Skip to content

Commit c8b92dc

Browse files
henryjuhenryju
authored
SCANJLIB-256 Add support for empty keystore passwords (#230)
1 parent d13b2bf commit c8b92dc

File tree

12 files changed

+40
-29
lines changed

12 files changed

+40
-29
lines changed

‎batch-interface/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.sonarsource.scanner.lib</groupId>
55
<artifactId>sonar-scanner-java-library-parent</artifactId>
6-
<version>3.3-SNAPSHOT</version>
6+
<version>3.2.1-SNAPSHOT</version>
77
</parent>
88

99
<artifactId>sonar-scanner-java-library-batch-interface</artifactId>

‎batch/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<parent>
55
<groupId>org.sonarsource.scanner.lib</groupId>
66
<artifactId>sonar-scanner-java-library-parent</artifactId>
7-
<version>3.3-SNAPSHOT</version>
7+
<version>3.2.1-SNAPSHOT</version>
88
</parent>
99

1010
<artifactId>sonar-scanner-java-library-batch</artifactId>

‎its/it-simple-scanner/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<parent>
55
<groupId>org.sonarsource.scanner.lib</groupId>
66
<artifactId>it</artifactId>
7-
<version>3.3-SNAPSHOT</version>
7+
<version>3.2.1-SNAPSHOT</version>
88
</parent>
99

1010
<artifactId>it-scanner-java-library-simple-scanner</artifactId>

‎its/it-tests/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.sonarsource.scanner.lib</groupId>
55
<artifactId>it</artifactId>
6-
<version>3.3-SNAPSHOT</version>
6+
<version>3.2.1-SNAPSHOT</version>
77
</parent>
88

99
<artifactId>it-sonar-scanner-java-library</artifactId>

‎its/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>org.sonarsource.scanner.lib</groupId>
88
<artifactId>sonar-scanner-java-library-parent</artifactId>
9-
<version>3.3-SNAPSHOT</version>
9+
<version>3.2.1-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>it</artifactId>

‎lib/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<parent>
55
<groupId>org.sonarsource.scanner.lib</groupId>
66
<artifactId>sonar-scanner-java-library-parent</artifactId>
7-
<version>3.3-SNAPSHOT</version>
7+
<version>3.2.1-SNAPSHOT</version>
88
</parent>
99

1010
<artifactId>sonar-scanner-java-library</artifactId>

‎lib/src/main/java/org/sonarsource/scanner/lib/internal/facade/forked/ScannerEngineLauncher.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import org.slf4j.LoggerFactory;
3434
import org.sonarsource.scanner.lib.ScannerProperties;
3535
import org.sonarsource.scanner.lib.internal.cache.CachedFile;
36+
import org.sonarsource.scanner.lib.internal.http.OkHttpClientFactory;
3637

3738
public class ScannerEngineLauncher {
3839

@@ -105,6 +106,7 @@ private List<String> buildArgs(Map<String, String> properties) {
105106
if (javaOpts != null) {
106107
args.addAll(split(javaOpts));
107108
}
109+
args.add("-D" + OkHttpClientFactory.BC_IGNORE_USELESS_PASSWD + "=true");
108110
args.add("-jar");
109111
args.add(scannerEngineJar.getPathInCache().toAbsolutePath().toString());
110112
return args;

‎lib/src/main/java/org/sonarsource/scanner/lib/internal/http/OkHttpClientFactory.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import okhttp3.OkHttpClient;
4343
import okhttp3.logging.HttpLoggingInterceptor;
4444
import org.bouncycastle.jce.provider.BouncyCastleProvider;
45+
import org.bouncycastle.util.Properties;
4546
import org.slf4j.Logger;
4647
import org.slf4j.LoggerFactory;
4748
import org.sonarsource.scanner.lib.internal.http.ssl.CertificateStore;
@@ -60,6 +61,8 @@ public class OkHttpClientFactory {
6061
private static final String PROXY_AUTHORIZATION = "Proxy-Authorization";
6162
// use the same cookie jar for all instances
6263
private static final JavaNetCookieJar COOKIE_JAR;
64+
// This property tells Bouncycastle to not fail on empty keystore passwords
65+
public static final String BC_IGNORE_USELESS_PASSWD = "org.bouncycastle.pkcs12.ignore_useless_passwd";
6366

6467
private OkHttpClientFactory() {
6568
// only statics
@@ -158,6 +161,7 @@ private static void loadIdentityMaterialWithDefaultPassword(SSLFactory.Builder s
158161

159162
static KeyStore loadTrustStoreWithBouncyCastle(Path keystorePath, @Nullable String keystorePassword, String keystoreType) throws IOException,
160163
KeyStoreException, CertificateException, NoSuchAlgorithmException {
164+
Properties.setThreadOverride(BC_IGNORE_USELESS_PASSWD, true);
161165
KeyStore keystore = KeyStore.getInstance(keystoreType, new BouncyCastleProvider());
162166
if (keystorePassword != null) {
163167
loadKeyStoreWithPassword(keystorePath, keystore, keystorePassword);

‎lib/src/test/java/org/sonarsource/scanner/lib/internal/facade/forked/ScannerEngineLauncherTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ void execute() {
5959
launcher.execute(properties);
6060

6161
verify(javaRunner).execute(
62-
eq(List.of("-Xmx4g", "-Xms1g", "-jar", scannerEngine.toAbsolutePath().toString())),
62+
eq(List.of("-Xmx4g", "-Xms1g", "-Dorg.bouncycastle.pkcs12.ignore_useless_passwd=true", "-jar", scannerEngine.toAbsolutePath().toString())),
6363
eq("{\"scannerProperties\":[{\"key\":\"sonar.host.url\",\"value\":\"http://localhost:9000\"},{\"key\":\"sonar.scanner.javaOpts\",\"value\":\"-Xmx4g -Xms1g\"}]}"),
6464
any());
6565
}
@@ -76,7 +76,7 @@ void replace_null_values_by_empty_in_json_and_ignore_null_key() {
7676
launcher.execute(properties);
7777

7878
verify(javaRunner).execute(
79-
eq(List.of("-jar", scannerEngine.toAbsolutePath().toString())),
79+
eq(List.of("-Dorg.bouncycastle.pkcs12.ignore_useless_passwd=true", "-jar", scannerEngine.toAbsolutePath().toString())),
8080
eq("{\"scannerProperties\":[{\"key\":\"sonar.myProp\",\"value\":\"\"}]}"),
8181
any());
8282
}

‎lib/src/test/java/org/sonarsource/scanner/lib/internal/http/OkHttpClientFactoryTest.java‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import javax.annotation.Nullable;
3333
import javax.net.ssl.SSLHandshakeException;
3434
import nl.altindag.ssl.exception.GenericKeyStoreException;
35+
import nl.altindag.ssl.exception.GenericSecurityException;
3536
import okhttp3.Request;
3637
import okhttp3.Response;
3738
import org.junit.jupiter.api.BeforeEach;
@@ -85,15 +86,17 @@ void prepareMocks() {
8586

8687
@ParameterizedTest
8788
@CsvSource({
88-
"keystore_changeit.p12, wrong, false",
89-
"keystore_changeit.p12, changeit, true",
90-
"keystore_changeit.p12,, true",
91-
"keystore_sonar.p12, wrong, false",
92-
"keystore_sonar.p12, sonar, true",
93-
"keystore_sonar.p12,, true",
94-
"keystore_anotherpwd.p12, wrong, false",
95-
"keystore_anotherpwd.p12, anotherpwd, true",
96-
"keystore_anotherpwd.p12,, false"})
89+
"keystore_changeit.p12, wrong, false",
90+
"keystore_changeit.p12, changeit, true",
91+
"keystore_changeit.p12,, true",
92+
"keystore_sonar.p12, wrong, false",
93+
"keystore_sonar.p12, sonar, true",
94+
"keystore_sonar.p12,, true",
95+
"keystore_anotherpwd.p12, wrong, false",
96+
"keystore_anotherpwd.p12, anotherpwd, true",
97+
"keystore_anotherpwd.p12,, false",
98+
"keystore_emptypwd.p12, wrong, true",
99+
"keystore_emptypwd.p12,, true"})
97100
void it_should_fail_if_invalid_truststore_password(String keystore, @Nullable String password, boolean shouldSucceed) {
98101
bootstrapProperties.put("sonar.scanner.truststorePath", toPath(requireNonNull(OkHttpClientFactoryTest.class.getResource("/ssl/" + keystore))).toString());
99102
if (password != null) {
@@ -106,21 +109,23 @@ void it_should_fail_if_invalid_truststore_password(String keystore, @Nullable St
106109
assertThatThrownBy(() -> OkHttpClientFactory.create(new HttpConfig(bootstrapProperties, sonarUserHome)))
107110
.isInstanceOf(GenericKeyStoreException.class)
108111
.hasMessageContaining("Unable to read truststore from")
109-
.hasStackTraceContaining("wrong password or corrupted file");
112+
.hasStackTraceContaining("password");
110113
}
111114
}
112115

113116
@ParameterizedTest
114117
@CsvSource({
115-
"keystore_changeit.p12, wrong, false",
116-
"keystore_changeit.p12, changeit, true",
117-
"keystore_changeit.p12,, true",
118-
"keystore_sonar.p12, wrong, false",
119-
"keystore_sonar.p12, sonar, true",
120-
"keystore_sonar.p12,, true",
121-
"keystore_anotherpwd.p12, wrong, false",
122-
"keystore_anotherpwd.p12, anotherpwd, true",
123-
"keystore_anotherpwd.p12,, false"})
118+
"keystore_changeit.p12, wrong, false",
119+
"keystore_changeit.p12, changeit, true",
120+
"keystore_changeit.p12,, true",
121+
"keystore_sonar.p12, wrong, false",
122+
"keystore_sonar.p12, sonar, true",
123+
"keystore_sonar.p12,, true",
124+
"keystore_anotherpwd.p12, wrong, false",
125+
"keystore_anotherpwd.p12, anotherpwd, true",
126+
"keystore_anotherpwd.p12,, false",
127+
"keystore_emptypwd.p12, wrong, true",
128+
"keystore_emptypwd.p12,, true"})
124129
void it_should_fail_if_invalid_keystore_password(String keystore, @Nullable String password, boolean shouldSucceed) {
125130
bootstrapProperties.put("sonar.scanner.keystorePath", toPath(requireNonNull(OkHttpClientFactoryTest.class.getResource("/ssl/" + keystore))).toString());
126131
if (password != null) {
@@ -131,7 +136,7 @@ void it_should_fail_if_invalid_keystore_password(String keystore, @Nullable Stri
131136
assertThatNoException().isThrownBy(() -> OkHttpClientFactory.create(new HttpConfig(bootstrapProperties, sonarUserHome)));
132137
} else {
133138
assertThatThrownBy(() -> OkHttpClientFactory.create(new HttpConfig(bootstrapProperties, sonarUserHome)))
134-
.isInstanceOf(GenericKeyStoreException.class)
139+
.isInstanceOf(GenericSecurityException.class)
135140
.hasMessageContaining("keystore password was incorrect");
136141
}
137142
}

0 commit comments

Comments
 (0)