Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SNOW-1454054: Add check of user permission for token file #1835

Merged
merged 2 commits into from
Jul 22, 2024
Merged

SNOW-1454054: Add check of user permission for token file #1835

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5f8ef63
SNOW-1454054 - add check of user permision for token file
sfc-gh-pmotacki Jul 19, 2024
785f216
SNOW-1454054 - add check of user permission for token file
sfc-gh-pmotacki Jul 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions src/main/java/net/snowflake/client/config/SFConnectionConfigParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,14 +60,14 @@ private static Map<String, Map> readParametersMap(Path configFilePath)
throws SnowflakeSQLException {
try {
File file = new File(configFilePath.toUri());
varifyFilePermissionSecure(configFilePath);
verifyFilePermissionSecure(configFilePath);
return mapper.readValue(file, Map.class);
} catch (IOException ex) {
throw new SnowflakeSQLException(ex, "Problem during reading a configuration file.");
}
}

private static void varifyFilePermissionSecure(Path configFilePath)
private static void verifyFilePermissionSecure(Path configFilePath)
throws IOException, SnowflakeSQLException {
if (Constants.getOS() != Constants.OS.WINDOWS) {
PosixFileAttributeView posixFileAttributeView =
Expand Down Expand Up @@ -108,13 +108,14 @@ public static ConnectionParameters buildConnectionParameters() throws SnowflakeS
.orElse(SNOWFLAKE_TOKEN_FILE_PATH));
logger.debug("Token used in connect is read from file: {}", path);
try {
verifyFilePermissionSecure(path);
String token = new String(Files.readAllBytes(path), Charset.defaultCharset());
if (!token.isEmpty()) {
putPropertyIfNotNull(conectionProperties, "token", token.trim());
} else {
logger.warn("The token has empty value");
}
} catch (IOException ex) {
} catch (Exception ex) {
throw new SnowflakeSQLException(ex, "There is a problem during reading token from file");
}
}
Expand Down
96 changes: 60 additions & 36 deletions src/test/java/net/snowflake/client/config/SFConnectionConfigParserTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ public void testLoadSFConnectionConfigWrongConfigurationName()
throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "unknown");
prepareConnectionConfigurationTomlFile(null, true);
prepareConnectionConfigurationTomlFile();
ConnectionParameters connectionParameters =
SFConnectionConfigParser.buildConnectionParameters();
assertNull(connectionParameters);
Expand All @@ -62,7 +62,7 @@ public void testLoadSFConnectionConfigWrongConfigurationName()
@Test
public void testLoadSFConnectionConfigInValidPath() throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, Paths.get("unknownPath").toString());
prepareConnectionConfigurationTomlFile(null, true);
prepareConnectionConfigurationTomlFile();
assertNull(SFConnectionConfigParser.buildConnectionParameters());
}

Expand All @@ -73,37 +73,87 @@ public void testLoadSFConnectionConfigWithTokenFromFile()
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
File tokenFile = new File(Paths.get(tempPath.toString(), "token").toUri());
prepareConnectionConfigurationTomlFile(
Collections.singletonMap("token_file_path", tokenFile.toString()), true);
Collections.singletonMap("token_file_path", tokenFile.toString()));

ConnectionParameters data = SFConnectionConfigParser.buildConnectionParameters();
assertNotNull(data);
assertEquals(tokenFile.toString(), data.getParams().get("token_file_path"));
assertEquals("testToken", data.getParams().get("token"));
}

@Test
public void testThrowErrorWhenWrongPermissionsForConnectionConfigurationFile()
throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
File tokenFile = new File(Paths.get(tempPath.toString(), "token").toUri());
prepareConnectionConfigurationTomlFile(
Collections.singletonMap("token_file_path", tokenFile.toString()), false, false);
assumeFalse(RunningNotOnLinuxMac.isNotRunningOnLinuxMac());
sfc-gh-pmotacki marked this conversation as resolved.
Show resolved Hide resolved
assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}

