Skip to content

Fixed security risk and redundant quote - #440

Merged
frankgiordano merged 9 commits into
zowe:mainfrom
shabaz213:code-improvements-1
Dec 25, 2025
Merged

frankgiordano merged 9 commits into
zowe:mainfrom
shabaz213:code-improvements-1

Conversation

@shabaz213

@shabaz213 shabaz213 commented Dec 24, 2025 •

Copy link
Copy Markdown
Contributor

List of changes

  • Removed redundant quote in the toString()
  • Mask credentials in toString()
  • Normalize basePath to handle slashes
  • Made setUser package-private
  • Removed tests with invalidBasePathFailure as it is no longer throwing expected exception instead it is throwing ZosmfRequestException

Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
}
}

private String getNormalizedPath(String basePath) {

@frankgiordano frankgiordano Dec 25, 2025 •

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about change this method as follows:

/**
 * Normalizes a path by collapsing multiple slashes, resolving relative segments (. and ..),  
 * and ensuring a consistent leading slash. The result is standardized to forward slashes   
 * and excludes a trailing slash unless it is the root path.  
 * 
 * @param basePath The raw path string to normalize.
 * @return A canonical Unix-style path string.
 */
private String getNormalizedPath(String basePath) {
    // Paths.get handles leading slashes and collapses internal duplicate slashes
    // normalize() resolves dot-segments like /./ and /../
    final String normalized = Paths.get("/", basePath).normalize().toString().replace("\\", "/");
    
    // Remove trailing slash unless the result is the root "/"
    return (normalized.length() > 1 && normalized.endsWith("/"))
            ? normalized.substring(0, normalized.length() - 1) : normalized;
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can replace all the backward slashes with forward slash in the same logic, but I don't think its a good idea to use "Paths" class as it will interpret "file separator" differently based on OS, for windows and Unix it will be different.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed a new commit to replace backward slashes to forward slashes

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok thanks.. with your updated version and without using Path how about we change the method to be like this way:

/**
 * Normalizes a path string by standardizing separators, collapsing multiple 
 * consecutive slashes, and ensuring a consistent leading slash.
 * <p>
 * This method performs the following transformations:
 * <ul>
 *   <li>Converts all backslashes (\) to forward slashes (/).</li>
 *   <li>Collapses multiple consecutive forward slashes into a single slash.</li>
 *   <li>Ensures the path begins with a leading slash.</li>
 *   <li>Removes the trailing slash unless the path is the root "/".</li>
 * </ul>
 *
 * @param basePath raw path string to be normalized.
 * @return canonicalize path string, or "/" if the input is null or blank.
 */
private String getNormalizedPath(String basePath) {
    // standardize separators and ensure a leading slash
    String normalizedPath = basePath.replace('\\', '/');
    normalizedPath = normalizedPath.startsWith("/") ? normalizedPath : "/" + normalizedPath;
    
    // collapse two or more consecutive slashes into one
    normalizedPath = normalizedPath.replaceAll("/{2,}", "/");

    // remove trailing slash unless the result is just the root "/"
    if (normalizedPath.length() > 1 && normalizedPath.endsWith("/")) {
        normalizedPath = normalizedPath.substring(0, normalizedPath.length() - 1);
    }

    return normalizedPath;
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually lets change the beginning to this to handle spaces too:
// remove all spaces and standardize separators and ensure a leading slash
String path = basePath.replace(" ", "").replace('\', '/');

* @return boolean true or false
* @author Frank Giordano
*/
private static boolean isUrlNotValid(final String url) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you feel this is redundant?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't able to get a "true" out of this method in unit testing.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added it back, found a way to get "true" out of this method with some modification to host

Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
@@ -208,7 +210,18 @@ void setCertPassword(String certPassword) {
* @param basePath string value
*/
void setBasePath(String basePath) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for this method how about we change it too:

/**
 * Sets the base path after normalizing it for z/OSMF REST endpoints. 
 * If the input is null or blank, it sets the value as is.
 * <p>
 * This method's access level is private-package
 *
 * @param basePath string value
 */
void setBasePath(String basePath) {
    this.basePath = Optional.ofNullable(basePath)
            .filter(path -> !path.isBlank())
            .map(this::getNormalizedPath)
            .orElse(basePath);
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like complicated code instead of simple if-else

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok never mind.

