mirror of
https://github.com/google/nomulus.git
synced 2025-07-23 03:06:01 +02:00
Sanitize EPP XML requests and responses
Masks user credentials (tags 'pw' and 'newPW') in EPP XML messages. ------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=207953894
This commit is contained in:
weiminyu
jianglai
parent
9eec70729f
commit
81fce674d2
11 changed files with 415 additions and 3 deletions
125
javatests/google/registry/flows/EppXmlSanitizerTest.java
Normal file
125
javatests/google/registry/flows/EppXmlSanitizerTest.java
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
// Copyright 2018 The Nomulus Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.package google.registry.flows;
|
||||
|
||||
package google.registry.flows;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static google.registry.flows.EppXmlSanitizer.sanitizeEppXml;
|
||||
import static google.registry.testing.TestDataHelper.loadBytes;
|
||||
import static java.nio.charset.StandardCharsets.UTF_8;
|
||||
|
||||
import com.google.common.collect.ImmutableMap;
|
||||
import google.registry.testing.EppLoader;
|
||||
import java.util.Base64;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
|
||||
/** Unit tests for {@link EppXmlSanitizer}. */
|
||||
@RunWith(JUnit4.class)
|
||||
public class EppXmlSanitizerTest {
|
||||
|
||||
private static final String XML_HEADER = "<?xml version=\"1.0\" ?>";
|
||||
|
||||
@Test
|
||||
public void testSanitize_noSensitiveData_noop() throws Exception {
|
||||
byte[] inputXmlBytes = loadBytes(getClass(), "host_create.xml").read();
|
||||
String expectedXml = XML_HEADER + new String(inputXmlBytes, UTF_8);
|
||||
|
||||
String sanitizedXml = sanitizeEppXml(inputXmlBytes);
|
||||
assertThat(sanitizedXml).isEqualTo(expectedXml);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSanitize_loginPasswords_sanitized() {
|
||||
String inputXml =
|
||||
new EppLoader(
|
||||
this,
|
||||
"login_update_password.xml",
|
||||
ImmutableMap.of("PW", "oldpass", "NEWPW", "newPw"))
|
||||
.getEppXml();
|
||||
String expectedXml =
|
||||
XML_HEADER
|
||||
+ new EppLoader(
|
||||
this,
|
||||
"login_update_password.xml",
|
||||
ImmutableMap.of("PW", "*******", "NEWPW", "*****"))
|
||||
.getEppXml();
|
||||
|
||||
String sanitizedXml = sanitizeEppXml(inputXml.getBytes(UTF_8));
|
||||
assertThat(sanitizedXml).isEqualTo(expectedXml);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSanitize_loginPasswordTagWrongCase_sanitized() {
|
||||
String inputXml =
|
||||
new EppLoader(
|
||||
this, "login_wrong_case.xml", ImmutableMap.of("PW", "oldpass", "NEWPW", "newPw"))
|
||||
.getEppXml();
|
||||
String expectedXml =
|
||||
XML_HEADER
|
||||
+ new EppLoader(
|
||||
this,
|
||||
"login_wrong_case.xml",
|
||||
ImmutableMap.of("PW", "*******", "NEWPW", "*****"))
|
||||
.getEppXml();
|
||||
|
||||
String sanitizedXml = sanitizeEppXml(inputXml.getBytes(UTF_8));
|
||||
assertThat(sanitizedXml).isEqualTo(expectedXml);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSanitize_contactAuthInfo_sanitized() throws Exception {
|
||||
byte[] inputXmlBytes = loadBytes(getClass(), "contact_info.xml").read();
|
||||
String expectedXml =
|
||||
XML_HEADER
|
||||
+ new EppLoader(this, "contact_info_sanitized.xml", ImmutableMap.of()).getEppXml();
|
||||
|
||||
String sanitizedXml = sanitizeEppXml(inputXmlBytes);
|
||||
assertThat(sanitizedXml).isEqualTo(expectedXml);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSanitize_contactCreateResponseAuthInfo_sanitized() throws Exception {
|
||||
byte[] inputXmlBytes = loadBytes(getClass(), "contact_info_from_create_response.xml").read();
|
||||
String expectedXml =
|
||||
XML_HEADER
|
||||
+ new EppLoader(
|
||||
this, "contact_info_from_create_response_sanitized.xml", ImmutableMap.of())
|
||||
.getEppXml();
|
||||
|
||||
String sanitizedXml = sanitizeEppXml(inputXmlBytes);
|
||||
assertThat(sanitizedXml).isEqualTo(expectedXml);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSanitize_emptyElement_transformedToLongForm() {
|
||||
byte[] inputXmlBytes = "<pw/>".getBytes(UTF_8);
|
||||
assertThat(sanitizeEppXml(inputXmlBytes)).isEqualTo(XML_HEADER + "<pw></pw>\n");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSanitize_invalidXML_throws() {
|
||||
byte[] inputXmlBytes = "<pw>".getBytes(UTF_8);
|
||||
assertThat(sanitizeEppXml(inputXmlBytes))
|
||||
.isEqualTo(Base64.getMimeEncoder().encodeToString(inputXmlBytes));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSanitize_unicode_hasCorrectCharCount() {
|
||||
byte[] inputXmlBytes = "<pw>\u007F\u4E43x</pw>".getBytes(UTF_8);
|
||||
String expectedXml = XML_HEADER + "<pw>C**</pw>\n";
|
||||
assertThat(sanitizeEppXml(inputXmlBytes)).isEqualTo(expectedXml);
|
||||
}
|
||||
}
|
||||
|
|
@ -190,12 +190,13 @@ public class FlowRunnerTest extends ShardableTestCase {
|
|||
@Test
|
||||
public void testRun_loggingStatement_complexEppInput() throws Exception {
|
||||
String domainCreateXml = loadFile(getClass(), "domain_create_prettyprinted.xml");
|
||||
String sanitizedDomainCreateXml = domainCreateXml.replace("2fooBAR", "*******");
|
||||
flowRunner.inputXmlBytes = domainCreateXml.getBytes(UTF_8);
|
||||
flowRunner.run(eppMetricBuilder);
|
||||
String logMessage = findFirstLogMessageByPrefix(handler, "EPP Command\n\t");
|
||||
List<String> lines = Splitter.on("\n\t").splitToList(logMessage);
|
||||
assertThat(lines.size()).named("number of lines in log message").isAtLeast(9);
|
||||
String xml = Joiner.on('\n').join(lines.subList(3, lines.size() - 4));
|
||||
assertThat(xml).isEqualTo(domainCreateXml);
|
||||
assertThat(xml).isEqualTo(sanitizedDomainCreateXml);
|
||||
}
|
||||
}
|
||||
|
|
|
|||
43
javatests/google/registry/flows/testdata/contact_info_from_create_response_sanitized.xml
vendored
Normal file
43
javatests/google/registry/flows/testdata/contact_info_from_create_response_sanitized.xml
vendored
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
|
||||
<response>
|
||||
<result code="1000">
|
||||
<msg>Command completed successfully</msg>
|
||||
</result>
|
||||
<resData>
|
||||
<contact:infData xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
|
||||
<contact:id>sh8013</contact:id>
|
||||
<contact:roid>1-Q9JYB4C</contact:roid>
|
||||
<contact:status s="ok"></contact:status>
|
||||
<contact:postalInfo type="int">
|
||||
<contact:name>John Doe</contact:name>
|
||||
<contact:org>Example Inc.</contact:org>
|
||||
<contact:addr>
|
||||
<contact:street>123 Example Dr.</contact:street>
|
||||
<contact:street>Suite 100</contact:street>
|
||||
<contact:city>Dulles</contact:city>
|
||||
<contact:sp>VA</contact:sp>
|
||||
<contact:pc>20166-6503</contact:pc>
|
||||
<contact:cc>US</contact:cc>
|
||||
</contact:addr>
|
||||
</contact:postalInfo>
|
||||
<contact:voice x="1234">+1.7035555555</contact:voice>
|
||||
<contact:fax>+1.7035555556</contact:fax>
|
||||
<contact:email>jdoe@example.com</contact:email>
|
||||
<contact:clID>NewRegistrar</contact:clID>
|
||||
<contact:crID>NewRegistrar</contact:crID>
|
||||
<contact:crDate>2000-06-01T00:00:00.0Z</contact:crDate>
|
||||
<contact:authInfo>
|
||||
<contact:pw>*******</contact:pw>
|
||||
</contact:authInfo>
|
||||
<contact:disclose flag="1">
|
||||
<contact:voice></contact:voice>
|
||||
<contact:email></contact:email>
|
||||
</contact:disclose>
|
||||
</contact:infData>
|
||||
</resData>
|
||||
<trID>
|
||||
<clTRID>ABC-12345</clTRID>
|
||||
<svTRID>server-trid</svTRID>
|
||||
</trID>
|
||||
</response>
|
||||
</epp>
|
||||
13
javatests/google/registry/flows/testdata/contact_info_sanitized.xml
vendored
Normal file
13
javatests/google/registry/flows/testdata/contact_info_sanitized.xml
vendored
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
|
||||
<command>
|
||||
<info>
|
||||
<contact:info xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
|
||||
<contact:id>sh8013</contact:id>
|
||||
<contact:authInfo>
|
||||
<contact:pw>*******</contact:pw>
|
||||
</contact:authInfo>
|
||||
</contact:info>
|
||||
</info>
|
||||
<clTRID>ABC-12345</clTRID>
|
||||
</command>
|
||||
</epp>
|
||||
23
javatests/google/registry/flows/testdata/login_update_password.xml
vendored
Normal file
23
javatests/google/registry/flows/testdata/login_update_password.xml
vendored
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
|
||||
<command>
|
||||
<login>
|
||||
<clID>%CLID%</clID>
|
||||
<pw>%PW%</pw>
|
||||
<newPW>%NEWPW%</newPW>
|
||||
<options>
|
||||
<version>1.0</version>
|
||||
<lang>en</lang>
|
||||
</options>
|
||||
<svcs>
|
||||
<objURI>urn:ietf:params:xml:ns:host-1.0</objURI>
|
||||
<objURI>urn:ietf:params:xml:ns:domain-1.0</objURI>
|
||||
<objURI>urn:ietf:params:xml:ns:contact-1.0</objURI>
|
||||
<svcExtension>
|
||||
<extURI>urn:ietf:params:xml:ns:launch-1.0</extURI>
|
||||
<extURI>urn:ietf:params:xml:ns:rgp-1.0</extURI>
|
||||
</svcExtension>
|
||||
</svcs>
|
||||
</login>
|
||||
<clTRID>ABC-12345</clTRID>
|
||||
</command>
|
||||
</epp>
|
||||
23
javatests/google/registry/flows/testdata/login_wrong_case.xml
vendored
Normal file
23
javatests/google/registry/flows/testdata/login_wrong_case.xml
vendored
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
|
||||
<command>
|
||||
<login>
|
||||
<clID>%CLID%</clID>
|
||||
<pw>%PW%</pw>
|
||||
<newPw>%NEWPW%</newPw>
|
||||
<options>
|
||||
<version>1.0</version>
|
||||
<lang>en</lang>
|
||||
</options>
|
||||
<svcs>
|
||||
<objURI>urn:ietf:params:xml:ns:host-1.0</objURI>
|
||||
<objURI>urn:ietf:params:xml:ns:domain-1.0</objURI>
|
||||
<objURI>urn:ietf:params:xml:ns:contact-1.0</objURI>
|
||||
<svcExtension>
|
||||
<extURI>urn:ietf:params:xml:ns:launch-1.0</extURI>
|
||||
<extURI>urn:ietf:params:xml:ns:rgp-1.0</extURI>
|
||||
</svcExtension>
|
||||
</svcs>
|
||||
</login>
|
||||
<clTRID>ABC-12345</clTRID>
|
||||
</command>
|
||||
</epp>
|
||||
|
|
@ -17,8 +17,10 @@ package google.registry.model.eppinput;
|
|||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static com.google.common.truth.Truth8.assertThat;
|
||||
import static google.registry.flows.EppXmlTransformer.unmarshal;
|
||||
import static google.registry.testing.JUnitBackports.assertThrows;
|
||||
import static google.registry.testing.TestDataHelper.loadBytes;
|
||||
|
||||
import google.registry.flows.EppException.SyntaxErrorException;
|
||||
import google.registry.model.contact.ContactResourceTest;
|
||||
import google.registry.model.domain.DomainResourceTest;
|
||||
import google.registry.model.eppinput.EppInput.InnerCommand;
|
||||
|
|
@ -77,4 +79,11 @@ public class EppInputTest {
|
|||
assertThat(loginCommand.services.serviceExtensions)
|
||||
.containsExactly("urn:ietf:params:xml:ns:launch-1.0", "urn:ietf:params:xml:ns:rgp-1.0");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testUnmarshalling_loginTagInWrongCase_throws() {
|
||||
assertThrows(
|
||||
SyntaxErrorException.class,
|
||||
() -> unmarshal(EppInput.class, loadBytes(getClass(), "login_wrong_case.xml").read()));
|
||||
}
|
||||
}
|
||||
|
|
|
|||
22
javatests/google/registry/model/eppinput/testdata/login_wrong_case.xml
vendored
Normal file
22
javatests/google/registry/model/eppinput/testdata/login_wrong_case.xml
vendored
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
|
||||
<command>
|
||||
<login>
|
||||
<clID>NewRegistrar</clID>
|
||||
<PW>foo-BAR2</PW>
|
||||
<options>
|
||||
<version>1.0</version>
|
||||
<lang>en</lang>
|
||||
</options>
|
||||
<svcs>
|
||||
<objURI>urn:ietf:params:xml:ns:host-1.0</objURI>
|
||||
<objURI>urn:ietf:params:xml:ns:domain-1.0</objURI>
|
||||
<objURI>urn:ietf:params:xml:ns:contact-1.0</objURI>
|
||||
<svcExtension>
|
||||
<extURI>urn:ietf:params:xml:ns:launch-1.0</extURI>
|
||||
<extURI>urn:ietf:params:xml:ns:rgp-1.0</extURI>
|
||||
</svcExtension>
|
||||
</svcs>
|
||||
</login>
|
||||
<clTRID>ABC-12345</clTRID>
|
||||
</command>
|
||||
</epp>
|
||||
Loading…
Add table
Add a link
Reference in a new issue