Skip to content

Commit aef500b

Browse files
adamretteradamretter
authored
Merge pull request #107 from evolvedbinary/6.x.x/hotfix/security-metadata
[6.x.x] Fix an issue with de-serialization of Maps in the Configurator
2 parents 6517fc6 + 5385228 commit aef500b

9 files changed

Lines changed: 619 additions & 398 deletions

‎exist-core/pom.xml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -724,6 +724,8 @@
724724
<include>src/test/java/org/exist/xquery/functions/fn/ParsingFunctionsTest.java</include>
725725
<include>src/test/java/org/exist/xquery/functions/fn/transform/ConvertTest.java</include>
726726
<include>src/test/java/org/exist/xquery/functions/fn/transform/FunTransformITTest.java</include>
727+
<include>src/test/java/org/exist/xquery/functions/securitymanager/AccountMetadataFunctionsTest.java</include>
728+
<include>src/test/java/org/exist/xquery/functions/securitymanager/SecurityManagerTestUtil.java</include>
727729
<include>src/main/java/org/exist/xquery/functions/system/FunctionAvailable.java</include>
728730
<include>src/test/java/org/exist/xquery/functions/xmldb/XMLDBStoreTest.java</include>
729731
<include>src/test/java/org/exist/xquery/functions/xquery3/SerializeTest.java</include>
@@ -1143,6 +1145,11 @@
11431145
<include>src/main/java/org/exist/xquery/functions/fn/transform/Transform.java</include>
11441146
<include>src/main/java/org/exist/xquery/functions/fn/transform/TreeUtils.java</include>
11451147
<include>src/main/java/org/exist/xquery/functions/integer/WordPicture.java</include>
1148+
<include>src/test/java/org/exist/xquery/functions/securitymanager/GetPermissionsTest.java</include>
1149+
<include>src/test/java/org/exist/xquery/functions/securitymanager/GroupManagementFunctionRemoveGroupTest.java</include>
1150+
<include>src/test/java/org/exist/xquery/functions/securitymanager/GroupMembershipFunctionRemoveGroupMemberTest.java</include>
1151+
<include>src/test/java/org/exist/xquery/functions/securitymanager/PermissionsFunctionChmodTest.java</include>
1152+
<include>src/test/java/org/exist/xquery/functions/securitymanager/PermissionsFunctionChownTest.java</include>
11461153
<include>src/main/java/org/exist/xquery/functions/system/GetUptime.java</include>
11471154
<include>src/main/java/org/exist/xquery/functions/system/Shutdown.java</include>
11481155
<include>src/main/java/org/exist/xquery/functions/system/SystemModule.java</include>
@@ -1727,6 +1734,13 @@
17271734
<exclude>src/main/java/org/exist/xquery/functions/fn/transform/TreeUtils.java</exclude>
17281735
<exclude>src/main/java/org/exist/xquery/functions/integer/WordPicture.java</exclude>
17291736
<exclude>src/main/java/org/exist/xquery/functions/map/MapType.java</exclude>
1737+
<exclude>src/test/java/org/exist/xquery/functions/securitymanager/AccountMetadataFunctionsTest.java</exclude>
1738+
<exclude>src/test/java/org/exist/xquery/functions/securitymanager/GetPermissionsTest.java</exclude>
1739+
<exclude>src/test/java/org/exist/xquery/functions/securitymanager/GroupManagementFunctionRemoveGroupTest.java</exclude>
1740+
<exclude>src/test/java/org/exist/xquery/functions/securitymanager/GroupMembershipFunctionRemoveGroupMemberTest.java</exclude>
1741+
<exclude>src/test/java/org/exist/xquery/functions/securitymanager/PermissionsFunctionChmodTest.java</exclude>
1742+
<exclude>src/test/java/org/exist/xquery/functions/securitymanager/PermissionsFunctionChownTest.java</exclude>
1743+
<exclude>src/test/java/org/exist/xquery/functions/securitymanager/SecurityManagerTestUtil.java</exclude>
17301744
<exclude>src/test/java/org/exist/xquery/functions/session/AbstractSessionTest.java</exclude>
17311745
<exclude>src/test/java/org/exist/xquery/functions/session/AttributeTest.java</exclude>
17321746
<exclude>src/main/java/org/exist/xquery/functions/system/FunctionAvailable.java</exclude>

‎exist-core/src/main/java/org/exist/config/ConfigurationImpl.java‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -146,20 +146,20 @@ private void cache() {
146146
Node child = element.getFirstChild();
147147
while (child != null) {
148148

149-
if (child.getNodeType() == Node.ELEMENT_NODE) {
149+
if (child instanceof Element) {
150+
final Element childElement = (Element) child;
150151

151-
final String ns = child.getNamespaceURI();
152-
if (ns != null && NS.equals(ns)) {
153-
154-
String name = child.getLocalName();
152+
final String ns = childElement.getNamespaceURI();
153+
if (NS.equals(ns)) {
155154

155+
final String name = childElement.getLocalName();
156+
156157
if (names.contains(name)) {
157-
158-
if (props.containsKey(name)) {
159-
props.remove(name);
160-
}
158+
props.remove(name);
161159
} else {
162-
props.put(name, child.getTextContent());
160+
if (!childElement.hasAttribute("key")) { // NOTE(AR) Skip Map entries
161+
props.put(name, childElement.getTextContent());
162+
}
163163
names.add(name);
164164
}
165165
}

‎exist-core/src/test/java/org/exist/xquery/functions/securitymanager/AccountMetadataFunctionsTest.java‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
/*
2+
* Elemental
3+
* Copyright (C) 2024, Evolved Binary Ltd
4+
*
5+
* admin@evolvedbinary.com
6+
* https://www.evolvedbinary.com | https://www.elemental.xyz
7+
*
8+
* This library is free software; you can redistribute it and/or
9+
* modify it under the terms of the GNU Lesser General Public
10+
* License as published by the Free Software Foundation; version 2.1.
11+
*
12+
* This library is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15+
* Lesser General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU Lesser General Public
18+
* License along with this library; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20+
*/
21+
package org.exist.xquery.functions.securitymanager;
22+
23+
import org.exist.EXistException;
24+
import org.exist.collections.Collection;
25+
import org.exist.security.AXSchemaType;
26+
import org.exist.security.PermissionDeniedException;
27+
import org.exist.security.SecurityManager;
28+
import org.exist.security.internal.RealmImpl;
29+
import org.exist.storage.BrokerPool;
30+
import org.exist.storage.DBBroker;
31+
import org.exist.storage.txn.Txn;
32+
import org.exist.test.ExistEmbeddedServer;
33+
import org.exist.util.LockException;
34+
import org.exist.util.MimeType;
35+
import org.exist.util.StringInputSource;
36+
import org.exist.xmldb.XmldbURI;
37+
import org.exist.xquery.XPathException;
38+
import org.exist.xquery.XQuery;
39+
import org.exist.xquery.value.Sequence;
40+
import org.junit.Rule;
41+
import org.junit.Test;
42+
import org.xml.sax.SAXException;
43+
44+
import java.io.IOException;
45+
import java.util.Arrays;
46+
import java.util.Optional;
47+
48+
import static com.evolvedbinary.j8fu.tuple.Tuple.Tuple;
49+
import static org.exist.xquery.functions.securitymanager.SecurityManagerTestUtil.*;
50+
import static org.junit.Assert.assertEquals;
51+
import static org.junit.Assert.assertNotNull;
52+
53+
public class AccountMetadataFunctionsTest {
54+
55+
private static final String USER1_NAME = "User 1";
56+
private static final String USER1_UID = "user1";
57+
private static final String USER1_PWD = USER1_UID;
58+
59+
@Rule
60+
public final ExistEmbeddedServer existWebServer = new ExistEmbeddedServer(true, true);
61+
62+
/**
63+
* Creates a new user programmatically and tries to retrieve their name
64+
* from the user's metadata.
65+
*
66+
* See: <a href="https://github.com/eXist-db/exist/issues/5904">[BUG] Security Account Metadata is lost</a>
67+
*/
68+
