Skip to content

Fixed security risk and redundant quote #440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
frankgiordano merged 9 commits into from
Dec 25, 2025
Merged

Fixed security risk and redundant quote #440

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
7a84260
Fixed security risk and redundant quote
shabaz213 Dec 24, 2025
1cf268a
Removed redundant single quote
shabaz213 Dec 24, 2025
8c3e1d3
Made setUser method package-private
shabaz213 Dec 24, 2025
58a1206
Normalize zOSMF basePath in url
shabaz213 Dec 24, 2025
f4ef5db
Normalize zOSMF basePath in url
shabaz213 Dec 24, 2025
e35347c
Removed redundant isUrlNotValid method
shabaz213 Dec 24, 2025
e83945c
Replace backward slash with forward slash in baseUrl
shabaz213 Dec 25, 2025
2a982a8
Added back isUrlNotValid method
shabaz213 Dec 25, 2025
0d2e0c8
Renamed unit test for clarity
shabaz213 Dec 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/main/java/zowe/client/sdk/core/SshConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ public String toString() {
"host='" + host + '\'' +
", port='" + port + '\'' +
", user='" + user + '\'' +
", password='*****'" + '\'' +
", password='*****'" +
'}';
}

Expand Down
23 changes: 18 additions & 5 deletions src/main/java/zowe/client/sdk/core/ZosConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,10 +113,12 @@ public String getUser() {

/**
* Set user value
* <p>
* This method's access level is private-package
*
* @param user string value
*/
public void setUser(String user) {
void setUser(String user) {
this.user = user;
}

Expand Down Expand Up @@ -208,7 +210,18 @@ void setCertPassword(String certPassword) {
* @param basePath string value
*/
void setBasePath(String basePath) {

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for this method how about we change it too:

/**
 * Sets the base path after normalizing it for z/OSMF REST endpoints. 
 * If the input is null or blank, it sets the value as is.
 * <p>
 * This method's access level is private-package
 *
 * @param basePath string value
 */
void setBasePath(String basePath) {
    this.basePath = Optional.ofNullable(basePath)
            .filter(path -> !path.isBlank())
            .map(this::getNormalizedPath)
            .orElse(basePath);
}

@shabaz213 shabaz213 Dec 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like complicated code instead of simple if-else

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok never mind.

this.basePath = basePath;
if (basePath == null || basePath.isBlank())
this.basePath = basePath;
else {
this.basePath = getNormalizedPath(basePath);
}
}

private String getNormalizedPath(String basePath) {

@frankgiordano frankgiordano Dec 25, 2025 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about change this method as follows:

/**
 * Normalizes a path by collapsing multiple slashes, resolving relative segments (. and ..),  
 * and ensuring a consistent leading slash. The result is standardized to forward slashes   
 * and excludes a trailing slash unless it is the root path.  
 * 
 * @param basePath The raw path string to normalize.
 * @return A canonical Unix-style path string.
 */
private String getNormalizedPath(String basePath) {
    // Paths.get handles leading slashes and collapses internal duplicate slashes
    // normalize() resolves dot-segments like /./ and /../
    final String normalized = Paths.get("/", basePath).normalize().toString().replace("\\", "/");
    
    // Remove trailing slash unless the result is the root "/"
    return (normalized.length() > 1 && normalized.endsWith("/"))
            ? normalized.substring(0, normalized.length() - 1) : normalized;
}

@shabaz213 shabaz213 Dec 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can replace all the backward slashes with forward slash in the same logic, but I don't think its a good idea to use "Paths" class as it will interpret "file separator" differently based on OS, for windows and Unix it will be different.

