forked from apache/atlas
-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3294 from atlanhq/beta-master-helper
Syncing Beta with Master
- Loading branch information
Showing
8 changed files
with
109 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
repository/src/test/java/org/apache/atlas/repository/util/FilterUtilTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| package org.apache.atlas.repository.util; | ||
|
|
||
| import org.junit.Test; | ||
|
|
||
| import static org.apache.atlas.repository.util.FilterUtil.validateFilePath; | ||
| import static org.junit.Assert.*; | ||
|
|
||
| public class FilterUtilTest { | ||
| @Test | ||
| public void testValidateFilePath() { | ||
| // Array of test cases, each containing the file path and the expected boolean result | ||
| Object[][] testCases = { | ||
| {"/var/app/allowed/file.txt", true, "Should return true for a valid path within the allowed directory."}, | ||
| {"/tmp/../notallowed/file.txt", false, "Should return false for a path attempting directory traversal."}, | ||
| {"/var/app/allowed/./file.txt", false, "Should return false for a path with relative current directory notation."}, | ||
| {"/Users/username/repos/repo0/.\\file.txt", false, "Should return false for a path with mixed slash types potentially bypassing checks."}, | ||
| {"tmp/file.txt", false, "Should return false for non-absolute paths."}, | ||
| {"", false, "Should return false for empty paths"}, | ||
| {"/var/app/allowed/..\\file.txt", false, "Should return false for paths with unusual characters aiming to navigate directories."}, | ||
| {"/Users/username/repos/repo0/%2e%2e/notallowed/file.txt", false, "Should return false for paths with URL-encoded traversal sequences."}, | ||
| {"/var/app/allowed/\0file.txt", false, "Should return false for paths that cause exceptions, like those containing null bytes."} | ||
| }; | ||
|
|
||
| for (Object[] testCase : testCases) { | ||
| String path = (String) testCase[0]; | ||
| boolean expected = (Boolean) testCase[1]; | ||
| String message = (String) testCase[2]; | ||
|
|
||
| if (expected) { | ||
| assertTrue(message, validateFilePath(path)); | ||
| } else { | ||
| assertFalse(message, validateFilePath(path)); | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
39 changes: 39 additions & 0 deletions
39
webapp/src/test/java/org/apache/atlas/web/filters/MetaStoreActiveServerFilterTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| package org.apache.atlas.web.filters; | ||
|
|
||
| import org.junit.Test; | ||
|
|
||
|
|
||
| import static org.apache.atlas.web.filters.ActiveServerFilter.sanitizeRedirectLocation; | ||
| import static org.junit.Assert.assertEquals; | ||
| import static org.junit.Assert.assertNull; | ||
|
|
||
| public class MetaStoreActiveServerFilterTest { | ||
|
|
||
| @Test | ||
| public void testSanitizeRedirectLocation() { | ||
| Object[][] testCases = { | ||
| {"https://dom-sub-uat.atlan.com/api/meta/entity/guid/fd7a69c9-738b-4b35-a0db-1da00cbd86cd", "https%3A%2F%2Fdom-sub-uat.atlan.com%2Fapi%2Fmeta%2Fentity%2Fguid%2Ffd7a69c9-738b-4b35-a0db-1da00cbd86cd"}, | ||
| {"https://datamesh.atlan.com/api/meta/entity/bulk?replaceBusinessAttributes=true&replaceClassifications=true", "https%3A%2F%2Fdatamesh.atlan.com%2Fapi%2Fmeta%2Fentity%2Fbulk%3FreplaceBusinessAttributes%3Dtrue%26replaceClassifications%3Dtrue"}, | ||
| {"http://example.com/page?param=value&another=one", "http%3A%2F%2Fexample.com%2Fpage%3Fparam%3Dvalue%26another%3Done"}, | ||
| {"http://example.com/page?param=value%Set-Cookie: test=evil", "http%3A%2F%2Fexample.com%2Fpage%3Fparam%3Dvalue%25Set-Cookie%3A+test%3Devil"}, | ||
| {"http://example.com/search?query=value\n<script>alert('xss')</script>", "http%3A%2F%2Fexample.com%2Fsearch%3Fquery%3Dvalue%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E"}, | ||
| {"http://example.com/update?action=edit%HTTP/1.1 200 OKContent-Type: text/html", "http%3A%2F%2Fexample.com%2Fupdate%3Faction%3Dedit%25HTTP%2F1.1+200+OKContent-Type%3A+text%2Fhtml"}, | ||
| {"http://example.com/login?redirect=success%Set-Cookie: sessionId=12345", "http%3A%2F%2Fexample.com%2Flogin%3Fredirect%3Dsuccess%25Set-Cookie%3A+sessionId%3D12345"}, | ||
| {"http://example.com/page\r", "http%3A%2F%2Fexample.com%2Fpage"}, | ||
| {"http://example.com/page?next=url%0D%0AContent-Length: %300", "http%3A%2F%2Fexample.com%2Fpage%3Fnext%3Durl%0D%0AContent-Length%3A+%300"}, | ||
| {null, null} // Testing for null input | ||
| }; | ||
|
|
||
| for (Object[] testCase : testCases) { | ||
| String input = (String) testCase[0]; | ||
| String expected = (String) testCase[1]; | ||
|
|
||
| if (input == null) { | ||
| assertNull("Output should be null for null input.", sanitizeRedirectLocation(input)); | ||
| } else { | ||
| assertEquals("URLs should be correctly sanitized.", expected, sanitizeRedirectLocation(input)); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| } |