@Test
69+
public void getAccountNameMetadataViaObject() throws PermissionDeniedException, EXistException, XPathException {
70+
final BrokerPool pool = existWebServer.getBrokerPool();
71+
final SecurityManager sm = pool.getSecurityManager();
72+
73+
// 1. Create user
74+
try (final DBBroker broker = pool.get(Optional.of(sm.getSystemSubject()));
75+
final Txn transaction = pool.getTransactionManager().beginTransaction()) {
76+
createUser(broker, sm, USER1_UID, USER1_PWD, Arrays.asList(Tuple(AXSchemaType.FULLNAME, USER1_NAME)));
77+
transaction.commit();
78+
}
79+
80+
// 2. Try and retrieve the user's metadata from XQuery
81+
final String query =
82+
"import module namespace sm = 'http://exist-db.org/xquery/securitymanager';\n" +
83+
"sm:get-account-metadata('" + USER1_UID + "', xs:anyURI('http://axschema.org/namePerson'))";
84+
85+
try (final DBBroker broker = pool.get(Optional.of(pool.getSecurityManager().getSystemSubject()))) {
86+
final XQuery xquery = existWebServer.getBrokerPool().getXQueryService();
87+
final Sequence result = xquery.execute(broker, query, null);
88+
assertNotNull(result);
89+
assertEquals(USER1_NAME, result.itemAt(0).getStringValue());
90+
}
91+
}
92+
93+
/**
94+
* Creates a new user by storing their account document into the security collection
95+
* and tries to retrieve their name from the user's metadata.
96+
*
97+
* See: <a href="https://github.com/eXist-db/exist/issues/5904">[BUG] Security Account Metadata is lost</a>
98+
*/
99+
@Test
100+
public void getAccountNameMetadataViaDocument() throws PermissionDeniedException, EXistException, XPathException, LockException, IOException, SAXException {
101+
final BrokerPool pool = existWebServer.getBrokerPool();
102+
final SecurityManager sm = pool.getSecurityManager();
103+
104+
final XmldbURI accountDocumentUri = XmldbURI.create(USER1_UID + ".xml");
105+
final String accountDocument =
106+
"<account xmlns=\"http://exist-db.org/Configuration\" id=\"15\">\n" +
107+
" <group name=\"nogroup\"/>\n" +
108+
" <password>{RIPEMD160}q2VXP75jMi+d8E5VAsEr6pD8V5w=</password>\n" +
109+
" <expired>false</expired>\n" +
110+
" <enabled>true</enabled>\n" +
111+
" <umask>022</umask>\n" +
112+
" <metadata key=\"http://axschema.org/namePerson\">" + USER1_NAME + "</metadata>\n" +
113+
" <name>" + USER1_UID + "</name>\n" +
114+
"</account>";
115+
116+
// 1. Create user
117+
try (final DBBroker broker = pool.get(Optional.of(sm.getSystemSubject()));
118+
final Txn transaction = pool.getTransactionManager().beginTransaction()) {
119+
120+
// /db/system/security/exist/accounts
121+
122+
final XmldbURI accountsCollectionUri = SecurityManager.SECURITY_COLLECTION_URI.append(RealmImpl.ID).append(SecurityManager.ACCOUNTS_COLLECTION_URI);
123+
124+
try (final Collection accountsCollection = broker.getCollection(accountsCollectionUri)) {
125+
accountsCollection.storeDocument(transaction, broker, accountDocumentUri, new StringInputSource(accountDocument), MimeType.XML_TYPE);
126+
}
127+
transaction.commit();
128+
}
129+
130+
// 2. Try and retrieve the user's metadata from XQuery
131+
final String query =
132+
"import module namespace sm = 'http://exist-db.org/xquery/securitymanager';\n" +
133+
"sm:get-account-metadata('" + USER1_UID + "', xs:anyURI('http://axschema.org/namePerson'))";
134+
135+
try (final DBBroker broker = pool.get(Optional.of(pool.getSecurityManager().getSystemSubject()))) {
136+
final XQuery xquery = existWebServer.getBrokerPool().getXQueryService();
137+
final Sequence result = xquery.execute(broker, query, null);
138+
assertNotNull(result);
139+
assertEquals(USER1_NAME, result.itemAt(0).getStringValue());
140+
}
141+
}
142+
}

‎exist-core/src/test/java/org/exist/xquery/functions/securitymanager/GetPermissionsTest.java‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,28 @@
11
/*
2+
* Elemental
3+
* Copyright (C) 2024, Evolved Binary Ltd
4+
*
5+
* admin@evolvedbinary.com
6+
* https://www.evolvedbinary.com | https://www.elemental.xyz
7+
*
8+
* This library is free software; you can redistribute it and/or
9+
* modify it under the terms of the GNU Lesser General Public
10+
* License as published by the Free Software Foundation; version 2.1.
11+
*
12+
* This library is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15+
* Lesser General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU Lesser General Public
18+
* License along with this library; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20+
*
21+
* NOTE: Parts of this file contain code from 'The eXist-db Authors'.
22+
* The original license header is included below.
23+
*
24+
* =====================================================================
25+
*
226
* eXist-db Open Source Native XML Database
327
* Copyright (C) 2001 The eXist-db Authors
428
*
@@ -23,7 +47,6 @@
2347

2448
import org.exist.EXistException;
2549
import org.exist.dom.memtree.ElementImpl;
26-
import org.exist.dom.memtree.NodeImpl;
2750
import org.exist.security.PermissionDeniedException;
2851
import org.exist.security.internal.SecurityManagerImpl;
2952
import org.exist.storage.BrokerPool;

‎exist-core/src/test/java/org/exist/xquery/functions/securitymanager/GroupManagementFunctionRemoveGroupTest.java‎

Lines changed: 28 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,28 @@
11
/*
2+
* Elemental
3+
* Copyright (C) 2024, Evolved Binary Ltd
4+
*
5+
* admin@evolvedbinary.com
6+
* https://www.evolvedbinary.com | https://www.elemental.xyz
7+
*
8+
* This library is free software; you can redistribute it and/or
9+
* modify it under the terms of the GNU Lesser General Public
10+
* License as published by the Free Software Foundation; version 2.1.
11+
*
12+
* This library is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15+
* Lesser General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU Lesser General Public
18+
* License along with this library; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20+
*
21+
* NOTE: Parts of this file contain code from 'The eXist-db Authors'.
22+
* The original license header is included below.
23+
*
24+
* =====================================================================
25+
*
226
* eXist-db Open Source Native XML Database
327
* Copyright (C) 2001 The eXist-db Authors
428
*
@@ -21,23 +45,19 @@
2145
*/
2246
package org.exist.xquery.functions.securitymanager;
2347

24-
import com.evolvedbinary.j8fu.function.Runnable3E;
2548
import org.exist.EXistException;
2649
import org.exist.security.*;
2750
import org.exist.security.SecurityManager;
28-
import org.exist.security.internal.aider.GroupAider;
29-
import org.exist.security.internal.aider.UserAider;
3051
import org.exist.storage.BrokerPool;
3152
import org.exist.storage.DBBroker;
3253
import org.exist.storage.txn.Txn;
3354
import org.exist.test.ExistEmbeddedServer;
3455
import org.exist.xquery.XPathException;
35-
import org.exist.xquery.XQuery;
36-
import org.exist.xquery.value.Sequence;
3756
import org.junit.*;
3857

3958
import java.util.Optional;
4059

60+
import static org.exist.xquery.functions.securitymanager.SecurityManagerTestUtil.*;
4161
import static org.junit.Assert.*;
4262

4363
public class GroupManagementFunctionRemoveGroupTest {
@@ -56,21 +76,21 @@ public class GroupManagementFunctionRemoveGroupTest {
5676
@Test(expected = PermissionDeniedException.class)
5777
public void cannotDeleteDbaGroup() throws XPathException, PermissionDeniedException, EXistException {
5878
extractPermissionDenied(() -> {
59-
xqueryRemoveGroup(SecurityManager.DBA_GROUP);
79+
xqueryRemoveGroup(existWebServer.getBrokerPool(), SecurityManager.DBA_GROUP);
6080
});
6181
}
6282

