Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Formbased authentication corrupts post params payara #429

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Formbased authentication corrupts post params payara #429

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
69d8b87
First attemp to reproduce parameter corruption in Payara
albfernandez Jan 26, 2018
3a557d5
Fix the test to reproduce payara bug
albfernandez Jan 28, 2018
affedbf
Merge branch 'master' into formbased_authentication_corrupts_post_par…
arjantijms Dec 5, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion servlet/security-form-based/src/main/webapp/WEB-INF/web.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@
<security-constraint>
<web-resource-collection>
<web-resource-name>SecurityConstraint</web-resource-name>
<url-pattern>/*</url-pattern>
<url-pattern>*.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>g1</role-name>
Expand Down
21 changes: 21 additions & 0 deletions servlet/security-form-based/src/main/webapp/form.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
<!DOCTYPE html>
<html>
<head>
<title>Sample form</title>
</head>
<body>
<h1>Example</h1>
<p>
Submit your data, you must see your data after login.</p>
<p>This example make a test with a single parameter.
If you submit more parameters, only one (the last in the post body) is corrupted</p>

<p>You must be logged out to test the bug, because the bug is in the authenticator</p>

<form method="POST" action="receive.jsp" name="form">
<input type="text" id="name" name="name" value="example"/>
<!-- No name attribute for submit, we want to test only (and only) one parameter -->
<input type="submit" value="Submit"/>
</form>
</body>
</html>
33 changes: 33 additions & 0 deletions servlet/security-form-based/src/main/webapp/receive.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
<%@page
contentType="text/html; charset=UTF-8"
language="java"
pageEncoding="UTF-8"
import="java.nio.charset.StandardCharsets"
%><%

String param = request.getParameter("name");
if (param == null) {
param = "";
}
int paramLength = param.length();
byte[] paramData = param.getBytes(StandardCharsets.UTF_8);
int paramDataLength = paramData.length;
%>
<!DOCTYPE html>
<html>
<head>
<title>Receiving parameters via post</title>
</head>
<body>

<p>Here you should see the data you entered in the previous form.</p>
<p>the bug makes the last parameter to contain a lot of junk (zeros) at the end</p>


Hello <span id="param"><%= param %></span><br/>
paramLegnth <span id="paramLength"><%= paramLength %></span><br/>
paramDataLength <span id="arrayLength"><%= paramDataLength %></span>


</body>
</html>
38 changes: 33 additions & 5 deletions ...t/security-form-based/src/test/java/org/javaee7/servlet/security/form/based/FormTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import com.gargoylesoftware.htmlunit.html.HtmlPage;
import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;


/**
* @author Arun Gupta
*/
Expand All @@ -32,8 +33,8 @@ public class FormTest {

@ArquillianResource
private URL base;
private WebClient webClient;

private HtmlForm loginForm;

@Deployment(testable = false)
public static WebArchive createDeployment() {
Expand All @@ -44,26 +45,27 @@ public static WebArchive createDeployment() {
.addAsWebResource(new File(WEBAPP_SRC, "index.jsp"))
.addAsWebResource(new File(WEBAPP_SRC, "loginerror.jsp"))
.addAsWebResource(new File(WEBAPP_SRC, "loginform.jsp"))
.addAsWebResource(new File(WEBAPP_SRC, "form.html"))
.addAsWebResource(new File(WEBAPP_SRC, "receive.jsp"))
.addAsWebInfResource(new File(WEBAPP_SRC + "/WEB-INF", "web.xml"))
.addAsWebInfResource(new File(WEBAPP_SRC + "/WEB-INF", "glassfish-web.xml"));
}

@Before
public void setup() throws IOException {
WebClient webClient = new WebClient();
HtmlPage page = webClient.getPage(base + "/index.jsp");
loginForm = page.getForms().get(0);
webClient = new WebClient();
}

@After
public void tearDown() {
WebClient webClient = loginForm.getPage().getWebClient();
webClient.getCookieManager().clearCookies();
webClient.close();
}

@Test
public void testGetWithCorrectCredentials() throws Exception {
HtmlPage loginPage = webClient.getPage(base + "/index.jsp");
HtmlForm loginForm = loginPage.getForms().get(0);
loginForm.getInputByName("j_username").setValueAttribute("u1");
loginForm.getInputByName("j_password").setValueAttribute("p1");
HtmlSubmitInput submitButton = loginForm.getInputByName("submitButton");
Expand All @@ -74,11 +76,37 @@ public void testGetWithCorrectCredentials() throws Exception {

@Test
public void testGetWithIncorrectCredentials() throws Exception {
HtmlPage page = webClient.getPage(base + "/index.jsp");
HtmlForm loginForm = page.getForms().get(0);
loginForm.getInputByName("j_username").setValueAttribute("random");
loginForm.getInputByName("j_password").setValueAttribute("random");
HtmlSubmitInput submitButton = loginForm.getInputByName("submitButton");
HtmlPage page2 = submitButton.click();

assertEquals("Form-Based Login Error Page", page2.getTitleText());
}
@Test
public void testMaintainPostParamsAfterAuth() throws Exception {

String PARAM_VALUE = "example";
String PARAM_LENGTH = Integer.toString(PARAM_VALUE.length());

// Unauthenticated page
HtmlPage unauthenticatedPage = webClient.getPage(base + "/form.html");
HtmlForm unauthenticatedForm = unauthenticatedPage.getForms().get(0);
unauthenticatedForm.getInputByName("name").setValueAttribute(PARAM_VALUE);
HtmlSubmitInput unauthenticatedSubmitButton = unauthenticatedForm.getInputByValue("Submit");

// we request an protected page, so we are presented the login page.
HtmlPage loginPage = unauthenticatedSubmitButton.click();
HtmlForm loginForm = loginPage.getForms().get(0);
loginForm.getInputByName("j_username").setValueAttribute("u1");
loginForm.getInputByName("j_password").setValueAttribute("p1");
HtmlSubmitInput submitButton = loginForm.getInputByName("submitButton");

HtmlPage receivePage = submitButton.click();
assertEquals(PARAM_LENGTH, receivePage.getElementById("paramLength").getTextContent());
assertEquals(PARAM_LENGTH, receivePage.getElementById("arrayLength").getTextContent());
assertEquals(PARAM_VALUE, receivePage.getElementById("param").getTextContent());
}
}