-
Notifications
You must be signed in to change notification settings - Fork 191
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #502 from JamesFoxxx:argocd-weak-credential-tester
PiperOrigin-RevId: 726085619 Change-Id: I6e0903dd813b6f2007a237faa8f0490dce50cf79
- Loading branch information
Showing
5 changed files
with
350 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
121 changes: 121 additions & 0 deletions
121
...tors/credentials/genericweakcredentialdetector/testers/argocd/ArgoCdCredentialTester.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| /* | ||
| * Copyright 2023 Google LLC | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.google.tsunami.plugins.detectors.credentials.genericweakcredentialdetector.testers.argocd; | ||
|
|
||
| import static com.google.common.base.Preconditions.checkNotNull; | ||
| import static com.google.tsunami.common.net.http.HttpRequest.post; | ||
| import static com.google.tsunami.common.net.http.HttpStatus.TEMPORARY_REDIRECT; | ||
|
|
||
| import com.google.common.collect.ImmutableList; | ||
| import com.google.common.flogger.GoogleLogger; | ||
| import com.google.gson.JsonParser; | ||
| import com.google.gson.JsonSyntaxException; | ||
| import com.google.protobuf.ByteString; | ||
| import com.google.tsunami.common.data.NetworkEndpointUtils; | ||
| import com.google.tsunami.common.data.NetworkServiceUtils; | ||
| import com.google.tsunami.common.net.http.HttpClient; | ||
| import com.google.tsunami.common.net.http.HttpHeaders; | ||
| import com.google.tsunami.common.net.http.HttpResponse; | ||
| import com.google.tsunami.plugins.detectors.credentials.genericweakcredentialdetector.provider.TestCredential; | ||
| import com.google.tsunami.plugins.detectors.credentials.genericweakcredentialdetector.tester.CredentialTester; | ||
| import com.google.tsunami.proto.NetworkService; | ||
| import java.io.IOException; | ||
| import java.util.List; | ||
| import javax.inject.Inject; | ||
|
|
||
| /** Credential tester specifically for argocd. */ | ||
| public final class ArgoCdCredentialTester extends CredentialTester { | ||
| private static final GoogleLogger logger = GoogleLogger.forEnclosingClass(); | ||
| private final HttpClient httpClient; | ||
|
|
||
| private static final String ARGOCD_SERVICE = "argocd"; | ||
|
|
||
| @Inject | ||
| ArgoCdCredentialTester(HttpClient httpClient) { | ||
| this.httpClient = checkNotNull(httpClient); | ||
| } | ||
|
|
||
| @Override | ||
| public String name() { | ||
| return "ArgoCdCredentialTester"; | ||
| } | ||
|
|
||
| @Override | ||
| public String description() { | ||
| return "ArgoCd credential tester."; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean canAccept(NetworkService networkService) { | ||
| return NetworkServiceUtils.getWebServiceName(networkService).equals(ARGOCD_SERVICE); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean batched() { | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public ImmutableList<TestCredential> testValidCredentials( | ||
| NetworkService networkService, List<TestCredential> credentials) { | ||
| // Always return 1st weak credential to gracefully handle no auth configured case, where we | ||
| // return empty credential instead of all the weak credentials | ||
| return credentials.stream() | ||
| .filter(cred -> isArgoCdAccessible(networkService, cred)) | ||
| .findFirst() | ||
| .map(ImmutableList::of) | ||
| .orElseGet(ImmutableList::of); | ||
| } | ||
|
|
||
| private boolean isArgoCdAccessible(NetworkService networkService, TestCredential credential) { | ||
| var uriAuthority = NetworkEndpointUtils.toUriAuthority(networkService.getNetworkEndpoint()); | ||
| var url = String.format("http://%s/%s", uriAuthority, "api/v1/session"); | ||
| try { | ||
| logger.atInfo().log( | ||
| "url: %s, username: %s, password: %s", | ||
| url, credential.username(), credential.password().orElse("")); | ||
| ByteString loginReqBody = | ||
| ByteString.copyFromUtf8( | ||
| String.format( | ||
| "{\"username\":\"%s\",\"password\":\"%s\"}", | ||
| credential.username(), credential.password().get())); | ||