6383
@Test(expected = PermissionDeniedException.class)
6484
public void cannotDeleteGuestGroup() throws XPathException, PermissionDeniedException, EXistException {
6585
extractPermissionDenied(() -> {
66-
xqueryRemoveGroup(SecurityManager.GUEST_GROUP);
86+
xqueryRemoveGroup(existWebServer.getBrokerPool(), SecurityManager.GUEST_GROUP);
6787
});
6888
}
6989

7090
@Test(expected = PermissionDeniedException.class)
7191
public void cannotDeleteUnknownGroup() throws XPathException, PermissionDeniedException, EXistException {
7292
extractPermissionDenied(() -> {
73-
xqueryRemoveGroup(SecurityManager.UNKNOWN_GROUP);
93+
xqueryRemoveGroup(existWebServer.getBrokerPool(), SecurityManager.UNKNOWN_GROUP);
7494
});
7595
}
7696

@@ -264,69 +284,4 @@ public void deleteUsersSharingPersonalPrimaryGroup() throws PermissionDeniedExce
264284
transaction.commit();
265285
}
266286
}
267-
268-
private static Account createUser(final DBBroker broker, final SecurityManager sm, final String username, final String password) throws PermissionDeniedException, EXistException {
269-
Group userGroup = new GroupAider(username);
270-
sm.addGroup(broker, userGroup);
271-
final Account user = new UserAider(username);
272-
user.setPassword(password);
273-
user.setPrimaryGroup(userGroup);
274-
sm.addAccount(user);
275-
276-
userGroup = sm.getGroup(username);
277-
userGroup.addManager(sm.getAccount(username));
278-
sm.updateGroup(userGroup);
279-
280-
return user;
281-
}
282-
283-
private static Group createGroup(final DBBroker broker, final SecurityManager sm, final String groupName) throws PermissionDeniedException, EXistException {
284-
final Group otherGroup = new GroupAider(groupName);
285-
return sm.addGroup(broker, otherGroup);
286-
}
287-
288-
private static void addUserToGroup(final SecurityManager sm, final Account user, final Group group) throws PermissionDeniedException, EXistException {
289-
user.addGroup(group.getName());
290-
sm.updateAccount(user);
291-
}
292-
293-
private static void setPrimaryGroup(final SecurityManager sm, final Account user, final Group group) throws PermissionDeniedException, EXistException {
294-
user.setPrimaryGroup(group);
295-
sm.updateAccount(user);
296-
}
297-
298-
private static void removeUser(final SecurityManager sm, final String username) throws PermissionDeniedException, EXistException {
299-
sm.deleteAccount(username);
300-
removeGroup(sm, username);
301-
}
302-
303-
private static void removeGroup(final SecurityManager sm, final String groupname) throws PermissionDeniedException, EXistException {
304-
sm.deleteGroup(groupname);
305-
}
306-
307-
private Sequence xqueryRemoveGroup(final String groupname) throws EXistException, PermissionDeniedException, XPathException {
308-
final BrokerPool pool = existWebServer.getBrokerPool();
309-
310-
final String query =
311-
"import module namespace sm = 'http://exist-db.org/xquery/securitymanager';\n" +
312-
"sm:remove-group('" + groupname + "')";
313-
314-
try (final DBBroker broker = pool.get(Optional.of(pool.getSecurityManager().getSystemSubject()))) {
315-
final XQuery xquery = existWebServer.getBrokerPool().getXQueryService();
316-
final Sequence result = xquery.execute(broker, query, null);
317-
return result;
318-
}
319-
}
320-
321-
private static void extractPermissionDenied(final Runnable3E<XPathException, PermissionDeniedException, EXistException> runnable) throws XPathException, PermissionDeniedException, EXistException {
322-
try {
323-
runnable.run();
324-
} catch (final XPathException e) {
325-
if (e.getCause() != null && e.getCause() instanceof PermissionDeniedException) {
326-
throw (PermissionDeniedException)e.getCause();
327-
} else {
328-
throw e;
329-
}
330-
}
331-
}
332287
}

0 commit comments

Comments
 (0)