From 3cefe45aa8315194f0b36a6d18afce022f033db9 Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Tue, 29 Dec 2020 08:58:30 -0500 Subject: [PATCH 1/6] - adds security policy --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..f7b89984 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ + + +## Security + +Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/). + +If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc751383(v=technet.10)), please report it to us as described below. + +## Reporting Security Issues + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://msrc.microsoft.com/create-report). + +If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://www.microsoft.com/en-us/msrc/pgp-key-msrc). + +You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc). + +Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: + + * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) + * Full paths of source file(s) related to the manifestation of the issue + * The location of the affected source code (tag/branch/commit or direct URL) + * Any special configuration required to reproduce the issue + * Step-by-step instructions to reproduce the issue + * Proof-of-concept or exploit code (if possible) + * Impact of the issue, including how an attacker might exploit the issue + +This information will help us triage your report more quickly. + +If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://microsoft.com/msrc/bounty) page for more details about our active programs. + +## Preferred Languages + +We prefer all communications to be in English. + +## Policy + +Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://www.microsoft.com/en-us/msrc/cvd). + + \ No newline at end of file From 2631298bc8e70c860c8a969c9c676c965fbab4ec Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Tue, 29 Dec 2020 08:58:43 -0500 Subject: [PATCH 2/6] - adds code of conduct --- CODE_OF_CONDUCT.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 CODE_OF_CONDUCT.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 00000000..f9ba8cf6 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,9 @@ +# Microsoft Open Source Code of Conduct + +This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). + +Resources: + +- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/) +- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) +- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns From 83f5ea162872d4d208c2b66d4461fbb5bbcb4254 Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Wed, 13 Jan 2021 13:51:32 -0500 Subject: [PATCH 3/6] - fixes a bug where the telemetry header would not match the specification --- .../com/microsoft/graph/httpcore/TelemetryHandler.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java b/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java index b5da60c3..22a55d4b 100644 --- a/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java +++ b/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java @@ -17,6 +17,7 @@ public class TelemetryHandler implements Interceptor{ public static final String JAVA_VERSION_PREFIX = "java"; public static final String ANDROID_VERSION_PREFIX = "android"; public static final String CLIENT_REQUEST_ID = "client-request-id"; + private static final String DEFAULT_VERSION_VALUE = "0"; @Override public Response intercept(Chain chain) throws IOException { @@ -30,7 +31,9 @@ public Response intercept(Chain chain) throws IOException { final String featureUsage = "(featureUsage=" + telemetryOptions.getFeatureUsage() + ")"; final String javaVersion = System.getProperty("java.version"); final String androidVersion = getAndroidAPILevel(); - final String sdkversion_value = GRAPH_VERSION_PREFIX + "/" + VERSION + " " + featureUsage + " " + JAVA_VERSION_PREFIX + "/" + javaVersion + " " + ANDROID_VERSION_PREFIX + "/" + androidVersion; + final String sdkversion_value = GRAPH_VERSION_PREFIX + "/" + VERSION + " " + featureUsage + + (javaVersion == DEFAULT_VERSION_VALUE ? "" : (", " + JAVA_VERSION_PREFIX + "/" + javaVersion)) + + (androidVersion == DEFAULT_VERSION_VALUE ? "" : (", " + ANDROID_VERSION_PREFIX + "/" + androidVersion)); telemetryAddedBuilder.addHeader(SDK_VERSION, sdkversion_value); if(request.header(CLIENT_REQUEST_ID) == null) { @@ -61,10 +64,10 @@ private String getAndroidAPILevelInternal() { final Field sdkVersionField = versionClass.getField("SDK_INT"); final Object value = sdkVersionField.get(null); final String valueStr = String.valueOf(value); - return valueStr == null || valueStr == "" ? "0" : valueStr; + return valueStr == null || valueStr == "" ? DEFAULT_VERSION_VALUE : valueStr; } catch (IllegalAccessException | ClassNotFoundException | NoSuchFieldException ex) { // we're not on android and return "0" to align with java version which returns "0" when running on android - return "0"; + return DEFAULT_VERSION_VALUE; } } } From e7c753cb264cfbc9f904aae27358121fdfe0ea67 Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Thu, 14 Jan 2021 11:29:50 -0500 Subject: [PATCH 4/6] - updates unit test to match behavior change --- .../java/com/microsoft/graph/httpcore/TelemetryHandlerTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/java/com/microsoft/graph/httpcore/TelemetryHandlerTest.java b/src/test/java/com/microsoft/graph/httpcore/TelemetryHandlerTest.java index 8fcffc3d..897a54a2 100644 --- a/src/test/java/com/microsoft/graph/httpcore/TelemetryHandlerTest.java +++ b/src/test/java/com/microsoft/graph/httpcore/TelemetryHandlerTest.java @@ -33,7 +33,7 @@ public Request authenticateRequest(Request request) { final Response response = client.newCall(request).execute(); assertNotNull(response); assertTrue(response.request().header(TelemetryHandler.SDK_VERSION).contains(expectedHeader)); - assertTrue(response.request().header(TelemetryHandler.SDK_VERSION).contains(TelemetryHandler.ANDROID_VERSION_PREFIX)); + assertTrue(!response.request().header(TelemetryHandler.SDK_VERSION).contains(TelemetryHandler.ANDROID_VERSION_PREFIX)); // Android version is not going to be present on unit tests runnning on java platform assertTrue(response.request().header(TelemetryHandler.SDK_VERSION).contains(TelemetryHandler.JAVA_VERSION_PREFIX)); } From 16e98ca7958b7743367982b8cd349b858a4b58e3 Mon Sep 17 00:00:00 2001 From: Theo Belaire Date: Thu, 21 Jan 2021 11:57:27 -0500 Subject: [PATCH 5/6] Actually throw exception in MSBatchRequestStep It was created but not thrown, which just discards it. --- .../java/com/microsoft/graph/content/MSBatchRequestStep.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/com/microsoft/graph/content/MSBatchRequestStep.java b/src/main/java/com/microsoft/graph/content/MSBatchRequestStep.java index ac13bb0a..9e4265a4 100644 --- a/src/main/java/com/microsoft/graph/content/MSBatchRequestStep.java +++ b/src/main/java/com/microsoft/graph/content/MSBatchRequestStep.java @@ -15,7 +15,7 @@ public MSBatchRequestStep(String requestId, Request request, List arrayO if(requestId.length() == 0) throw new IllegalArgumentException("Request Id cannot be empty."); if(request == null) - new IllegalArgumentException("Request cannot be null."); + throw new IllegalArgumentException("Request cannot be null."); this.requestId = requestId; this.request = request; From 6056281a353f65fcc060b5cb57d3a8f17e64ddfe Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Thu, 21 Jan 2021 13:29:47 -0500 Subject: [PATCH 6/6] - bumps minor version --- gradle.properties | 2 +- readme.md | 4 ++-- .../java/com/microsoft/graph/httpcore/TelemetryHandler.java | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gradle.properties b/gradle.properties index 17a8f7ac..8defcc2e 100644 --- a/gradle.properties +++ b/gradle.properties @@ -25,7 +25,7 @@ mavenGroupId = com.microsoft.graph mavenArtifactId = microsoft-graph-core mavenMajorVersion = 1 mavenMinorVersion = 0 -mavenPatchVersion = 6 +mavenPatchVersion = 7 mavenArtifactSuffix = nightliesUrl = http://dl.bintray.com/MicrosoftGraph/Maven diff --git a/readme.md b/readme.md index b280482d..44aa829e 100644 --- a/readme.md +++ b/readme.md @@ -20,7 +20,7 @@ repositories { dependencies { // Include the sdk as a dependency - implementation 'com.microsoft.graph:microsoft-graph-core:1.0.6' + implementation 'com.microsoft.graph:microsoft-graph-core:1.0.7' } ``` @@ -32,7 +32,7 @@ Add the dependency in `dependencies` in pom.xml com.microsoft.graph microsoft-graph-core - 1.0.6 + 1.0.7 ``` diff --git a/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java b/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java index b5da60c3..d55079c8 100644 --- a/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java +++ b/src/main/java/com/microsoft/graph/httpcore/TelemetryHandler.java @@ -12,7 +12,7 @@ public class TelemetryHandler implements Interceptor{ public static final String SDK_VERSION = "SdkVersion"; - public static final String VERSION = "v1.0.6"; + public static final String VERSION = "v1.0.7"; public static final String GRAPH_VERSION_PREFIX = "graph-java-core"; public static final String JAVA_VERSION_PREFIX = "java"; public static final String ANDROID_VERSION_PREFIX = "android";