@Test public void test_write_failure_no_explicit_permission() { String token = "5PDrOhsy4ig8L3EpsJZSLAMg"; String jsonStr = "{\"path\":\"shared/mysafe01/myfolder\",\"data\":{\"secret1\":\"value1\",\"secret2\":\"value2\"}}"; HashMap<String, String> data = new HashMap<>(); data.put("secret1", "value1"); Secret secret = new Secret("shared/mysafe01/myfolder", data); Response response = getMockResponse(HttpStatus.NO_CONTENT, true, ""); ResponseEntity<String> responseEntityExpected = ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"No permisison to write secret in this safe\"]}"); when(ControllerUtil.addDefaultSecretKey(jsonStr)).thenReturn("{\"path\":\"shared/mysafe01/myfolder\",\"data\":{\"secret1\":\"value1\",\"secret2\":\"value2\"}}"); when(ControllerUtil.areSecretKeysValid(jsonStr)).thenReturn(true); when(ControllerUtil.isPathValid("shared/mysafe01/myfolder")).thenReturn(true); when(reqProcessor.process("/write",jsonStr,token)).thenReturn(response); String path ="shared/mysafe01/myfolder"; when(ControllerUtil.getSafeType(path)).thenReturn("shared"); when(ControllerUtil.getSafeName(path)).thenReturn("mysafe01"); String policies[] = {"s_shared_mysafe01"}; UserDetails userDetails = getMockUser(false); userDetails.setPolicies(policies); when(JSONUtil.getJSON(secret)).thenReturn(jsonStr); ResponseEntity<String> responseEntity = secretService.write(token, secret, userDetails); assertEquals(HttpStatus.FORBIDDEN, responseEntity.getStatusCode()); assertEquals(responseEntityExpected, responseEntity); }
public ResponseEntity<String> write(String token, Secret secret, UserDetails userDetails){ String jsonStr = JSONUtil.getJSON(secret); String path=""; try { path = new ObjectMapper().readTree(jsonStr).at("/path").asText(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Trying to write secret [%s]", path)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); jsonStr = ControllerUtil.addDefaultSecretKey(jsonStr); if (!ControllerUtil.areSecretKeysValid(jsonStr)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } } catch (IOException e) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } if(ControllerUtil.isPathValid(path)){ if (!hasExplicitWritePermission(token, userDetails, secret.getPath())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "No permisison to write secret in this safe"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"No permisison to write secret in this safe\"]}"); } Response response = reqProcessor.process("/write",jsonStr,token); if(response.getHttpstatus().equals(HttpStatus.NO_CONTENT)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] completed succssfully", path)). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Secret saved to vault\"]}"); } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, response.getResponse()). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "Invalid path"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid path\"]}"); } }
SecretService { public ResponseEntity<String> write(String token, Secret secret, UserDetails userDetails){ String jsonStr = JSONUtil.getJSON(secret); String path=""; try { path = new ObjectMapper().readTree(jsonStr).at("/path").asText(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Trying to write secret [%s]", path)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); jsonStr = ControllerUtil.addDefaultSecretKey(jsonStr); if (!ControllerUtil.areSecretKeysValid(jsonStr)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } } catch (IOException e) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } if(ControllerUtil.isPathValid(path)){ if (!hasExplicitWritePermission(token, userDetails, secret.getPath())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "No permisison to write secret in this safe"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"No permisison to write secret in this safe\"]}"); } Response response = reqProcessor.process("/write",jsonStr,token); if(response.getHttpstatus().equals(HttpStatus.NO_CONTENT)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] completed succssfully", path)). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Secret saved to vault\"]}"); } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, response.getResponse()). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "Invalid path"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid path\"]}"); } } }
SecretService { public ResponseEntity<String> write(String token, Secret secret, UserDetails userDetails){ String jsonStr = JSONUtil.getJSON(secret); String path=""; try { path = new ObjectMapper().readTree(jsonStr).at("/path").asText(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Trying to write secret [%s]", path)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); jsonStr = ControllerUtil.addDefaultSecretKey(jsonStr); if (!ControllerUtil.areSecretKeysValid(jsonStr)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } } catch (IOException e) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } if(ControllerUtil.isPathValid(path)){ if (!hasExplicitWritePermission(token, userDetails, secret.getPath())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "No permisison to write secret in this safe"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"No permisison to write secret in this safe\"]}"); } Response response = reqProcessor.process("/write",jsonStr,token); if(response.getHttpstatus().equals(HttpStatus.NO_CONTENT)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] completed succssfully", path)). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Secret saved to vault\"]}"); } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, response.getResponse()). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "Invalid path"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid path\"]}"); } }  }
SecretService { public ResponseEntity<String> write(String token, Secret secret, UserDetails userDetails){ String jsonStr = JSONUtil.getJSON(secret); String path=""; try { path = new ObjectMapper().readTree(jsonStr).at("/path").asText(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Trying to write secret [%s]", path)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); jsonStr = ControllerUtil.addDefaultSecretKey(jsonStr); if (!ControllerUtil.areSecretKeysValid(jsonStr)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } } catch (IOException e) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } if(ControllerUtil.isPathValid(path)){ if (!hasExplicitWritePermission(token, userDetails, secret.getPath())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "No permisison to write secret in this safe"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"No permisison to write secret in this safe\"]}"); } Response response = reqProcessor.process("/write",jsonStr,token); if(response.getHttpstatus().equals(HttpStatus.NO_CONTENT)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] completed succssfully", path)). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Secret saved to vault\"]}"); } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, response.getResponse()). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "Invalid path"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid path\"]}"); } }  ResponseEntity<String> readFromVault(String token, String path); ResponseEntity<String> write(String token, Secret secret, UserDetails userDetails); ResponseEntity<String> deleteFromVault(String token, String path); ResponseEntity<String> readFromVaultRecursive(String token, String path); ResponseEntity<String> readFoldersAndSecrets(String token, String path); }
SecretService { public ResponseEntity<String> write(String token, Secret secret, UserDetails userDetails){ String jsonStr = JSONUtil.getJSON(secret); String path=""; try { path = new ObjectMapper().readTree(jsonStr).at("/path").asText(); log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Trying to write secret [%s]", path)). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); jsonStr = ControllerUtil.addDefaultSecretKey(jsonStr); if (!ControllerUtil.areSecretKeysValid(jsonStr)) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } } catch (IOException e) { return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid request.Check json data\"]}"); } if(ControllerUtil.isPathValid(path)){ if (!hasExplicitWritePermission(token, userDetails, secret.getPath())) { log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "No permisison to write secret in this safe"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.FORBIDDEN).body("{\"errors\":[\"No permisison to write secret in this safe\"]}"); } Response response = reqProcessor.process("/write",jsonStr,token); if(response.getHttpstatus().equals(HttpStatus.NO_CONTENT)) { log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] completed succssfully", path)). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.OK).body("{\"messages\":[\"Secret saved to vault\"]}"); } log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, response.getResponse()). put(LogMessage.STATUS, response.getHttpstatus().toString()). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(response.getHttpstatus()).body(response.getResponse()); }else{ log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder(). put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER).toString()). put(LogMessage.ACTION, "Write Secret"). put(LogMessage.MESSAGE, String.format("Writing secret [%s] failed", path)). put(LogMessage.RESPONSE, "Invalid path"). put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL).toString()). build())); return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("{\"errors\":[\"Invalid path\"]}"); } }  ResponseEntity<String> readFromVault(String token, String path); ResponseEntity<String> write(String token, Secret secret, UserDetails userDetails); ResponseEntity<String> deleteFromVault(String token, String path); ResponseEntity<String> readFromVaultRecursive(String token, String path); ResponseEntity<String> readFoldersAndSecrets(String token, String path);  }