@Test
public void testThrowErrorWhenWrongPermissionsForTokenFile() throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
File tokenFile = new File(Paths.get(tempPath.toString(), "token").toUri());
prepareConnectionConfigurationTomlFile(
Collections.singletonMap("token_file_path", tokenFile.toString()), false);
Collections.singletonMap("token_file_path", tokenFile.toString()), true, false);
assumeFalse(RunningNotOnLinuxMac.isNotRunningOnLinuxMac());
assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}

@Test
public void testLoadSFConnectionConfigWithHostConfigured()
throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", "snowflake.reg.local");
extraparams.put("account", null);
extraparams.put("port", "8082");
extraparams.put("token", "testToken");
prepareConnectionConfigurationTomlFile(extraparams);
ConnectionParameters data = SFConnectionConfigParser.buildConnectionParameters();
assertNotNull(data);
assertEquals("jdbc:snowflake://snowflake.reg.local:8082", data.getUrl());
assertEquals("oauth", data.getParams().get("authenticator"));
assertEquals("testToken", data.getParams().get("token"));
}

@Test
public void shouldThrowExceptionIfNoneOfHostAndAccountIsSet() throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", null);
extraparams.put("account", null);
prepareConnectionConfigurationTomlFile(extraparams);
Assert.assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}

private void prepareConnectionConfigurationTomlFile() throws IOException {
prepareConnectionConfigurationTomlFile(null, true, true);
}

private void prepareConnectionConfigurationTomlFile(Map moreParameters) throws IOException {
prepareConnectionConfigurationTomlFile(moreParameters, true, true);
}

private void prepareConnectionConfigurationTomlFile(
Map moreParameters, boolean onlyUserPermission) throws IOException {
Map moreParameters, boolean onlyUserPermissionConnection, boolean onlyUserPermissionToken)
throws IOException {
Path path = Paths.get(tempPath.toString(), "connections.toml");
Path filePath = createFilePathWithPermission(path, onlyUserPermission);
Path filePath = createFilePathWithPermission(path, onlyUserPermissionConnection);
File file = filePath.toFile();

Map configuration = new HashMap();
Map configurationParams = new HashMap();
configurationParams.put("account", "snowaccount.us-west-2.aws");
configurationParams.put("user", "user1");
configurationParams.put("token", "testToken");
configurationParams.put("port", "443");
configurationParams.put("authenticator", "oauth");

if (moreParameters != null) {
moreParameters.forEach((k, v) -> configurationParams.put(k, v));
Expand All @@ -114,7 +164,8 @@ private void prepareConnectionConfigurationTomlFile(
if (configurationParams.containsKey("token_file_path")) {
Path tokenFilePath =
createFilePathWithPermission(
Paths.get(configurationParams.get("token_file_path").toString()), onlyUserPermission);
Paths.get(configurationParams.get("token_file_path").toString()),
onlyUserPermissionToken);
Files.write(tokenFilePath, "token_from_file".getBytes());
}
}
Expand All @@ -131,31 +182,4 @@ private Path createFilePathWithPermission(Path path, boolean onlyUserPermission)
return Files.createFile(path);
}
}

@Test
public void testLoadSFConnectionConfigWithHostConfigured()
throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", "snowflake.reg.local");
extraparams.put("account", null);
extraparams.put("port", "8082");
prepareConnectionConfigurationTomlFile(extraparams, true);
ConnectionParameters data = SFConnectionConfigParser.buildConnectionParameters();
assertNotNull(data);
assertEquals("jdbc:snowflake://snowflake.reg.local:8082", data.getUrl());
}

@Test
public void shouldThrowExceptionIfNoneOfHostAndAccountIsSet() throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", null);
extraparams.put("account", null);
prepareConnectionConfigurationTomlFile(extraparams, true);
Assert.assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}
}
Loading