}
}

private String getNormalizedPath(String basePath) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok thanks.. with your updated version and without using Path how about we change the method to be like this way:

/**
 * Normalizes a path string by standardizing separators, collapsing multiple 
 * consecutive slashes, and ensuring a consistent leading slash.
 * <p>
 * This method performs the following transformations:
 * <ul>
 *   <li>Converts all backslashes (\) to forward slashes (/).</li>
 *   <li>Collapses multiple consecutive forward slashes into a single slash.</li>
 *   <li>Ensures the path begins with a leading slash.</li>
 *   <li>Removes the trailing slash unless the path is the root "/".</li>
 * </ul>
 *
 * @param basePath raw path string to be normalized.
 * @return canonicalize path string, or "/" if the input is null or blank.
 */
private String getNormalizedPath(String basePath) {
    // standardize separators and ensure a leading slash
    String normalizedPath = basePath.replace('\\', '/');
    normalizedPath = normalizedPath.startsWith("/") ? normalizedPath : "/" + normalizedPath;
    
    // collapse two or more consecutive slashes into one
    normalizedPath = normalizedPath.replaceAll("/{2,}", "/");

    // remove trailing slash unless the result is just the root "/"
    if (normalizedPath.length() > 1 && normalizedPath.endsWith("/")) {
        normalizedPath = normalizedPath.substring(0, normalizedPath.length() - 1);
    }

    return normalizedPath;
}

@@ -223,7 +223,7 @@ public void tstUrlConstructionWithoutBasePathSuccess() {
public void tstUrlConstructionWithInvalidBasePathFailure() {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test does not consider base path. Tweak is as the following I suggest:

@Test
public void tstUrlConstructionWithInvalidHostNameFailure() {
    // Create a connection
    final ZosConnection connection = ZosConnectionFactory
            .createBasicConnection("test.host:123foo", "443", "user", "password");
    // Create a mock request to verify URL
    final ZosmfRequest request = ZosmfRequestFactory.buildRequest(connection, ZosmfRequestType.GET_JSON);

    // Set URL for a hypothetical endpoint
    final String RESOURCE_PATH = "/resource/endpoint";
    assertThrows(IllegalArgumentException.class,
            () -> request.setUrl(connection.getZosmfUrl() + RESOURCE_PATH));
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

renamed test

Signed-off-by: Shabaz K <kshabaz1729@gmail.com>
@shabaz213

Copy link
Copy Markdown
Contributor Author

@frankgiordano I understand you want the project to have useful comments consistently but this is not required for a clean and readable code.


private String getNormalizedPath(String basePath) {
String normalizedPath = basePath.startsWith("/") ? basePath : "/" + basePath;
String normalizedPath = basePath.replace('\\', '/');

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we do the following here:
String normalizedPath = basePath.replace(" ", "").replace('', '/');

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant to say:
String normalizedPath = basePath.replace(" ", "").replace('\', '/');

// Create a connection and set an empty base path
final ZosConnection connection = ZosConnectionFactory
.createBasicConnection("test.host", "443", "user", "password", "frank//");
.createBasicConnection("test.host:123foo", "443", "user", "password", "frank///");

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think here we can just use:
.createBasicConnection("test.host:123foo", "443", "user", "password");

@frankgiordano

Copy link
Copy Markdown
Collaborator

I think this is all good. I was over thinking on edge cases but it is not needed.

@frankgiordano
frankgiordano merged commit e873618 into zowe:main Dec 25, 2025
2 checks passed
@frankgiordano frankgiordano added enhancement New feature or request bug Something isn't working labels Dec 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants