Improved: no functional change in ControlFilterTests class

Uses @beforeeach and @AfterEach to set and remove
"ControlFilterTests" property

Author: JacquesLeRoux

.gitignore

@@ -1,6 +1,5 @@
 bin/
 build/
-gradle/wrapper/gradle-wrapper.jar
 applications/*/build
 framework/*/build
 /plugins/

framework/security/config/security.properties

@@ -145,7 +145,7 @@ security.login.externalLoginKey.enabled=true
 #    Read Passwords and JWT (JSON Web Tokens) usage documentation to choose the way you want to store this key
 #    The key must be 512 bits (ie 64 chars) as we use HMAC512 to create the token, cf. OFBIZ-12724
 #    Run './gradlew generateSecretKeys' to generate a cryptographically secure random key.
-login.secret_key_string=
+login.secret_key_string=5CmG8aolQ8zOkrjuMR2vL+FSXnIbVLqQtl8Z1I6Tyl5hUIJ7t02iAFuZ3raQjT1e
 
 # -- Time To Live of the token send to the external server in seconds
 security.jwt.token.expireTime=1800
@@ -161,7 +161,7 @@ security.internal.sso.enabled=false
 #    Read Passwords and JWT (JSON Web Tokens) usage documentation to choose the way you want to store this key
 #    The key must be 512 bits (ie 64 chars) as we use HMAC512 to create the token, cf. OFBIZ-12724
 #    Run './gradlew generateSecretKeys' to generate a cryptographically secure random key.
-security.token.key=
+security.token.key=bNssBNUJZvIXAF7GHIjVL5k7ydQ4qB/HxtkLqNCG3kyTpbfpA/wi5AEabuBuWXJZ
 
 # -- Specifies the expected issuer (the "iss" claim) of JSON Web Tokens (JWTs).
 #    If this property is set, the system assumes that tokens are issued and signed by an external

framework/webapp/src/test/java/org/apache/ofbiz/webapp/control/ControlFilterTests.java

@@ -24,6 +24,7 @@
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -53,12 +54,18 @@ public void setUp() {
         when(req.getContextPath()).thenReturn("");
         resp = mock(HttpServletResponse.class);
         next = mock(FilterChain.class);
+        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         filter = new ControlFilter();
+
+    }
+
+    @AfterEach
+    public void tearDown() {
+        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void filterWithExactAllowedPath() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("redirectPath")).thenReturn("/foo");
         when(config.getInitParameter("allowedPaths")).thenReturn("/foo:/bar");
         when(req.getRequestURI()).thenReturn("/servlet/bar");
@@ -67,12 +74,10 @@ public void filterWithExactAllowedPath() throws Exception {
         filter.init(config);
         filter.doFilter(req, resp, next);
         verify(next).doFilter(req, resp);
-        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void filterWithAllowedSubPath() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("redirectPath")).thenReturn("/foo");
         when(config.getInitParameter("allowedPaths")).thenReturn("/foo:/bar");
         when(req.getRequestURI()).thenReturn("/servlet/bar/baz");
@@ -81,38 +86,32 @@ public void filterWithAllowedSubPath() throws Exception {
         filter.init(config);
         filter.doFilter(req, resp, next);
         verify(next).doFilter(req, resp);
-        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void filterWithRedirection() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("redirectPath")).thenReturn("/foo");
         when(config.getInitParameter("allowedPaths")).thenReturn("/bar:/baz");
         when(req.getRequestURI()).thenReturn("/missing/path");
 
         filter.init(config);
         filter.doFilter(req, resp, next);
         verify(resp).sendRedirect("/foo");
-        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void filterWithURIredirection() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("redirectPath")).thenReturn("http://example.org/foo");
         when(config.getInitParameter("allowedPaths")).thenReturn("/foo:/bar");
         when(req.getRequestURI()).thenReturn("/baz");
 
         filter.init(config);
         filter.doFilter(req, resp, next);
         verify(resp).sendRedirect("http://example.org/foo");
-        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void bailsOutWithVariousErrorCodes() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("allowedPaths")).thenReturn("/foo");
         when(req.getRequestURI()).thenReturn("/baz");
 
