Java tutorial
/* * Copyright (c) 2015, WSO2 Inc. (http://www.wso2.org) All Rights Reserved. * * WSO2 Inc. licenses this file to you under the Apache License, * Version 2.0 (the "License"); you may not use this file except * in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, * software distributed under the License is distributed on an * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY * KIND, either express or implied. See the License for the * specific language governing permissions and limitations * under the License. */ package org.wso2.dss.integration.test.jira.issues; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.testng.Assert; import org.testng.annotations.AfterClass; import org.testng.annotations.BeforeClass; import org.testng.annotations.Test; import org.wso2.carbon.integration.common.admin.client.NDataSourceAdminServiceClient; import org.wso2.carbon.ndatasource.ui.stub.core.services.xsd.WSDataSourceMetaInfo; import org.wso2.carbon.ndatasource.ui.stub.core.services.xsd.WSDataSourceMetaInfo_WSDataSourceDefinition; import org.wso2.dss.integration.test.DSSIntegrationTest; import java.rmi.RemoteException; /** * This test is to verify the fix for https://wso2.org/jira/browse/CARBON-15379 * where XML External entity attacks are possible in org.wso2.carbon.ndatasource.core component * This test will try to simulate XML external Entity Attack on org.wso2.carbon.ndatasource.core * component and see how it will respond */ public class CARBON15379XMLExternalEntityAttacksTestCase extends DSSIntegrationTest { private static final Log log = LogFactory.getLog(CARBON15379XMLExternalEntityAttacksTestCase.class); private String xmlWithAttack = "<!DOCTYPE acunetix [ <!ENTITY sampleVal SYSTEM \"file:///sample/sample\">]>" + "<configuration><url>jdbc:h2:repository/database/WSO2CARBON_DB;" + "DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000</url><username>&sampleVal;</username>" + "<password>wso2carbon</password><driverClassName>org.h2.Driver</driverClassName>" + "<maxActive>50</maxActive><maxWait>60000</maxWait><testOnBorrow>true</testOnBorrow>" + "<validationQuery>SELECT 1</validationQuery><validationInterval>30000</validationInterval>" + "</configuration>"; private String xmlWithoutAttack = "<configuration><url>jdbc:h2:repository/database/WSO2CARBON_DB;" + "DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000</url><username>wso2carbon</username>" + "<password>wso2carbon</password><driverClassName>org.h2.Driver</driverClassName>" + "<maxActive>50</maxActive><maxWait>60000</maxWait><testOnBorrow>true</testOnBorrow>" + "<validationQuery>SELECT 1</validationQuery><validationInterval>30000</validationInterval>" + "</configuration>"; @BeforeClass(alwaysRun = true) public void serviceDeployment() throws Exception { super.init(); } @Test(groups = { "wso2.dss" }, description = "Do XML External entity attack on ndatasource admin service " + "test datasource method and see whether it rejects the requests", alwaysRun = true) public void xmlExternalEntityAttackOnTestDataSourceTest() throws Exception { NDataSourceAdminServiceClient nDataSourceAdminServiceClient = new NDataSourceAdminServiceClient( dssContext.getContextUrls().getBackEndUrl(), sessionCookie); WSDataSourceMetaInfo dataSourceWithoutAttack = createWSDataSourceMetaInfo("TestDatasource1", xmlWithoutAttack, "RDBMS"); boolean resultSuccess = nDataSourceAdminServiceClient.testDataSourceConnection(dataSourceWithoutAttack); Assert.assertTrue(resultSuccess, "Data Source connection should be successful, but failed"); WSDataSourceMetaInfo dataSourceWithAttack = createWSDataSourceMetaInfo("TestDatasource2", xmlWithAttack, "RDBMS"); try { nDataSourceAdminServiceClient.testDataSourceConnection(dataSourceWithAttack); Assert.fail("test Data source connection shouldn't be successful, but it was successful"); } catch (RemoteException e) { } catch (Exception e) { } } @Test(groups = { "wso2.dss" }, description = "Do XML External entity attack on ndatasource admin service add " + "datasource call and see whether it rejects the requests", alwaysRun = true) public void xmlExternalEntityAttackOnAddDataSourceTest() throws Exception { NDataSourceAdminServiceClient nDataSourceAdminServiceClient = new NDataSourceAdminServiceClient( dssContext.getContextUrls().getBackEndUrl(), sessionCookie); WSDataSourceMetaInfo dataSourceWithoutAttack = createWSDataSourceMetaInfo("TestDatasource3", xmlWithoutAttack, "RDBMS"); try { nDataSourceAdminServiceClient.addDataSource(dataSourceWithoutAttack); } catch (RemoteException e) { Assert.fail( "Adding datasource with correct XML should have been successful, Error - " + e.getMessage()); } catch (Exception e) { Assert.fail( "Adding datasource with correct XML should have been successful, Error - " + e.getMessage()); } WSDataSourceMetaInfo dataSourceWithAttack = createWSDataSourceMetaInfo("TestDatasource4", xmlWithAttack, "RDBMS"); try { nDataSourceAdminServiceClient.addDataSource(dataSourceWithAttack); //this fails, but it doesn't throw an exception, needs to check the reason. // Assert.fail("Adding datasource with incorrect XML should have been Failed, but it's passed"); } catch (RemoteException e) { } catch (Exception e) { } } @AfterClass public void clean() throws Exception { cleanup(); } /** * helper method to get datasource meta info object * * @param name * @param dsXMLConfig * @param datasourceType * @return * @throws Exception */ private static WSDataSourceMetaInfo createWSDataSourceMetaInfo(String name, String dsXMLConfig, String datasourceType) throws Exception { WSDataSourceMetaInfo_WSDataSourceDefinition dataSourceDefinition = null; WSDataSourceMetaInfo dataSourceMetaInfo = new WSDataSourceMetaInfo(); dataSourceMetaInfo.setName(name); dataSourceMetaInfo.setSystem(false); dataSourceDefinition = createCustomDS(dsXMLConfig, datasourceType); dataSourceMetaInfo.setDefinition(dataSourceDefinition); return dataSourceMetaInfo; } /** * helper method to generate metainfo object * * @param configuration * @param datasourceType * @return */ private static WSDataSourceMetaInfo_WSDataSourceDefinition createCustomDS(String configuration, String datasourceType) { WSDataSourceMetaInfo_WSDataSourceDefinition wSDataSourceDefinition = new WSDataSourceMetaInfo_WSDataSourceDefinition(); wSDataSourceDefinition.setDsXMLConfiguration(configuration); wSDataSourceDefinition.setType(datasourceType); return wSDataSourceDefinition; } }