@shabaz213 shabaz213 Dec 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed a new commit to replace backward slashes to forward slashes

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok thanks.. with your updated version and without using Path how about we change the method to be like this way:

/**
 * Normalizes a path string by standardizing separators, collapsing multiple 
 * consecutive slashes, and ensuring a consistent leading slash.
 * <p>
 * This method performs the following transformations:
 * <ul>
 *   <li>Converts all backslashes (\) to forward slashes (/).</li>
 *   <li>Collapses multiple consecutive forward slashes into a single slash.</li>
 *   <li>Ensures the path begins with a leading slash.</li>
 *   <li>Removes the trailing slash unless the path is the root "/".</li>
 * </ul>
 *
 * @param basePath raw path string to be normalized.
 * @return canonicalize path string, or "/" if the input is null or blank.
 */
private String getNormalizedPath(String basePath) {
    // standardize separators and ensure a leading slash
    String normalizedPath = basePath.replace('\\', '/');
    normalizedPath = normalizedPath.startsWith("/") ? normalizedPath : "/" + normalizedPath;
    
    // collapse two or more consecutive slashes into one
    normalizedPath = normalizedPath.replaceAll("/{2,}", "/");

    // remove trailing slash unless the result is just the root "/"
    if (normalizedPath.length() > 1 && normalizedPath.endsWith("/")) {
        normalizedPath = normalizedPath.substring(0, normalizedPath.length() - 1);
    }

    return normalizedPath;
}

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually lets change the beginning to this to handle spaces too:
// remove all spaces and standardize separators and ensure a leading slash
String path = basePath.replace(" ", "").replace('\', '/');

String normalizedPath = basePath.replace('\\', '/');

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we do the following here:
String normalizedPath = basePath.replace(" ", "").replace('', '/');

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant to say:
String normalizedPath = basePath.replace(" ", "").replace('\', '/');

normalizedPath = normalizedPath.startsWith("/") ? normalizedPath : "/" + normalizedPath;
return normalizedPath.endsWith("/") ?
normalizedPath.substring(0, normalizedPath.length() - 1) : normalizedPath;
}

/**
Expand Down Expand Up @@ -308,10 +321,10 @@ public String toString() {
", zosmfPort='" + zosmfPort + '\'' +
", authType=" + authType +
", user='" + user + '\'' +
", password='*****'" + '\'' +
", token=" + token +
", password='*****'" +
", token=='*****'" +
", certFilePath='" + certFilePath + '\'' +
", certPassword='" + certPassword + '\'' +
", certPassword=='*****'" +
", basePath='" + basePath + '\'' +
'}';
}
Expand Down
9 changes: 9 additions & 0 deletions src/test/java/zowe/client/sdk/core/ZosConnectionFactoryTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,9 +204,18 @@ public void tstZosConnectionFactoryBasePathHashCodeMapWithSamePathsSuccess() {
"test", "zosmfPort", "user", "password", "/custom/path");
final ZosConnection zc2 = ZosConnectionFactory.createBasicConnection(
"test", "zosmfPort", "user", "password", "/custom/path");
final ZosConnection zc3 = ZosConnectionFactory.createBasicConnection(
"test", "zosmfPort", "user", "password", "custom/path/");
final ZosConnection zc4 = ZosConnectionFactory.createBasicConnection(
"test", "zosmfPort", "user", "password", "custom/path");
final ZosConnection zc5 = ZosConnectionFactory.createBasicConnection(
"test", "zosmfPort", "user", "password", "\\custom\\path");
final var zcs = new HashMap<ZosConnection, Integer>();
zcs.put(zc1, 1);
zcs.put(zc2, 2);
zcs.put(zc3, 3);
zcs.put(zc4, 4);
zcs.put(zc5, 5);
assertEquals(1, zcs.size());
}

Expand Down
2 changes: 1 addition & 1 deletion src/test/java/zowe/client/sdk/rest/ZoweRequestTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,7 @@ public void tstUrlConstructionWithoutBasePathSuccess() {
public void tstUrlConstructionWithInvalidBasePathFailure() {

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test does not consider base path. Tweak is as the following I suggest:

@Test
public void tstUrlConstructionWithInvalidHostNameFailure() {
    // Create a connection
    final ZosConnection connection = ZosConnectionFactory
            .createBasicConnection("test.host:123foo", "443", "user", "password");
    // Create a mock request to verify URL
    final ZosmfRequest request = ZosmfRequestFactory.buildRequest(connection, ZosmfRequestType.GET_JSON);

