[jboss-jira] [JBoss JIRA] (WFLY-8062) Some OSH's in the Elytron subsystem don't validate the server type before registering steps

[James Perkins (JIRA)]

James Perkins created WFLY-8062:
-----------------------------------

             Summary: Some OSH's in the Elytron subsystem don't validate the server type before registering steps
                 Key: WFLY-8062
                 URL: https://issues.jboss.org/browse/WFLY-8062
             Project: WildFly
          Issue Type: Bug
          Components: Security
            Reporter: James Perkins
            Assignee: James Perkins
            Priority: Blocker
             Fix For: 11.0.0.Alpha1


In the Elytron subsystem there are implementations of {{org.jboss.as.controller.OperationStepHandler}} that do not check the state of the {{OperationContext}} before registering runtime steps. This is an issue for domain servers as the steps will be registered on the host-controller even if the operations is being executed on a profile.

For example:
{code:java}
@Override
public void execute(OperationContext context, ModelNode operation) throws OperationFailedException {
    context.addStep(operation, (parentContext, parentOperation) -> {
        ModifiableRealmIdentity realmIdentity = getRealmIdentity(parentContext);
        List<ModelNode> modelNodes = parentOperation.asList();
        Property passwordProperty = modelNodes.get(2).asProperty();
        PathAddress currentAddress = parentContext.getCurrentAddress();
        String principalName = currentAddress.getLastElement().getValue();

        try {
            realmIdentity.setCredentials(Collections.singleton(new PasswordCredential(createPassword(parentContext, principalName, passwordProperty))));
        } catch (NoSuchAlgorithmException | InvalidKeySpecException | RealmUnavailableException e) {
            throw ROOT_LOGGER.couldNotCreatePassword(e);
        }
        parentContext.completeStep(NOOP_RESULT_HANDLER);
    }, OperationContext.Stage.RUNTIME);
}
{code}

Should check the {{context.isDefaultRequiresRuntime()}}:
{code:java}
@Override
public void execute(OperationContext context, ModelNode operation) throws OperationFailedException {
    if (context.isDefaultRequiresRuntime()) {
        context.addStep(operation, (parentContext, parentOperation) -> {
            ModifiableRealmIdentity realmIdentity = getRealmIdentity(parentContext);
            List<ModelNode> modelNodes = parentOperation.asList();
            Property passwordProperty = modelNodes.get(2).asProperty();
            PathAddress currentAddress = parentContext.getCurrentAddress();
            String principalName = currentAddress.getLastElement().getValue();

            try {
                realmIdentity.setCredentials(Collections.singleton(new PasswordCredential(createPassword(parentContext, principalName, passwordProperty))));
            } catch (NoSuchAlgorithmException | InvalidKeySpecException | RealmUnavailableException e) {
                throw ROOT_LOGGER.couldNotCreatePassword(e);
            }
            parentContext.completeStep(NOOP_RESULT_HANDLER);
        }, OperationContext.Stage.RUNTIME);
    }
}
{code}

The handlers should be analyzed to ensure they check the state before registering runtime steps.



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)