Skip to content

Commit

Permalink
SNOW-1454054 - add check of user permision for token file
Browse files Browse the repository at this point in the history
  • Loading branch information
@sfc-gh-pmotacki
sfc-gh-pmotacki committed Jul 19, 2024
1 parent 60e9e54 commit 5f8ef63
Show file tree
Hide file tree
Showing 2 changed files with 62 additions and 37 deletions.
3 changes: 2 additions & 1 deletion src/main/java/net/snowflake/client/config/SFConnectionConfigParser.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,13 +108,14 @@ public static ConnectionParameters buildConnectionParameters() throws SnowflakeS
.orElse(SNOWFLAKE_TOKEN_FILE_PATH));
logger.debug("Token used in connect is read from file: {}", path);
try {
varifyFilePermissionSecure(path);
String token = new String(Files.readAllBytes(path), Charset.defaultCharset());
if (!token.isEmpty()) {
putPropertyIfNotNull(conectionProperties, "token", token.trim());
} else {
logger.warn("The token has empty value");
}
} catch (IOException ex) {
} catch (Exception ex) {
throw new SnowflakeSQLException(ex, "There is a problem during reading token from file");
}
}
Expand Down
96 changes: 60 additions & 36 deletions src/test/java/net/snowflake/client/config/SFConnectionConfigParserTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ public void testLoadSFConnectionConfigWrongConfigurationName()
throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "unknown");
prepareConnectionConfigurationTomlFile(null, true);
prepareConnectionConfigurationTomlFile();
ConnectionParameters connectionParameters =
SFConnectionConfigParser.buildConnectionParameters();
assertNull(connectionParameters);
Expand All @@ -62,7 +62,7 @@ public void testLoadSFConnectionConfigWrongConfigurationName()
@Test
public void testLoadSFConnectionConfigInValidPath() throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, Paths.get("unknownPath").toString());
prepareConnectionConfigurationTomlFile(null, true);
prepareConnectionConfigurationTomlFile();
assertNull(SFConnectionConfigParser.buildConnectionParameters());
}

Expand All @@ -73,37 +73,87 @@ public void testLoadSFConnectionConfigWithTokenFromFile()
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
File tokenFile = new File(Paths.get(tempPath.toString(), "token").toUri());
prepareConnectionConfigurationTomlFile(
Collections.singletonMap("token_file_path", tokenFile.toString()), true);
Collections.singletonMap("token_file_path", tokenFile.toString()));

ConnectionParameters data = SFConnectionConfigParser.buildConnectionParameters();
assertNotNull(data);
assertEquals(tokenFile.toString(), data.getParams().get("token_file_path"));
assertEquals("testToken", data.getParams().get("token"));
}

@Test
public void testThrowErrorWhenWrongPermissionsForConnectionConfigurationFile()
throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
File tokenFile = new File(Paths.get(tempPath.toString(), "token").toUri());
prepareConnectionConfigurationTomlFile(
Collections.singletonMap("token_file_path", tokenFile.toString()), false, false);
assumeFalse(RunningNotOnLinuxMac.isNotRunningOnLinuxMac());
assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}

@Test
public void testThrowErrorWhenWrongPermissionsForTokenFile() throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
File tokenFile = new File(Paths.get(tempPath.toString(), "token").toUri());
prepareConnectionConfigurationTomlFile(
Collections.singletonMap("token_file_path", tokenFile.toString()), false);
Collections.singletonMap("token_file_path", tokenFile.toString()), true, false);
assumeFalse(RunningNotOnLinuxMac.isNotRunningOnLinuxMac());
assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}

@Test
public void testLoadSFConnectionConfigWithHostConfigured()
throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", "snowflake.reg.local");
extraparams.put("account", null);
extraparams.put("port", "8082");
extraparams.put("token", "testToken");
prepareConnectionConfigurationTomlFile(extraparams);
ConnectionParameters data = SFConnectionConfigParser.buildConnectionParameters();
assertNotNull(data);
assertEquals("jdbc:snowflake://snowflake.reg.local:8082", data.getUrl());
assertEquals("oauth", data.getParams().get("authenticator"));
assertEquals("testToken", data.getParams().get("token"));
}

@Test
public void shouldThrowExceptionIfNoneOfHostAndAccountIsSet() throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", null);
extraparams.put("account", null);
prepareConnectionConfigurationTomlFile(extraparams);
Assert.assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}

private void prepareConnectionConfigurationTomlFile() throws IOException {
prepareConnectionConfigurationTomlFile(null, true, true);
}

private void prepareConnectionConfigurationTomlFile(Map moreParameters) throws IOException {
prepareConnectionConfigurationTomlFile(moreParameters, true, true);
}

private void prepareConnectionConfigurationTomlFile(
Map moreParameters, boolean onlyUserPermission) throws IOException {
Map moreParameters, boolean onlyUserPermissionConnection, boolean onlyUserPermissionToken)
throws IOException {
Path path = Paths.get(tempPath.toString(), "connections.toml");
Path filePath = createFilePathWithPermission(path, onlyUserPermission);
Path filePath = createFilePathWithPermission(path, onlyUserPermissionConnection);
File file = filePath.toFile();

Map configuration = new HashMap();
Map configurationParams = new HashMap();
configurationParams.put("account", "snowaccount.us-west-2.aws");
configurationParams.put("user", "user1");
configurationParams.put("token", "testToken");
configurationParams.put("port", "443");
configurationParams.put("authenticator", "oauth");

if (moreParameters != null) {
moreParameters.forEach((k, v) -> configurationParams.put(k, v));
Expand All @@ -114,7 +164,8 @@ private void prepareConnectionConfigurationTomlFile(
if (configurationParams.containsKey("token_file_path")) {
Path tokenFilePath =
createFilePathWithPermission(
Paths.get(configurationParams.get("token_file_path").toString()), onlyUserPermission);
Paths.get(configurationParams.get("token_file_path").toString()),
onlyUserPermissionToken);
Files.write(tokenFilePath, "token_from_file".getBytes());
}
}
Expand All @@ -131,31 +182,4 @@ private Path createFilePathWithPermission(Path path, boolean onlyUserPermission)
return Files.createFile(path);
}
}

@Test
public void testLoadSFConnectionConfigWithHostConfigured()
throws SnowflakeSQLException, IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", "snowflake.reg.local");
extraparams.put("account", null);
extraparams.put("port", "8082");
prepareConnectionConfigurationTomlFile(extraparams, true);
ConnectionParameters data = SFConnectionConfigParser.buildConnectionParameters();
assertNotNull(data);
assertEquals("jdbc:snowflake://snowflake.reg.local:8082", data.getUrl());
}

@Test
public void shouldThrowExceptionIfNoneOfHostAndAccountIsSet() throws IOException {
SnowflakeUtil.systemSetEnv(SNOWFLAKE_HOME_KEY, tempPath.toString());
SnowflakeUtil.systemSetEnv(SNOWFLAKE_DEFAULT_CONNECTION_NAME_KEY, "default");
Map<String, String> extraparams = new HashMap();
extraparams.put("host", null);
extraparams.put("account", null);
prepareConnectionConfigurationTomlFile(extraparams, true);
Assert.assertThrows(
SnowflakeSQLException.class, () -> SFConnectionConfigParser.buildConnectionParameters());
}
}

0 comments on commit 5f8ef63

Please sign in to comment.