    // Set URL for a hypothetical endpoint
    final String RESOURCE_PATH = "/resource/endpoint";
    assertThrows(IllegalArgumentException.class,
            () -> request.setUrl(connection.getZosmfUrl() + RESOURCE_PATH));
}

@shabaz213 shabaz213 Dec 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

renamed test

// Create a connection and set an empty base path
final ZosConnection connection = ZosConnectionFactory
.createBasicConnection("test.host", "443", "user", "password", "frank//");
.createBasicConnection("test.host:123foo", "443", "user", "password", "frank///");

@frankgiordano frankgiordano Dec 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think here we can just use:
.createBasicConnection("test.host:123foo", "443", "user", "password");

// Create a mock request to verify URL
final ZosmfRequest request = ZosmfRequestFactory.buildRequest(connection, ZosmfRequestType.GET_JSON);

Expand Down
10 changes: 0 additions & 10 deletions src/test/java/zowe/client/sdk/zosconsole/method/ConsoleCmdTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,16 +90,6 @@ public void tstIssueConsoleIssueCommandCmdResponseToggleTokenSuccess() throws Zo
assertEquals("student", response.getCmdResponse());
}

@Test
public void tstIssueConsoleIssueCommandCmdResponseWithInvalidBasePathFailure() {
final ZosConnection connection = ZosConnectionFactory
.createBasicConnection("1", "1", "1", "1", "consoles//");
// Create a mock request to verify URL
final ZosmfRequest request = ZosmfRequestFactory.buildRequest(connection, ZosmfRequestType.PUT_JSON);
final ConsoleCmd issueCommand = new ConsoleCmd(connection, request);
assertThrows(IllegalArgumentException.class, () -> issueCommand.issueCommand("command"));
}

@Test
public void tstIssueConsoleIssueCommandCmdResponseWithEmptyStringSuccess() throws ZosmfRequestException {
final Map<String, Object> jsonMap = new HashMap<>();
Expand Down
10 changes: 0 additions & 10 deletions src/test/java/zowe/client/sdk/zosjobs/methods/JobGetJsonTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,16 +296,6 @@ public void tstJobGetJsonStatusWithStepDataFlagTrue() throws ZosmfRequestExcepti
assertEquals("BLSQPRMI", job.getStepData()[0].getProgramName());
}

@Test
public void tstJobGetJsonByIdCmdResponseWithInvalidBasePathFailure() {
final ZosConnection connection = ZosConnectionFactory
.createBasicConnection("1", "1", "1", "1", "consoles//");
// Create a mock request to verify URL
final ZosmfRequest request = ZosmfRequestFactory.buildRequest(connection, ZosmfRequestType.GET_JSON);
final JobGet getJobs = new JobGet(connection, request);
assertThrows(IllegalArgumentException.class, () -> getJobs.getById("1"));
}

@Test
public void tstJobGetJsonSpoolContentByIdJobIdNullExceptionFailure() throws ZosmfRequestException {
String errorMsg = "";
Expand Down
10 changes: 0 additions & 10 deletions src/test/java/zowe/client/sdk/zosjobs/methods/JobGetTextTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,16 +61,6 @@ public void tstJobGetTextSpoolContentByIdSuccess() throws ZosmfRequestException
assertEquals("1\n2\n3\n", results);
}

@Test
public void tstJobGetTextSpoolContentCmdResponseWithInvalidBasePathFailure() {
final ZosConnection connection = ZosConnectionFactory
.createBasicConnection("1", "1", "1", "1", "consoles//");
// Create a mock request to verify URL
final ZosmfRequest request = ZosmfRequestFactory.buildRequest(connection, ZosmfRequestType.GET_TEXT);
final JobGet getJobs = new JobGet(connection, request);
assertThrows(IllegalArgumentException.class, () -> getJobs.getSpoolContent("jobName", "jobId", 1L));
}

@Test
public void tstJobGetTextSpoolContentByIdToggleTokenSuccess() throws ZosmfRequestException {
JobGet getJobs = new JobGet(tokenConnection);
Expand Down