@@ -138,12 +137,10 @@ public void bailsOutWithVariousErrorCodes() throws Exception {
         filter.init(config);
         filter.doFilter(req, resp, next);
         verify(resp).sendError(404, "/baz");
-        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void redirectAllAllowed() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("redirectPath")).thenReturn("/bar");
         when(config.getInitParameter("forceRedirectAll")).thenReturn("Y");
         when(config.getInitParameter("allowedPaths")).thenReturn("/foo");
@@ -152,12 +149,10 @@ public void redirectAllAllowed() throws Exception {
         filter.init(config);
         filter.doFilter(req, resp, next);
         verify(resp).sendRedirect("/bar");
-        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void redirectAllNotAllowed() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("redirectPath")).thenReturn("/bar");
         when(config.getInitParameter("forceRedirectAll")).thenReturn("Y");
         when(config.getInitParameter("allowedPaths")).thenReturn("/foo");
@@ -166,12 +161,10 @@ public void redirectAllNotAllowed() throws Exception {
         filter.init(config);
         filter.doFilter(req, resp, next);
         verify(resp).sendRedirect("/bar");
-        System.clearProperty("ControlFilterTests");
     }
 
     @Test
     public void redirectAllRecursive() throws Exception {
-        System.setProperty("ControlFilterTests", "bypassPreventsStreamExploitation");
         when(config.getInitParameter("redirectPath")).thenReturn("/foo");
         when(config.getInitParameter("forceRedirectAll")).thenReturn("Y");
         when(config.getInitParameter("allowedPaths")).thenReturn("/foo");
@@ -189,6 +182,5 @@ public void redirectAllRecursive() throws Exception {
         filter.doFilter(req, resp, next);
         verify(next).doFilter(req, resp);
         verify(session).removeAttribute("_FORCE_REDIRECT_");
-        System.clearProperty("ControlFilterTests");
     }
 }

gradle/init-gradle-wrapper.ps1

@@ -15,106 +15,26 @@
 # specific language governing permissions and limitations
 # under the License.
 
-param(
-    [switch]$Help,
-    [switch]$Upgrade
-)
-
-if ($Help) {
-    Write-Host "Usage: gradle\init-gradle-wrapper.ps1 [-Help] [-Upgrade]"
-    Write-Host ""
-    Write-Host "Downloads and verifies gradle-wrapper.jar for Apache OFBiz."
-    Write-Host "The jar is not committed to the repository; run this script"
-    Write-Host "before using gradlew.bat for the first time."
-    Write-Host ""
-    Write-Host "Options:"
-    Write-Host "  -Help     Show this message and exit."
-    Write-Host "  -Upgrade  After downloading/verifying the jar, run"
-    Write-Host "            '.\gradlew wrapper' to regenerate gradlew.bat"
-    Write-Host "            to match the new Gradle version."
-    Write-Host ""
-    Write-Host "Workflow for Gradle version upgrades (e.g. from a Dependabot PR):"
-    Write-Host "  1. gradle\init-gradle-wrapper.ps1 -Upgrade"
-    Write-Host "  2. Commit any changes to gradlew and gradlew.bat"
-    exit 0
-}
-
 md -force gradle/wrapper
 
-# Parse the Gradle version from gradle-wrapper.properties
-$distributionUrl = (Get-Content "gradle\wrapper\gradle-wrapper.properties" | Where-Object { $_ -match "^distributionUrl=" }) -replace "^distributionUrl=", ""
-$release = [regex]::Match($distributionUrl, 'gradle-(\d+(?:\.\d+)+)-').Groups[1].Value
-Write-Host "Gradle version: $release"
-
-$gradleWrapperJar = "gradle\wrapper\gradle-wrapper.jar"
-$gradleWrapperUri = "https://github.com/gradle/gradle/raw/v$release/gradle/wrapper/gradle-wrapper.jar"
-$gradleWrapperSha256Uri = "https://services.gradle.org/distributions/gradle-$release-wrapper.jar.sha256"
-
-function Get-ExpectedSha256 {
-    try {
-        return Invoke-RestMethod -Uri $gradleWrapperSha256Uri -ErrorAction Stop
-    } catch {
-        return $null
-    }
-}
-
-function Get-ActualSha256 {
-    return (Get-FileHash $gradleWrapperJar -Algorithm SHA256).Hash.ToLower()
-}
-
-# If gradle-wrapper.jar already exists, verify its checksum before deciding to skip or re-download
-if (Test-Path $gradleWrapperJar) {
-    Write-Host "gradle-wrapper.jar found, verifying checksum..."
-    $expected = Get-ExpectedSha256
-    if ($null -eq $expected) {
-        Write-Host "Warning: could not reach checksum service, skipping verification"
-        exit 0
-    }
-    $actual = Get-ActualSha256
-    if ($actual -eq $expected) {
-        Write-Host "Checksum OK."
-        if ($Upgrade) {
-            Write-Host "Running '.\gradlew wrapper' to regenerate gradlew and gradlew.bat..."
-            & .\gradlew wrapper
-        }
-        exit 0
-    } else {
-        Write-Host "Checksum mismatch, re-downloading..."
-        Remove-Item $gradleWrapperJar
-    }
-}
-
-# Download gradle-wrapper.jar from the Gradle GitHub repository
+# download raw format from https://github.com/gradle/gradle/tree/v7.6.0/gradle/wrapper
 If ($ExecutionContext.SessionState.LanguageMode -eq "ConstrainedLanguage") {
     Set-ItemProperty 'hklm:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -name "__PSLockdownPolicy" -Value 8
-    Invoke-WebRequest -outf $gradleWrapperJar $gradleWrapperUri
+    Invoke-WebRequest -outf gradle\wrapper\gradle-wrapper.jar https://github.com/gradle/gradle/raw/v7.6.0/gradle/wrapper/gradle-wrapper.jar
     Set-ItemProperty 'hklm:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment' -name "__PSLockdownPolicy" -Value 4
 } else {
-    Invoke-WebRequest -outf $gradleWrapperJar $gradleWrapperUri
+    Invoke-WebRequest -outf gradle\wrapper\gradle-wrapper.jar https://github.com/gradle/gradle/raw/v7.6.0/gradle/wrapper/gradle-wrapper.jar
 }
 
-# Verify the downloaded jar against the expected checksum published by Gradle
-# See: https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification
-Write-Host "Verifying checksum..."
-$expected = Get-ExpectedSha256
-if ($null -eq $expected) {
-    Remove-Item $gradleWrapperJar
-    Write-Host "Error: could not fetch checksum from $gradleWrapperSha256Uri"
-    exit 1
-}
-$actual = Get-ActualSha256
-if ($actual -eq $expected) {
-    Write-Host "Checksum OK."
-    if ($Upgrade) {
-        Write-Host "Running '.\gradlew wrapper' to regenerate gradlew and gradlew.bat..."
-        & .\gradlew wrapper
-    }
-} else {
-    Remove-Item $gradleWrapperJar
-    Write-Host "Error: checksum mismatch"
-    Write-Host "Expected: $expected"
-    Write-Host "Actual:   $actual"
-    exit 1
+# https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification
+$expected = Invoke-RestMethod -Uri https://services.gradle.org/distributions/gradle-7.6-wrapper.jar.sha256
+$actual = (Get-FileHash gradle\wrapper\gradle-wrapper.jar -Algorithm SHA256).Hash.ToLower()
+@{$true = 'OK: Checksum match'; $false = "ERROR: Checksum mismatch!`nExpected: $expected`nActual:   $actual"}[$actual -eq $expected]
+
+if (!$true) {
+    Remove-Item gradle\wrapper\gradle-wrapper.jar
 }
 
+#Write-Host $ExecutionContext.SessionState.LanguageMode
+
 Start-Sleep -s 3