VFSPermissionsFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest)request; int tokenPlace; String lastTokenBeforePath = "/" + gitServerUriPrefix + "/"; if ((tokenPlace = req.getRequestURL().indexOf(lastTokenBeforePath)) != -1) { String url = req.getRequestURL().substring(tokenPlace + lastTokenBeforePath.length()); url = url.replaceFirst("/info/refs", ""); url = url.replaceFirst("/git-upload-pack", ""); url = url.replaceAll("/", Matcher.quoteReplacement(File.separator)); File projectDirectory = Paths.get(vfsRoot, url).toFile(); String auth; String userName = ""; String password = ""; if ((auth = req.getHeader("authorization")) != null) { String userAndPasswordEncoded = auth.substring(6); String userAndPasswordDecoded = new String(Base64.decodeBase64(userAndPasswordEncoded)); int betweenUserAndPassword = userAndPasswordDecoded.indexOf(':'); userName = userAndPasswordDecoded.substring(0, betweenUserAndPassword); password = userAndPasswordDecoded.substring(betweenUserAndPassword + 1); } boolean needLogout = false; String token = null; User user; try { if (!userName.isEmpty()) { if (password.equals("x-che")) { token = userName; } else { token = getToken(userName, password); if (token == null) { ((HttpServletResponse)response).sendError(HttpServletResponse.SC_FORBIDDEN); return; } needLogout = true; } user = getUserBySSO(token); EnvironmentContext.getCurrent().setUser(user); } if (!hasAccessToItem(projectDirectory.getParentFile().getName(), projectDirectory.getName())) { if (!userName.isEmpty()) { ((HttpServletResponse)response).sendError(HttpServletResponse.SC_FORBIDDEN); return; } else { ((HttpServletResponse)response).addHeader("Cache-Control", "private"); ((HttpServletResponse)response).addHeader("WWW-Authenticate", "Basic"); ((HttpServletResponse)response).sendError(HttpServletResponse.SC_UNAUTHORIZED); return; } } } finally { if (needLogout) { logout(); } EnvironmentContext.reset(); } } chain.doFilter(req, response); }  @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest request, ServletResponse response, FilterChain chain); @Override void destroy();  }
@Test public void shouldSkipFurtherIfProjectHasPermissionsForAllAndUserIsEmpty() throws IOException, ServletException, UnauthorizedException, ForbiddenException, ConflictException, NotFoundException, ServerException { when(httpJsonHelper.requestString(anyString(), eq("GET"), any())).thenReturn("123"); filter.doFilter(request, response, filterChain); verify(filterChain).doFilter(request, response); }
@Test public void shouldRespondUnauthorizedIfProjectHasPermissionsToSpecificUserAndUserIsEmpty() throws IOException, ServletException, UnauthorizedException, ForbiddenException, ConflictException, NotFoundException, ServerException { when(httpJsonHelper.requestString(anyString(), eq("GET"), any())).thenThrow(new UnauthorizedException("NO")); filter.doFilter(request, response, filterChain); verify(response).sendError(eq(HttpServletResponse.SC_UNAUTHORIZED)); }
@Test public void shouldSkipFurtherIfUsernameAndPasswordAndAccessAllowed() throws IOException, ServletException, ApiException { when(request.getHeader("authorization")).thenReturn( "BASIC " + (Base64.encodeBase64String(("OTHERUSER" + ":" + PASSWORD).getBytes()))); when(httpJsonHelper.request(eq(Token.class), anyString(), eq("POST"), any())).thenReturn(DtoFactory.getInstance().createDto(Token.class).withValue("123")); when(httpJsonHelper.requestString(contains("internal/sso/server"), eq("GET"), isNull(), eq(Pair.of("clienturl", URLEncoder .encode(ENDPOINT, "UTF-8"))))) .thenReturn(JsonHelper.toJson(new UserImpl("name1", "id1", "123", Arrays.asList("role1"), false))); when(httpJsonHelper.requestString(anyString(), eq("GET"), any())).thenReturn("123"); filter.doFilter(request, response, filterChain); verify(filterChain).doFilter(request, response); }
@Test public void shouldSkipFurtherIfTokenPresentAndAccessAllowed() throws IOException, ServletException, ApiException { when(request.getHeader("authorization")).thenReturn( "BASIC " + (Base64.encodeBase64String(("OTHERUSER" + ":" + "x-che").getBytes()))); when(httpJsonHelper.requestString(contains("internal/sso/server"), eq("GET"), isNull(), eq(Pair.of("clienturl", URLEncoder .encode(ENDPOINT, "UTF-8"))))) .thenReturn(JsonHelper.toJson(new UserImpl("name1", "id1", "123", Arrays.asList("role1"), false))); when(httpJsonHelper.requestString(anyString(), eq("GET"), any())).thenReturn("123"); filter.doFilter(request, response, filterChain); verify(filterChain).doFilter(request, response); }