From e4f06c9586f8d85362eecd757529befcd4d8e18e Mon Sep 17 00:00:00 2001 From: afazel Date: Mon, 26 Jul 2021 11:59:18 -0700 Subject: [PATCH] Add validation for null elements in JSON array (#1157) (cherry picked from commit 960d4209282027adedc0b37b28d74df8913dfafe) --- .../AbstractConfigurationValidator.java | 34 +++++++++++++++++-- .../dlic/rest/api/ActionGroupsApiTest.java | 11 ++++++ .../dlic/rest/api/NodesDnApiTest.java | 13 +++++++ .../security/dlic/rest/api/RolesApiTest.java | 31 +++++++++++++++++ .../dlic/rest/api/RolesMappingApiTest.java | 22 ++++++++++++ .../security/dlic/rest/api/UserApiTest.java | 11 ++++++ .../actiongroup_null_array_element.json | 4 +++ .../restapi/nodesdn_null_array_element.json | 3 ++ ...es_null_array_element_allowed_actions.json | 9 +++++ ...ull_array_element_cluster_permissions.json | 9 +++++ ...les_null_array_element_index_patterns.json | 9 +++++ ..._null_array_element_index_permissions.json | 5 +++ ...oles_null_array_element_masked_fields.json | 9 +++++ ...null_array_element_tenant_permissions.json | 9 +++++ ...ping_null_array_element_backend_roles.json | 14 ++++++++ ...rolesmapping_null_array_element_hosts.json | 14 ++++++++ ...rolesmapping_null_array_element_users.json | 11 ++++++ .../restapi/users_null_array_element.json | 5 +++ 18 files changed, 221 insertions(+), 2 deletions(-) create mode 100644 src/test/resources/restapi/actiongroup_null_array_element.json create mode 100644 src/test/resources/restapi/nodesdn_null_array_element.json create mode 100644 src/test/resources/restapi/roles_null_array_element_allowed_actions.json create mode 100644 src/test/resources/restapi/roles_null_array_element_cluster_permissions.json create mode 100644 src/test/resources/restapi/roles_null_array_element_index_patterns.json create mode 100644 src/test/resources/restapi/roles_null_array_element_index_permissions.json create mode 100644 src/test/resources/restapi/roles_null_array_element_masked_fields.json create mode 100644 src/test/resources/restapi/roles_null_array_element_tenant_permissions.json create mode 100644 src/test/resources/restapi/rolesmapping_null_array_element_backend_roles.json create mode 100644 src/test/resources/restapi/rolesmapping_null_array_element_hosts.json create mode 100644 src/test/resources/restapi/rolesmapping_null_array_element_users.json create mode 100644 src/test/resources/restapi/users_null_array_element.json diff --git a/src/main/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/validation/AbstractConfigurationValidator.java b/src/main/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/validation/AbstractConfigurationValidator.java index 666ce0aa60..24b08ba375 100644 --- a/src/main/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/validation/AbstractConfigurationValidator.java +++ b/src/main/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/validation/AbstractConfigurationValidator.java @@ -188,6 +188,16 @@ public boolean validate() { return false; } + //null element in the values of all the possible keys with DataType as ARRAY + for (Entry allowedKey : allowedKeys.entrySet()) { + JsonNode value = contentAsNode.get(allowedKey.getKey()); + if (value != null) { + if (hasNullArrayElement(value)) { + this.errorType = ErrorType.NULL_ARRAY_ELEMENT; + return false; + } + } + } return valid; } @@ -256,6 +266,10 @@ public XContentBuilder errorsAsXContent(RestChannel channel) { builder.field(entry.getKey(), entry.getValue()); } break; + case NULL_ARRAY_ELEMENT: + builder.field("status", "error"); + builder.field("reason", ErrorType.NULL_ARRAY_ELEMENT.getMessage()); + break; default: builder.field("status", "error"); builder.field("reason", errorType.getMessage()); @@ -284,7 +298,8 @@ public static enum DataType { public static enum ErrorType { NONE("ok"), INVALID_CONFIGURATION("Invalid configuration"), INVALID_PASSWORD("Invalid password"), WRONG_DATATYPE("Wrong datatype"), BODY_NOT_PARSEABLE("Could not parse content of request."), PAYLOAD_NOT_ALLOWED("Request body not allowed for this action."), - PAYLOAD_MANDATORY("Request body required for this action."), SECURITY_NOT_INITIALIZED("Security index not initialized"); + PAYLOAD_MANDATORY("Request body required for this action."), SECURITY_NOT_INITIALIZED("Security index not initialized"), + NULL_ARRAY_ELEMENT("`null` is not allowed as json array element"); private String message; @@ -300,4 +315,19 @@ public String getMessage() { protected final boolean hasParams() { return param != null && param.length > 0; } -} \ No newline at end of file + + private boolean hasNullArrayElement(JsonNode node) { + for (JsonNode element: node) { + if(element.isNull()) { + if (node.isArray()) { + return true; + } + } else if (element.isContainerNode()) { + if (hasNullArrayElement(element)) { + return true; + } + } + } + return false; + } +} diff --git a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/ActionGroupsApiTest.java b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/ActionGroupsApiTest.java index f92b375b1b..4608c2eba6 100644 --- a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/ActionGroupsApiTest.java +++ b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/ActionGroupsApiTest.java @@ -359,4 +359,15 @@ public void testActionGroupsApiForNonSuperAdmin() throws Exception { } + @Test + public void checkNullElementsInArray() throws Exception{ + setup(); + rh.keystore = "restapi/kirk-keystore.jks"; + rh.sendAdminCertificate = true; + + String body = FileHelper.loadFile("restapi/actiongroup_null_array_element.json"); + HttpResponse response = rh.executePutRequest("/_opendistro/_security/api/actiongroups/CRUD_UT", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + } + } diff --git a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/NodesDnApiTest.java b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/NodesDnApiTest.java index 0e00721769..8fb008772c 100644 --- a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/NodesDnApiTest.java +++ b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/NodesDnApiTest.java @@ -19,6 +19,7 @@ import com.amazon.opendistroforelasticsearch.security.auditlog.impl.AuditMessage; import com.amazon.opendistroforelasticsearch.security.auditlog.integration.TestAuditlogImpl; import com.amazon.opendistroforelasticsearch.security.support.ConfigConstants; +import com.amazon.opendistroforelasticsearch.security.test.helper.file.FileHelper; import com.amazon.opendistroforelasticsearch.security.test.helper.rest.RestHelper.HttpResponse; import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.ObjectMapper; @@ -192,4 +193,16 @@ public void testNodesDnApiAuditComplianceLogging() throws Exception { assertThat(actualCategoryCounts, equalTo(expectedCategoryCounts)); } + + @Test + public void checkNullElementsInArray() throws Exception{ + setup(); + rh.keystore = "restapi/kirk-keystore.jks"; + rh.sendAdminCertificate = true; + + String body = FileHelper.loadFile("restapi/nodesdn_null_array_element.json"); + HttpResponse response = rh.executePutRequest("_opendistro/_security/api/nodesdn", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + } + } diff --git a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesApiTest.java b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesApiTest.java index 54ac51c978..718d44feb2 100644 --- a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesApiTest.java +++ b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesApiTest.java @@ -504,4 +504,35 @@ public void testRolesApiForNonSuperAdmin() throws Exception { } + @Test + public void checkNullElementsInArray() throws Exception{ + setup(); + rh.keystore = "restapi/kirk-keystore.jks"; + rh.sendAdminCertificate = true; + + String body = FileHelper.loadFile("restapi/roles_null_array_element_cluster_permissions.json"); + HttpResponse response = rh.executePutRequest("/_opendistro/_security/api/roles/opendistro_security_role_starfleet", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + + body = FileHelper.loadFile("restapi/roles_null_array_element_index_permissions.json"); + response = rh.executePutRequest("/_opendistro/_security/api/roles/opendistro_security_role_starfleet", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + + body = FileHelper.loadFile("restapi/roles_null_array_element_tenant_permissions.json"); + response = rh.executePutRequest("/_opendistro/_security/api/roles/opendistro_security_role_starfleet", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + + body = FileHelper.loadFile("restapi/roles_null_array_element_index_patterns.json"); + response = rh.executePutRequest("/_opendistro/_security/api/roles/opendistro_security_role_starfleet", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + + body = FileHelper.loadFile("restapi/roles_null_array_element_masked_fields.json"); + response = rh.executePutRequest("/_opendistro/_security/api/roles/opendistro_security_role_starfleet", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + + body = FileHelper.loadFile("restapi/roles_null_array_element_allowed_actions.json"); + response = rh.executePutRequest("/_opendistro/_security/api/roles/opendistro_security_role_starfleet", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + } + } diff --git a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesMappingApiTest.java b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesMappingApiTest.java index 5c6d2d5dbe..c4bbb65f9d 100644 --- a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesMappingApiTest.java +++ b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/RolesMappingApiTest.java @@ -392,4 +392,26 @@ public void testRolesMappingApiForNonSuperAdmin() throws Exception { Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); } + + @Test + public void checkNullElementsInArray() throws Exception{ + setup(); + rh.keystore = "restapi/kirk-keystore.jks"; + rh.sendAdminCertificate = true; + + String body = FileHelper.loadFile("restapi/rolesmapping_null_array_element_users.json"); + HttpResponse response = rh.executePutRequest("/_opendistro/_security/api/rolesmapping/opendistro_security_role_starfleet_captains", + body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + + body = FileHelper.loadFile("restapi/rolesmapping_null_array_element_backend_roles.json"); + response = rh.executePutRequest("/_opendistro/_security/api/rolesmapping/opendistro_security_role_starfleet_captains", + body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + + body = FileHelper.loadFile("restapi/rolesmapping_null_array_element_hosts.json"); + response = rh.executePutRequest("/_opendistro/_security/api/rolesmapping/opendistro_security_role_starfleet_captains", + body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + } } diff --git a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/UserApiTest.java b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/UserApiTest.java index 6862eda193..e8bbf07d1e 100644 --- a/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/UserApiTest.java +++ b/src/test/java/com/amazon/opendistroforelasticsearch/security/dlic/rest/api/UserApiTest.java @@ -576,4 +576,15 @@ public void testUserApiForNonSuperAdmin() throws Exception { } + @Test + public void checkNullElementsInArray() throws Exception{ + setup(); + rh.keystore = "restapi/kirk-keystore.jks"; + rh.sendAdminCertificate = true; + + String body = FileHelper.loadFile("restapi/users_null_array_element.json"); + HttpResponse response = rh.executePutRequest("/_opendistro/_security/api/internalusers/picard", body, new Header[0]); + Assert.assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode()); + } + } diff --git a/src/test/resources/restapi/actiongroup_null_array_element.json b/src/test/resources/restapi/actiongroup_null_array_element.json new file mode 100644 index 0000000000..ff0d34c350 --- /dev/null +++ b/src/test/resources/restapi/actiongroup_null_array_element.json @@ -0,0 +1,4 @@ +{ + "allowed_actions": [null, "OPENDISTRO_SECURITY_WRITE"] +} + diff --git a/src/test/resources/restapi/nodesdn_null_array_element.json b/src/test/resources/restapi/nodesdn_null_array_element.json new file mode 100644 index 0000000000..2998b06760 --- /dev/null +++ b/src/test/resources/restapi/nodesdn_null_array_element.json @@ -0,0 +1,3 @@ +{ + "nodes_dn" : [null] +} diff --git a/src/test/resources/restapi/roles_null_array_element_allowed_actions.json b/src/test/resources/restapi/roles_null_array_element_allowed_actions.json new file mode 100644 index 0000000000..a253062b17 --- /dev/null +++ b/src/test/resources/restapi/roles_null_array_element_allowed_actions.json @@ -0,0 +1,9 @@ +{ + "cluster_permissions" : ["cluster:monitor1*"], + "index_permissions" : [{ + "index_patterns" : [ "*" ], + "masked_fields" : [ "abvfg", "*ip_dest*::/[0-9]{1,3}$/::XXX", "*ip_source*::/[0-9]{1,3}$/::XXX::/^[0-9]{1,3}/::***", "customer.name::SHA-512", "/[0-9]{1,3}/::SHA-512" ], + "allowed_actions" : [ "123", null ] + }], + "tenant_permissions" : [ ] +} diff --git a/src/test/resources/restapi/roles_null_array_element_cluster_permissions.json b/src/test/resources/restapi/roles_null_array_element_cluster_permissions.json new file mode 100644 index 0000000000..95f444566c --- /dev/null +++ b/src/test/resources/restapi/roles_null_array_element_cluster_permissions.json @@ -0,0 +1,9 @@ +{ + "cluster_permissions" : [null], + "index_permissions" : [ { + "index_patterns" : [ "*" ], + "masked_fields" : [ "abvfg", "*ip_dest*::/[0-9]{1,3}$/::XXX", "*ip_source*::/[0-9]{1,3}$/::XXX::/^[0-9]{1,3}/::***", "customer.name::SHA-512", "/[0-9]{1,3}/::SHA-512" ], + "allowed_actions" : [ "123", "indices:data/read/*" ] + } ], + "tenant_permissions" : [ ] +} diff --git a/src/test/resources/restapi/roles_null_array_element_index_patterns.json b/src/test/resources/restapi/roles_null_array_element_index_patterns.json new file mode 100644 index 0000000000..90b9f79b0b --- /dev/null +++ b/src/test/resources/restapi/roles_null_array_element_index_patterns.json @@ -0,0 +1,9 @@ +{ + "cluster_permissions" : ["cluster:monitor1*"], + "index_permissions" : [{ + "index_patterns" : [null], + "masked_fields" : [ "abvfg", "*ip_dest*::/[0-9]{1,3}$/::XXX", "*ip_source*::/[0-9]{1,3}$/::XXX::/^[0-9]{1,3}/::***", "customer.name::SHA-512", "/[0-9]{1,3}/::SHA-512" ], + "allowed_actions" : [ "123", "indices:data/read/*" ] + }], + "tenant_permissions" : [ ] +} diff --git a/src/test/resources/restapi/roles_null_array_element_index_permissions.json b/src/test/resources/restapi/roles_null_array_element_index_permissions.json new file mode 100644 index 0000000000..61b632b041 --- /dev/null +++ b/src/test/resources/restapi/roles_null_array_element_index_permissions.json @@ -0,0 +1,5 @@ +{ + "cluster_permissions" : ["cluster:monitor1*"], + "index_permissions" : [null], + "tenant_permissions" : [ ] +} diff --git a/src/test/resources/restapi/roles_null_array_element_masked_fields.json b/src/test/resources/restapi/roles_null_array_element_masked_fields.json new file mode 100644 index 0000000000..91a4edfdae --- /dev/null +++ b/src/test/resources/restapi/roles_null_array_element_masked_fields.json @@ -0,0 +1,9 @@ +{ + "cluster_permissions" : ["cluster:monitor1*"], + "index_permissions" : [{ + "index_patterns" : [ "*" ], + "masked_fields" : [ "abvfg", null, "*ip_source*::/[0-9]{1,3}$/::XXX::/^[0-9]{1,3}/::***", "customer.name::SHA-512", "/[0-9]{1,3}/::SHA-512" ], + "allowed_actions" : [ "123", "indices:data/read/*" ] + }], + "tenant_permissions" : [ ] +} diff --git a/src/test/resources/restapi/roles_null_array_element_tenant_permissions.json b/src/test/resources/restapi/roles_null_array_element_tenant_permissions.json new file mode 100644 index 0000000000..77c0418826 --- /dev/null +++ b/src/test/resources/restapi/roles_null_array_element_tenant_permissions.json @@ -0,0 +1,9 @@ +{ + "cluster_permissions" : ["cluster:monitor1*"], + "index_permissions" : [{ + "index_patterns" : [ "*" ], + "masked_fields" : [ "abvfg", "*ip_dest*::/[0-9]{1,3}$/::XXX", "*ip_source*::/[0-9]{1,3}$/::XXX::/^[0-9]{1,3}/::***", "customer.name::SHA-512", "/[0-9]{1,3}/::SHA-512" ], + "allowed_actions" : [ "123", "indices:data/read/*" ] + }], + "tenant_permissions" : [null] +} diff --git a/src/test/resources/restapi/rolesmapping_null_array_element_backend_roles.json b/src/test/resources/restapi/rolesmapping_null_array_element_backend_roles.json new file mode 100644 index 0000000000..745526c3f2 --- /dev/null +++ b/src/test/resources/restapi/rolesmapping_null_array_element_backend_roles.json @@ -0,0 +1,14 @@ +{ + "users": [ + "user1", + "user2" + ], + "backend_roles": [ + "captains", + null + ], + "hosts": [ + "8.8.8.8", + "8.8.4.4" + ] +} diff --git a/src/test/resources/restapi/rolesmapping_null_array_element_hosts.json b/src/test/resources/restapi/rolesmapping_null_array_element_hosts.json new file mode 100644 index 0000000000..84b8fafd5b --- /dev/null +++ b/src/test/resources/restapi/rolesmapping_null_array_element_hosts.json @@ -0,0 +1,14 @@ +{ + "users": [ + "user1", + "user2" + ], + "backend_roles": [ + "captains", + "role2" + ], + "hosts": [ + null, + "8.8.4.4" + ] +} diff --git a/src/test/resources/restapi/rolesmapping_null_array_element_users.json b/src/test/resources/restapi/rolesmapping_null_array_element_users.json new file mode 100644 index 0000000000..c570fe5f8d --- /dev/null +++ b/src/test/resources/restapi/rolesmapping_null_array_element_users.json @@ -0,0 +1,11 @@ +{ + "users": [ + null + ], + "backend_roles": [ + "captains" + ], + "hosts": [ + "8.8.8.8" + ] +} diff --git a/src/test/resources/restapi/users_null_array_element.json b/src/test/resources/restapi/users_null_array_element.json new file mode 100644 index 0000000000..ac401c0803 --- /dev/null +++ b/src/test/resources/restapi/users_null_array_element.json @@ -0,0 +1,5 @@ +{ + "backend_roles": [ + null + ] +}