Skip to content

Fix potential NPE in UsersTool #37660

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cbuescher merged 3 commits into from
Jan 22, 2019
Merged

Fix potential NPE in UsersTool #37660

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7f9adc8
Fix potential NPE in UsersTool
Jan 21, 2019
4a7a1d5
Merge branch 'master' into possibly-dead-code
Jan 22, 2019
5b3339e
iter
Jan 22, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion ...in/security/src/main/java/org/elasticsearch/xpack/security/authc/file/tool/UsersTool.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

import joptsimple.OptionSet;
import joptsimple.OptionSpec;

import org.elasticsearch.cli.EnvironmentAwareCommand;
import org.elasticsearch.cli.ExitCodes;
import org.elasticsearch.cli.LoggingAwareMultiCommand;
Expand Down Expand Up @@ -221,14 +222,15 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th

Path file = FileUserPasswdStore.resolveFile(env);
FileAttributesChecker attributesChecker = new FileAttributesChecker(file);
Map<String, char[]> users = new HashMap<>(FileUserPasswdStore.parseFile(file, null, env.settings()));
Map<String, char[]> users = FileUserPasswdStore.parseFile(file, null, env.settings());
if (users == null) {
throw new UserException(ExitCodes.CONFIG, "Configuration file [" + file + "] is missing");
Copy link
Member Author

@cbuescher cbuescher Jan 21, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently this looks dead. Furthermore, FileUserPasswdStore.parseFile can return null which I think will then create an NPE in the HashMap ctor.

}
if (users.containsKey(username) == false) {
throw new UserException(ExitCodes.NO_USER, "User [" + username + "] doesn't exist");
}
final Hasher hasher = Hasher.resolve(XPackSettings.PASSWORD_HASHING_ALGORITHM.get(env.settings()));
users = new HashMap<>(users); // make modifiable
Copy link
Member Author

@cbuescher cbuescher Jan 22, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same approach as in L129

users.put(username, hasher.hash(new SecureString(password)));
FileUserPasswdStore.writeFile(users, file);

Expand Down