Skip to content

Commit

Permalink
Escape SFTP passwords correctly (#6)
Browse files Browse the repository at this point in the history
This commit changes how we handle the SFTP URI. Currently we don't
escape anything, and that might lead to failures. What this commit does
is use java.net.URI class and it's uri-escaping-properties to mitigate
this possibility, and fix this issue.
  • Loading branch information
LeoColman authored Mar 3, 2021
1 parent 95bb572 commit c84e0a2
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -18,15 +18,16 @@ package br.com.guiabolso.sftptos3connector.internal.sftp

import br.com.guiabolso.sftptos3connector.config.SftpConfig
import org.apache.commons.vfs2.VFS
import java.net.URI

internal class SftpFileStreamer(sftpConfig: SftpConfig) {
private val baseConnectionURI = sftpConfig.run { "sftp://$username:$password@$host:$port" }
private val baseConnectionURI = sftpConfig.run { URI("sftp", "$username:$password", host, port, null, null, null) }
private val fileSystemManager = VFS.getManager()

fun getSftpFile(filePath: String): SftpFile {
return getInputStreamWithContentLength(filePath)
}

private fun getInputStreamWithContentLength(filePath: String): SftpFile {
val remoteFile = fileSystemManager.resolveFile("$baseConnectionURI/$filePath")
return SftpFile(remoteFile.content.inputStream, remoteFile.content.size)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -41,4 +41,12 @@ class SftpFileStreamerTest : FunSpec({
fileInfo.contentLength shouldBe sftpFileContent.encodeToByteArray().size.toLong()
}
}

test("Escape uri characters") {
withConfiguredSftpServer("unsafe%%,,..&") { server ->
val target = SftpFileStreamer(SftpConfig("localhost", server.port, sftpUsername, "unsafe%%,,..&"))

target.getSftpFile(sftpFilePath)
}
}
})
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,13 @@ val sftpFilePath = "path/to/file"
val sftpFileContent = "FileContent\nMoreContent"


fun withConfiguredSftpServer(block: (FakeSftpServer) -> Unit) = FakeSftpServer.withSftpServer { server ->
fun withConfiguredSftpServer(
password: String = sftpPassword,
block: (FakeSftpServer) -> Unit
) = FakeSftpServer.withSftpServer { server ->
server.port = obtainRandomAvailablePort()
server.putFile(sftpFilePath, sftpFileContent, Charsets.UTF_8)
server.addUser(sftpUsername, sftpPassword)
server.addUser(sftpUsername, password)
block(server)
}

Expand Down

0 comments on commit c84e0a2

Please sign in to comment.