Skip to content

Commit

Permalink
Improve error handling
Browse files Browse the repository at this point in the history
  • Loading branch information
@k-tamura
k-tamura committed Sep 11, 2017
1 parent e3ae4bc commit d685667
Show file tree
Hide file tree
Showing 4 changed files with 66 additions and 54 deletions.
70 changes: 39 additions & 31 deletions src/main/java/org/t246osslab/easybuggy4sb/controller/DefaultLoginController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,25 +31,25 @@
@Controller
public class DefaultLoginController {

@Value("${account.lock.time}")
long accountLockTime;
@Value("${account.lock.time}")
long accountLockTime;

@Value("${account.lock.count}")
long accountLockCount;
@Value("${account.lock.count}")
long accountLockCount;

@Autowired
protected MessageSource msg;

@Autowired
protected LdapTemplate ldapTemplate;
protected LdapTemplate ldapTemplate;

/* User's login history using in-memory account locking */
protected ConcurrentHashMap<String, User> userLoginHistory = new ConcurrentHashMap<>();

private static final Logger log = LoggerFactory.getLogger(DefaultLoginController.class);
@RequestMapping(value = "/login", method = RequestMethod.GET)
public ModelAndView doGet(ModelAndView mav, HttpServletRequest req, HttpServletResponse res, Locale locale) {

@RequestMapping(value = "/login", method = RequestMethod.GET)
public ModelAndView doGet(ModelAndView mav, HttpServletRequest req, HttpServletResponse res, Locale locale) {
mav.setViewName("login");
mav.addObject("title", msg.getMessage("title.login.page", null, locale));

Expand All @@ -63,14 +63,15 @@ public ModelAndView doGet(ModelAndView mav, HttpServletRequest req, HttpServletR

HttpSession session = req.getSession(true);
if (session.getAttribute("authNMsg") != null && !"authenticated".equals(session.getAttribute("authNMsg"))) {
mav.addObject("errmsg", msg.getMessage((String)session.getAttribute("authNMsg"), null, locale));
mav.addObject("errmsg", msg.getMessage((String) session.getAttribute("authNMsg"), null, locale));
session.setAttribute("authNMsg", null);
}
return mav;
}

@RequestMapping(value = "/login", method = RequestMethod.POST)
public ModelAndView doPost(ModelAndView mav, HttpServletRequest req, HttpServletResponse res, Locale locale) throws IOException {
@RequestMapping(value = "/login", method = RequestMethod.POST)
public ModelAndView doPost(ModelAndView mav, HttpServletRequest req, HttpServletResponse res, Locale locale)
throws IOException {

String userid = StringUtils.trim(req.getParameter("userid"));
String password = StringUtils.trim(req.getParameter("password"));
Expand All @@ -95,7 +96,7 @@ public ModelAndView doPost(ModelAndView mav, HttpServletRequest req, HttpServlet

session.setAttribute("authNMsg", "authenticated");
session.setAttribute("userid", userid);

String target = (String) session.getAttribute("target");
if (target == null) {
res.sendRedirect("/admins/main");
Expand All @@ -105,41 +106,48 @@ public ModelAndView doPost(ModelAndView mav, HttpServletRequest req, HttpServlet
}
} else {
/* account lock count +1 */
User admin = userLoginHistory.get(userid);
if (admin == null) {
User newAdmin = new User();
newAdmin.setUserId(userid);
admin = userLoginHistory.putIfAbsent(userid, newAdmin);
if (userid != null) {
User admin = userLoginHistory.get(userid);
if (admin == null) {
admin = newAdmin;
User newAdmin = new User();
newAdmin.setUserId(userid);
admin = userLoginHistory.putIfAbsent(userid, newAdmin);
if (admin == null) {
admin = newAdmin;
}
}
admin.setLoginFailedCount(admin.getLoginFailedCount() + 1);
admin.setLastLoginFailedTime(new Date());
}
admin.setLoginFailedCount(admin.getLoginFailedCount() + 1);
admin.setLastLoginFailedTime(new Date());

session.setAttribute("authNMsg", "msg.authentication.fail");
return doGet(mav, req, res, locale);
}
return null;
}

protected boolean isAccountLocked(String userid) {
if (userid == null) {
return false;
}
User admin = userLoginHistory.get(userid);
return admin != null && admin.getLoginFailedCount() == accountLockCount
&& (new Date().getTime() - admin.getLastLoginFailedTime().getTime() < accountLockTime);
&& (new Date().getTime() - admin.getLastLoginFailedTime().getTime() < accountLockTime);
}

protected boolean authUser(String userId, String password) {
if (userId == null || password == null) {
return false;
}
try {
/* Perform a simple LDAP 'bind' authentication */
LdapQuery query = LdapQueryBuilder.query().where("uid").is(userId);
ldapTemplate.authenticate(query, password);
LdapQuery query = LdapQueryBuilder.query().where("uid").is(userId);
ldapTemplate.authenticate(query, password);
} catch (EmptyResultDataAccessException | AuthenticationException e) {
return false;
} catch (Exception e) {
log.error("Exception occurs: ", e);
} catch (Exception e) {
log.error("Exception occurs: ", e);
return false;
}
}
return true;
}
}
}
18 changes: 10 additions & 8 deletions src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/OpenRedirectController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -85,17 +85,19 @@ public ModelAndView doPost(ModelAndView mav, HttpServletRequest req, HttpServlet
}
} else {
/* account lock count +1 */
User admin = userLoginHistory.get(userid);
if (admin == null) {
User newAdmin = new User();
newAdmin.setUserId(userid);
admin = userLoginHistory.putIfAbsent(userid, newAdmin);
if (userid != null) {
User admin = userLoginHistory.get(userid);
if (admin == null) {
admin = newAdmin;
User newAdmin = new User();
newAdmin.setUserId(userid);
admin = userLoginHistory.putIfAbsent(userid, newAdmin);
if (admin == null) {
admin = newAdmin;
}
}
admin.setLoginFailedCount(admin.getLoginFailedCount() + 1);
admin.setLastLoginFailedTime(new Date());
}
admin.setLoginFailedCount(admin.getLoginFailedCount() + 1);
admin.setLastLoginFailedTime(new Date());

session.setAttribute("authNMsg", "msg.authentication.fail");
res.sendRedirect("/openredirect/login" + loginQueryString);
Expand Down
8 changes: 4 additions & 4 deletions src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/SQLInjectionController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,10 +45,10 @@ public ModelAndView process(@RequestParam(value = "name", required = false) Stri
} else {
mav.addObject("userList", users);
}
} catch (DataAccessException se) {
log.error("SQLException occurs: ", se);
mav.addObject("errmsg", msg.getMessage("msg.db.access.error.occur", null, locale));
}
} catch (DataAccessException se) {
log.error("DataAccessException occurs: ", se);
mav.addObject("errmsg", msg.getMessage("msg.db.access.error.occur", null, locale));
}
} else {
mav.addObject("errmsg", msg.getMessage("msg.warn.enter.name.and.passwd", null, locale));
}
Expand Down
24 changes: 13 additions & 11 deletions src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/VerboseErrorMessageController.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -77,17 +77,19 @@ public ModelAndView doPost(ModelAndView mav, HttpServletRequest req, HttpServlet
}
} else {
/* account lock count +1 */
User admin = userLoginHistory.get(userid);
if (admin == null) {
User newAdmin = new User();
newAdmin.setUserId(userid);
admin = userLoginHistory.putIfAbsent(userid, newAdmin);
if (admin == null) {
admin = newAdmin;
}
}
admin.setLoginFailedCount(admin.getLoginFailedCount() + 1);
admin.setLastLoginFailedTime(new Date());
if (userid != null) {
User admin = userLoginHistory.get(userid);
if (admin == null) {
User newAdmin = new User();
newAdmin.setUserId(userid);
admin = userLoginHistory.putIfAbsent(userid, newAdmin);
if (admin == null) {
admin = newAdmin;
}
}
admin.setLoginFailedCount(admin.getLoginFailedCount() + 1);
admin.setLastLoginFailedTime(new Date());
}

session.setAttribute("authNMsg", "msg.password.not.match");
return doGet(mav, req, res, locale);
Expand Down

0 comments on commit d685667

Please sign in to comment.