[java-identity-provider] 02/06: IDP-1595 Add Range checking to PluginVersion

Rod Widdowson rdw at steadingsoftware.com
Wed May 20 16:04:58 UTC 2020


This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch dev/IDP-1595
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=ac2d3cd0a812f3ab06bd479c261b82d0c78cde65

commit ac2d3cd0a812f3ab06bd479c261b82d0c78cde65
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon May 11 14:03:16 2020 +0100

    IDP-1595 Add Range checking to PluginVersion
    
    https://issues.shibboleth.net/jira/browse/IDP-1595
    
    This is for sanity checking, but more importantly is assures us
    that the hashing works. The hashing is adjusted slightly and the
    comments on compareTo enhanced.
---
 .../idp/installer/plugin/PluginVersion.java        | 53 ++++++++++++++++++----
 .../idp/installer/plugin/PluginVersionTest.java    | 24 +++++++++-
 2 files changed, 67 insertions(+), 10 deletions(-)

diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/PluginVersion.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/PluginVersion.java
index 054443cff..c59dac25b 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/PluginVersion.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/PluginVersion.java
@@ -24,6 +24,9 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
  */
 public final class PluginVersion implements Comparable<PluginVersion>{
 
+    /** arbitrary maximum (to help hashing and sanity). */
+    private static final int MAX_VNO = 10000;
+
     /** Major version. */
     private int major;
     
@@ -37,7 +40,8 @@ public final class PluginVersion implements Comparable<PluginVersion>{
      * Constructor.
      *
      * @param version what to build from 
-     * @throws NumberFormatException if it doesn't fit a 1.2.3 format.
+     * @throws NumberFormatException if it doesn't fit a 1.2.3 format or if the values are
+     * out of range
      */
     public PluginVersion(final String version) throws NumberFormatException {
         
@@ -48,13 +52,13 @@ public final class PluginVersion implements Comparable<PluginVersion>{
         
         final String[] components  = versionStr.split("\\.|\\+|-");
         if (components.length >= 1) {
-            major = Integer.parseInt(components[0]);
+            major = parseValue(components[0]);
         }
         if (components.length >= 2) {
-            minor = Integer.parseInt(components[1]);
+            minor = parseValue(components[1]);
         }
         if (components.length >= 3) {
-            patch = Integer.parseInt(components[2]);
+            patch = parseValue(components[2]);
         }
     }
     
@@ -63,12 +67,22 @@ public final class PluginVersion implements Comparable<PluginVersion>{
      *
      * @param maj Major Version 
      * @param min Minor Version 
-     * @param pat Patch Version 
+     * @param pat Patch Version
+     * @throws NumberFormatException if the values are out of range
      */
-    public PluginVersion(final int maj, final int min, final int pat) {
+    public PluginVersion(final int maj, final int min, final int pat) throws NumberFormatException {
         major = maj;
+        if (maj < 0 || maj >= MAX_VNO) {
+            throw new NumberFormatException("Improbably version number : " + maj);
+        }
         minor = min;
+        if (min < 0 || min >= MAX_VNO) {
+            throw new NumberFormatException("Improbably version number : " + min);
+        }
         patch = pat;
+        if (pat < 0 || pat >= MAX_VNO) {
+            throw new NumberFormatException("Improbably version number : " + pat);
+        }
     }
 
     /** Get the major version.
@@ -98,7 +112,21 @@ public final class PluginVersion implements Comparable<PluginVersion>{
         return major == 0 && minor ==0 && patch == 0;
     }
     
-
+    /** Helper function for the constructor.
+     *
+     * Parse a string into an int with a range check.
+     * @param valueAsString what to parse
+     * @return the value as an int
+     * @throws NumberFormatException if {@link Integer#parseInt(String, int)} does
+     * or if the value is less than 0 or > {@link #MAX_VNO}.
+     */
+    private int parseValue(final String valueAsString) throws NumberFormatException{
+        final int value = Integer.parseInt(valueAsString);
+        if (value < 0 || value >= MAX_VNO) {
+            throw new NumberFormatException("Improbably version number : " + value);
+        }
+        return value;
+    }
 
     /** {@inheritDoc} */
     public boolean equals(final Object obj) {
@@ -111,10 +139,17 @@ public final class PluginVersion implements Comparable<PluginVersion>{
     
     /** {@inheritDoc} */
     public int hashCode() {
-        return Integer.valueOf(major*100000 + minor*1000 +patch).hashCode();
+        long l = major*MAX_VNO*MAX_VNO;
+        l += minor * MAX_VNO;
+        l += patch;
+        return Long.hashCode(l);
     }
 
-    /** {@inheritDoc} */
+    /**
+     * Compares this object with the specified object for order.  Returns a
+     * negative integer, zero, or a positive integer as this object is less
+     * than, equal to, or greater than the specified object.
+     * {@inheritDoc} */
     public int compareTo(final PluginVersion other) {
         if (major == other.major) {
             if (minor == other.minor) {
diff --git a/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/PluginVersionTest.java b/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/PluginVersionTest.java
index 2d9217a71..d666f867a 100644
--- a/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/PluginVersionTest.java
+++ b/idp-installer/src/test/java/net/shibboleth/idp/installer/plugin/PluginVersionTest.java
@@ -66,6 +66,29 @@ public final class PluginVersionTest {
         failParse("1.jo");
         failParse("");
         failParse("XXXX");
+        failParse("-1");
+        failParse("1.-1");
+        failParse("1.1.-1");
+        failParse("10001.99.0");
+
+        try {
+            new PluginVersion(1,2,-1);
+            fail("Bad version not caught");
+        } catch (NumberFormatException ex) {
+            // OK
+        }
+        try {
+            new PluginVersion(10000,2,0);
+            fail("Bad version not caught");
+        } catch (NumberFormatException ex) {
+            // OK
+        }
+        try {
+            new PluginVersion(1, 10000,2);
+            fail("Bad version not caught");
+        } catch (NumberFormatException ex) {
+            // OK
+        }
     }
 
     @Test public void compareTest() {
@@ -77,5 +100,4 @@ public final class PluginVersionTest {
         assertTrue(new PluginVersion(4,1,0).compareTo(new PluginVersion(4,2,1)) < 0);
         assertTrue(new PluginVersion(4,1,0).compareTo(new PluginVersion(4,1,1)) < 0);
     }
-
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list