Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix redundant ConfigProperty queries in BadgeResource #4202

Merged
merged 1 commit into from
Oct 1, 2024
Merged

Fix redundant ConfigProperty queries in BadgeResource #4202

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 16 additions & 20 deletions src/main/java/org/dependencytrack/resources/v1/BadgeResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,7 @@
package org.dependencytrack.resources.v1;

import alpine.common.logging.Logger;
import alpine.common.util.BooleanUtil;
import alpine.model.ApiKey;
import alpine.model.ConfigProperty;
import alpine.model.UserPrincipal;
import alpine.model.LdapUser;
import alpine.model.ManagedUser;
Expand Down Expand Up @@ -80,12 +78,6 @@ public class BadgeResource extends AlpineResource {

private final Logger LOGGER = Logger.getLogger(AuthenticationFilter.class);

private boolean isUnauthenticatedBadgeAccessEnabled(final QueryManager qm) {
ConfigProperty property = qm.getConfigProperty(
GENERAL_BADGE_ENABLED.getGroupName(), GENERAL_BADGE_ENABLED.getPropertyName());
return BooleanUtil.valueOf(property.getPropertyValue());
}

// Stand-in methods for alpine.server.filters.AuthenticationFilter and
// alpine.server.filters.AuthorizationFilter to allow enabling and disabling of
// unauthenticated access to the badges API during runtime, used solely to offer
Expand Down Expand Up @@ -191,15 +183,16 @@ public Response getProjectVulnerabilitiesBadge(
@Parameter(description = "The UUID of the project to retrieve metrics for", schema = @Schema(type = "string", format = "uuid"), required = true)
@PathParam("uuid") @ValidUuid String uuid) {
try (QueryManager qm = new QueryManager()) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthentication()) {
final boolean shouldBypassAuth = qm.isEnabled(GENERAL_BADGE_ENABLED);
if (!shouldBypassAuth && !passesAuthentication()) {
return Response.status(Response.Status.UNAUTHORIZED).build();
}
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthorization(qm)) {
if (!shouldBypassAuth && !passesAuthorization(qm)) {
return Response.status(Response.Status.FORBIDDEN).build();
}
final Project project = qm.getObjectByUuid(Project.class, uuid);
if (project != null) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !qm.hasAccess(super.getPrincipal(), project)) {
if (!shouldBypassAuth && !qm.hasAccess(super.getPrincipal(), project)) {
return Response.status(Response.Status.FORBIDDEN).entity("Access to the specified project is forbidden").build();
}
final ProjectMetrics metrics = qm.getMostRecentProjectMetrics(project);
Expand Down Expand Up @@ -235,15 +228,16 @@ public Response getProjectVulnerabilitiesBadge(
@Parameter(description = "The version of the project to query on", required = true)
@PathParam("version") String version) {
try (QueryManager qm = new QueryManager()) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthentication()) {
final boolean shouldBypassAuth = qm.isEnabled(GENERAL_BADGE_ENABLED);
if (!shouldBypassAuth && !passesAuthentication()) {
return Response.status(Response.Status.UNAUTHORIZED).build();
}
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthorization(qm)) {
if (!shouldBypassAuth && !passesAuthorization(qm)) {
return Response.status(Response.Status.FORBIDDEN).build();
}
final Project project = qm.getProject(name, version);
if (project != null) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !qm.hasAccess(super.getPrincipal(), project)) {
if (!shouldBypassAuth && !qm.hasAccess(super.getPrincipal(), project)) {
return Response.status(Response.Status.FORBIDDEN).entity("Access to the specified project is forbidden").build();
}
final ProjectMetrics metrics = qm.getMostRecentProjectMetrics(project);
Expand Down Expand Up @@ -277,15 +271,16 @@ public Response getProjectPolicyViolationsBadge(
@Parameter(description = "The UUID of the project to retrieve a badge for", schema = @Schema(type = "string", format = "uuid"), required = true)
@PathParam("uuid") @ValidUuid String uuid) {
try (QueryManager qm = new QueryManager()) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthentication()) {
final boolean shouldBypassAuth = qm.isEnabled(GENERAL_BADGE_ENABLED);
if (!shouldBypassAuth && !passesAuthentication()) {
return Response.status(Response.Status.UNAUTHORIZED).build();
}
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthorization(qm)) {
if (!shouldBypassAuth && !passesAuthorization(qm)) {
return Response.status(Response.Status.FORBIDDEN).build();
}
final Project project = qm.getObjectByUuid(Project.class, uuid);
if (project != null) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !qm.hasAccess(super.getPrincipal(), project)) {
if (!shouldBypassAuth && !qm.hasAccess(super.getPrincipal(), project)) {
return Response.status(Response.Status.FORBIDDEN).entity("Access to the specified project is forbidden").build();
}
final ProjectMetrics metrics = qm.getMostRecentProjectMetrics(project);
Expand Down Expand Up @@ -321,15 +316,16 @@ public Response getProjectPolicyViolationsBadge(
@Parameter(description = "The version of the project to query on", required = true)
@PathParam("version") String version) {
try (QueryManager qm = new QueryManager()) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthentication()) {
final boolean shouldBypassAuth = qm.isEnabled(GENERAL_BADGE_ENABLED);
if (!shouldBypassAuth && !passesAuthentication()) {
return Response.status(Response.Status.UNAUTHORIZED).build();
}
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !passesAuthorization(qm)) {
if (!shouldBypassAuth && !passesAuthorization(qm)) {
return Response.status(Response.Status.FORBIDDEN).build();
}
final Project project = qm.getProject(name, version);
if (project != null) {
if (!isUnauthenticatedBadgeAccessEnabled(qm) && !qm.hasAccess(super.getPrincipal(), project)) {
if (!shouldBypassAuth && !qm.hasAccess(super.getPrincipal(), project)) {
return Response.status(Response.Status.FORBIDDEN).entity("Access to the specified project is forbidden").build();
}
final ProjectMetrics metrics = qm.getMostRecentProjectMetrics(project);
Expand Down
Loading