| HttpHeaders loginHeaders = | ||
| HttpHeaders.builder().addHeader("Content-Type", "application/json").build(); | ||
| HttpResponse loginResponse = | ||
| httpClient.send(post(url).setHeaders(loginHeaders).setRequestBody(loginReqBody).build()); | ||
| if (loginResponse.status() == TEMPORARY_REDIRECT) { | ||
| url = String.format("https://%s/%s", uriAuthority, "api/v1/session"); | ||
| loginResponse = | ||
| httpClient.send( | ||
| post(url).setHeaders(loginHeaders).setRequestBody(loginReqBody).build()); | ||
| } | ||
| return loginResponse.status().isSuccess() | ||
| && loginResponse.bodyString().isPresent() | ||
| && bodyContainsToken(loginResponse.bodyString().get()); | ||
| } catch (IOException e) { | ||
| logger.atWarning().withCause(e).log("Unable to query '%s'.", url); | ||
| return false; | ||
| } | ||
| } | ||
|
|
||
| private static boolean bodyContainsToken(String responseBody) { | ||
| try { | ||
| return JsonParser.parseString(responseBody).getAsJsonObject().has("token"); | ||
| } catch (IllegalStateException | JsonSyntaxException e) { | ||
| return false; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
176 changes: 176 additions & 0 deletions
176
.../credentials/genericweakcredentialdetector/testers/argocd/ArgoCdCredentialTesterTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,176 @@ | ||
| /* | ||
| * Copyright 2023 Google LLC | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.google.tsunami.plugins.detectors.credentials.genericweakcredentialdetector.testers.argocd; | ||
|
|
||
| import static com.google.common.net.HttpHeaders.CONTENT_TYPE; | ||
| import static com.google.common.truth.Truth.assertThat; | ||
| import static com.google.tsunami.common.data.NetworkEndpointUtils.forHostnameAndPort; | ||
| import static org.mockito.ArgumentMatchers.any; | ||
| import static org.mockito.Mockito.verifyNoInteractions; | ||
| import static org.mockito.Mockito.when; | ||
|
|
||
| import com.google.common.collect.ImmutableList; | ||
| import com.google.inject.Guice; | ||
| import com.google.tsunami.common.net.db.ConnectionProviderInterface; | ||
| import com.google.tsunami.common.net.http.HttpClientModule; | ||
| import com.google.tsunami.plugins.detectors.credentials.genericweakcredentialdetector.provider.TestCredential; | ||
| import com.google.tsunami.proto.NetworkService; | ||
| import java.io.IOException; | ||
| import java.nio.charset.StandardCharsets; | ||
| import java.sql.Connection; | ||
| import java.util.Objects; | ||
| import java.util.Optional; | ||
| import javax.inject.Inject; | ||
| import okhttp3.mockwebserver.Dispatcher; | ||
| import okhttp3.mockwebserver.MockResponse; | ||
| import okhttp3.mockwebserver.MockWebServer; | ||
| import okhttp3.mockwebserver.RecordedRequest; | ||
| import org.junit.Before; | ||
| import org.junit.Rule; | ||
| import org.junit.Test; | ||
| import org.junit.runner.RunWith; | ||
| import org.junit.runners.JUnit4; | ||
| import org.mockito.Mock; | ||
| import org.mockito.junit.MockitoJUnit; | ||
| import org.mockito.junit.MockitoRule; | ||
|
|
||
| /** Tests for {@link ArgoCdCredentialTester}. */ | ||
| @RunWith(JUnit4.class) | ||
| public class ArgoCdCredentialTesterTest { | ||
| @Rule public MockitoRule rule = MockitoJUnit.rule(); | ||
| @Mock private ConnectionProviderInterface mockConnectionProvider; | ||
| @Mock private Connection mockConnection; | ||
| @Inject private ArgoCdCredentialTester tester; | ||
| private MockWebServer mockWebServer; | ||
| private static final TestCredential WEAK_CRED_1 = | ||
| TestCredential.create("admin", Optional.of("password")); | ||
| private static final TestCredential WEAK_CRED_2 = | ||
| TestCredential.create("admin", Optional.of("Password1!")); | ||
| private static final TestCredential WEAK_CRED_3 = | ||
| TestCredential.create("admin", Optional.of("YOUR-PASSWORD-HERE")); | ||
| private static final TestCredential WRONG_CRED_1 = | ||
| TestCredential.create("wrong", Optional.of("wrong")); | ||
|
|
||
| @Before | ||
| public void setup() { | ||
| mockWebServer = new MockWebServer(); | ||
| Guice.createInjector(new HttpClientModule.Builder().build()).injectMembers(this); | ||
| } | ||
|
|
||
| @Test | ||
| public void detect_weakCredentialsExists_returnsWeakCredentials() throws Exception { | ||
| startMockWebServer(); | ||
| NetworkService targetNetworkService = | ||
| NetworkService.newBuilder() | ||
| .setNetworkEndpoint( | ||
| forHostnameAndPort(mockWebServer.getHostName(), mockWebServer.getPort())) | ||
| .setServiceName("argocd") | ||
| .build(); | ||
|
|
||
| assertThat(tester.testValidCredentials(targetNetworkService, ImmutableList.of(WEAK_CRED_1))) | ||
| .containsExactly(WEAK_CRED_1); | ||
| mockWebServer.shutdown(); | ||
| } | ||
|
|
||
| @Test | ||
| public void detect_weakCredentialsExist_returnsFirstWeakCredentials() throws Exception { | ||
| startMockWebServer(); | ||
| NetworkService targetNetworkService = | ||
| NetworkService.newBuilder() | ||
| .setNetworkEndpoint( | ||
| forHostnameAndPort(mockWebServer.getHostName(), mockWebServer.getPort())) | ||
| .setServiceName("argocd") | ||
| .build(); | ||
|
|
||
| assertThat( | ||
| tester.testValidCredentials( | ||
| targetNetworkService, ImmutableList.of(WEAK_CRED_1, WEAK_CRED_2, WEAK_CRED_3))) | ||
| .containsExactly(WEAK_CRED_1); | ||
| } | ||
|
|
||
| @Test | ||
| public void detect_argocdService_canAccept() throws Exception { | ||
| startMockWebServer(); | ||
| NetworkService targetNetworkService = | ||
| NetworkService.newBuilder() | ||
| .setNetworkEndpoint( | ||
| forHostnameAndPort(mockWebServer.getHostName(), mockWebServer.getPort())) | ||
| .setServiceName("argocd") | ||
| .build(); | ||
|
|
||
| assertThat(tester.canAccept(targetNetworkService)).isTrue(); | ||
| } | ||
|
|
||
| @Test | ||
| public void detect_noWeakCredentials_returnsNoCredentials() throws Exception { | ||
| startMockWebServer(); | ||
| NetworkService targetNetworkService = | ||
| NetworkService.newBuilder() | ||
| .setNetworkEndpoint( | ||
| forHostnameAndPort(mockWebServer.getHostName(), mockWebServer.getPort())) | ||
| .setServiceName("argocd") | ||
| .build(); | ||
| assertThat(tester.testValidCredentials(targetNetworkService, ImmutableList.of(WRONG_CRED_1))) | ||
| .isEmpty(); | ||
| } | ||
|
|
||
| @Test | ||
| public void detect_nonArgoCdService_skips() throws Exception { | ||
| when(mockConnectionProvider.getConnection(any(), any(), any())).thenReturn(mockConnection); | ||
| NetworkService targetNetworkService = | ||
| NetworkService.newBuilder() | ||
| .setNetworkEndpoint(forHostnameAndPort("example.com", 8080)) | ||
| .setServiceName("http") | ||
| .build(); | ||
|
|
||
| assertThat(tester.testValidCredentials(targetNetworkService, ImmutableList.of(WEAK_CRED_1))) | ||
| .isEmpty(); | ||
| verifyNoInteractions(mockConnectionProvider); | ||
| } | ||
|
|
||
| private void startMockWebServer() throws IOException { | ||
| final Dispatcher dispatcher = | ||
| new Dispatcher() { | ||
| @Override | ||
| public MockResponse dispatch(RecordedRequest request) { | ||
| String authorizationRequestBody = request.getBody().readString(StandardCharsets.UTF_8); | ||
| if (request.getPath().equals("/api/v1/session") | ||
| && Objects.equals(request.getMethod(), "POST") | ||
| && Objects.equals(request.getHeader(CONTENT_TYPE), "application/json")) { | ||
| boolean isDefaultCredentials = | ||
| authorizationRequestBody.equals( | ||
| "{\"username\":\"admin\",\"password\":\"Password1!\"}") | ||
| || authorizationRequestBody.equals( | ||
| "{\"username\":\"admin\",\"password\":\"password\"}") | ||
| || authorizationRequestBody.equals( | ||
| "{\"username\":\"admin\",\"password\":\"YOUR-PASSWORD-HERE\"}"); | ||
| if (isDefaultCredentials) { | ||
| return new MockResponse() | ||
| .setResponseCode(200) | ||
| .setBody("{\"token\": \"AToken\"\n" + "}"); | ||
| } else { | ||
| return new MockResponse().setResponseCode(401); | ||
| } | ||
| } | ||
| return new MockResponse().setResponseCode(404); | ||
| } | ||
| }; | ||
| mockWebServer.setDispatcher(dispatcher); | ||
| mockWebServer.start(); | ||
| mockWebServer.url("/"); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters