRejectsSqlInjectionInOrderBy() {
final String maliciousOrderBy = "id, (select password from m_appuser limit 1)-- -";
- final Object response = CenterHelper.listCentersRaw(maliciousOrderBy, "ASC", true, requestSpec, expectBadRequest);
- assertNotNull(response, "Expected a validation-error response body, not a silent 200 with leaked data");
+ assertEquals(BAD_REQUEST, centerHelper.listCentersExpectingError(maliciousOrderBy, "ASC", true).getStatus(),
+ "Expected a validation error, not a silent 200 with leaked data");
}
/**
* Regression test for the new strict ASC/DESC allow-list on {@code sortOrder}: any value other than exactly
- * ASC/DESC — including an injection payload appended to a nominally valid value — must be rejected.
+ * ASC/DESC — including an injection payload appended to a nominally valid value — must be rejected. The SQL
+ * validator does not catch this payload, so only the allow-list stands between it and the ORDER BY clause.
*/
@Test
public void testListCentersRejectsInvalidSortOrderValue() {
- final String maliciousSortOrder = "ASC; DROP TABLE m_office; --";
Review Comment:
why did you remove this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
Posted by "DeathGun44 (via GitHub)" <gi...@apache.org>.
DeathGun44 commented on code in PR #6513:
URL: https://github.com/apache/fineract/pull/6513#discussion_r4155566140
##########
integration-tests/src/test/java/org/apache/fineract/integrationtests/CenterIntegrationTest.java:
##########
@@ -133,38 +121,39 @@ public void testFullCenterCreation() {
public void testListCentersRejectsSqlInjectionInOrderBy() {
final String maliciousOrderBy = "id, (select password from m_appuser limit 1)-- -";
- final Object response = CenterHelper.listCentersRaw(maliciousOrderBy, "ASC", false, requestSpec, expectBadRequest);
- assertNotNull(response, "Expected a validation-error response body, not a silent 200 with leaked data");
+ assertEquals(BAD_REQUEST, centerHelper.listCentersExpectingError(maliciousOrderBy, "ASC", false).getStatus(),
+ "Expected a validation error, not a silent 200 with leaked data");
}
/** Same injection attempt against the paginated listing endpoint, which the patch modifies separately. */
@Test
public void testPaginatedListCentersRejectsSqlInjectionInOrderBy() {
final String maliciousOrderBy = "id, (select password from m_appuser limit 1)-- -";
- final Object response = CenterHelper.listCentersRaw(maliciousOrderBy, "ASC", true, requestSpec, expectBadRequest);
- assertNotNull(response, "Expected a validation-error response body, not a silent 200 with leaked data");
+ assertEquals(BAD_REQUEST, centerHelper.listCentersExpectingError(maliciousOrderBy, "ASC", true).getStatus(),
+ "Expected a validation error, not a silent 200 with leaked data");
}
/**
* Regression test for the new strict ASC/DESC allow-list on {@code sortOrder}: any value other than exactly
- * ASC/DESC — including an injection payload appended to a nominally valid value — must be rejected.
+ * ASC/DESC — including an injection payload appended to a nominally valid value — must be rejected. The SQL
+ * validator does not catch this payload, so only the allow-list stands between it and the ORDER BY clause.
*/
@Test
public void testListCentersRejectsInvalidSortOrderValue() {
- final String maliciousSortOrder = "ASC; DROP TABLE m_office; --";
Review Comment:
The original payload was never reaching the server intact: listCentersRaw URL-encoded it and REST Assured encoded it again, so the server logged ASC%3B+DROP+TABLE+m_office%3B+-- and rejected it only because that isn't ASC/DESC. Sent correctly, ASC; DROP TABLE … is caught earlier by DefaultSqlValidator (403, inject-stacked-query) and never reaches the new sortOrder allow-list the test is documented to cover. I switched to ASC, (select password from m_appuser limit 1), which passes the SQL validator and is rejected only by the allow-list (400).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2858: Improve check for blocking new restassured code [fineract]
Posted by "DeathGun44 (via GitHub)" <gi...@apache.org>.
DeathGun44 commented on PR #6513:
URL: https://github.com/apache/fineract/pull/6513#issuecomment-5927164411
@adamsaghy please take a look when you have a moment!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org