Skip to content

Commit c84e0a2

Browse files
authored
Escape SFTP passwords correctly (#6)
This commit changes how we handle the SFTP URI. Currently we don't escape anything, and that might lead to failures. What this commit does is use java.net.URI class and it's uri-escaping-properties to mitigate this possibility, and fix this issue.
1 parent 95bb572 commit c84e0a2

File tree

3 files changed

+17
-5
lines changed

3 files changed

+17
-5
lines changed

src/main/kotlin/br/com/guiabolso/sftptos3connector/internal/sftp/SftpFileStreamer.kt

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,16 @@ package br.com.guiabolso.sftptos3connector.internal.sftp
1818

1919
import br.com.guiabolso.sftptos3connector.config.SftpConfig
2020
import org.apache.commons.vfs2.VFS
21+
import java.net.URI
2122

2223
internal class SftpFileStreamer(sftpConfig: SftpConfig) {
23-
private val baseConnectionURI = sftpConfig.run { "sftp://$username:$password@$host:$port" }
24+
private val baseConnectionURI = sftpConfig.run { URI("sftp", "$username:$password", host, port, null, null, null) }
2425
private val fileSystemManager = VFS.getManager()
25-
26+
2627
fun getSftpFile(filePath: String): SftpFile {
2728
return getInputStreamWithContentLength(filePath)
2829
}
29-
30+
3031
private fun getInputStreamWithContentLength(filePath: String): SftpFile {
3132
val remoteFile = fileSystemManager.resolveFile("$baseConnectionURI/$filePath")
3233
return SftpFile(remoteFile.content.inputStream, remoteFile.content.size)

src/test/kotlin/br/com/guiabolso/sftptos3connector/internal/sftp/SftpFileStreamerTest.kt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,12 @@ class SftpFileStreamerTest : FunSpec({
4141
fileInfo.contentLength shouldBe sftpFileContent.encodeToByteArray().size.toLong()
4242
}
4343
}
44+
45+
test("Escape uri characters") {
46+
withConfiguredSftpServer("unsafe%%,,..&") { server ->
47+
val target = SftpFileStreamer(SftpConfig("localhost", server.port, sftpUsername, "unsafe%%,,..&"))
48+
49+
target.getSftpFile(sftpFilePath)
50+
}
51+
}
4452
})

src/test/kotlin/br/com/guiabolso/sftptos3connector/internal/sftp/SftpServer.kt

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,13 @@ val sftpFilePath = "path/to/file"
2525
val sftpFileContent = "FileContent\nMoreContent"
2626

2727

28-
fun withConfiguredSftpServer(block: (FakeSftpServer) -> Unit) = FakeSftpServer.withSftpServer { server ->
28+
fun withConfiguredSftpServer(
29+
password: String = sftpPassword,
30+
block: (FakeSftpServer) -> Unit
31+
) = FakeSftpServer.withSftpServer { server ->
2932
server.port = obtainRandomAvailablePort()
3033
server.putFile(sftpFilePath, sftpFileContent, Charsets.UTF_8)
31-
server.addUser(sftpUsername, sftpPassword)
34+
server.addUser(sftpUsername, password)
3235
block(server)
3336
}
3437

0 commit comments

Comments
 (0)