Always encrypt password (#2085)

First, we make "encryptPassword" in the PasswordService
idempotent, so that the method will not change the password
when the method is called with an already encrypted string.
Then, in the user manager, we will always call this method
to encrypt the password, if this is not already the case.

Co-authored-by: Eduard Heimbuch <eduard.heimbuch@cloudogu.com>

scm-webapp/src/test/java/sonia/scm/lifecycle/modules/IdempotentPasswordServiceTest.java

@@ -0,0 +1,54 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.lifecycle.modules;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.lifecycle.modules.ScmSecurityModule.IdempotentPasswordService;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@ExtendWith(MockitoExtension.class)
+class IdempotentPasswordServiceTest {
+
+  @Test
+  void shouldEncryptCleartextPassword() {
+    IdempotentPasswordService passwordService = new IdempotentPasswordService();
+
+    String encryptedPassword = passwordService.encryptPassword("some simple password");
+
+    assertThat(encryptedPassword).startsWith("$shiro1$");
+  }
+
+  @Test
+  void shouldKeepAlreadyEncryptedPassword() {
+    IdempotentPasswordService passwordService = new IdempotentPasswordService();
+
+    String encryptedPassword = passwordService.encryptPassword("$shiro1$SHA-512$8192$XHkPE4rU53P/TsZNrAYdSw==$k5OehxvFr4C8rNk6pLYwtX9g5qbKKcsjFOwd0l29X3s=");
+
+    assertThat(encryptedPassword).isEqualTo("$shiro1$SHA-512$8192$XHkPE4rU53P/TsZNrAYdSw==$k5OehxvFr4C8rNk6pLYwtX9g5qbKKcsjFOwd0l29X3s=");
+  }
+}

scm-webapp/src/test/java/sonia/scm/user/DefaultUserManagerTest.java

@@ -26,6 +26,7 @@ package sonia.scm.user;
 
 import com.github.sdorra.shiro.ShiroRule;
 import com.github.sdorra.shiro.SubjectAware;
+import org.apache.shiro.authc.credential.PasswordService;
 import org.assertj.core.api.Assertions;
 import org.junit.Before;
 import org.junit.Rule;
@@ -35,6 +36,9 @@ import sonia.scm.NotFoundException;
 import sonia.scm.store.JAXBConfigurationStoreFactory;
 import sonia.scm.user.xml.XmlUserDAO;
 
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
@@ -52,52 +56,54 @@ public class DefaultUserManagerTest extends UserManagerTestBase {
   @Rule
   public ShiroRule shiro = new ShiroRule();
 
-  private UserDAO userDAO;
+  private final UserDAO userDAO = mock(UserDAO.class);
+  private final ArgumentCaptor<User> userCaptor = ArgumentCaptor.forClass(User.class);
+  private final PasswordService passwordService = mock(PasswordService.class);
+
+  private UserManager userManager;
 
-  /**
-   * Method description
-   *
-   * @return
-   */
   @Override
   public UserManager createManager() {
-    return new DefaultUserManager(createXmlUserDAO());
+    return new DefaultUserManager(passwordService, createXmlUserDAO());
   }
 
   @Before
-  public void initDao() {
+  public void initMocks() {
     User trillian = UserTestData.createTrillian();
     trillian.setPassword("oldEncrypted");
 
-    userDAO = mock(UserDAO.class);
     when(userDAO.getType()).thenReturn("xml");
     when(userDAO.get("trillian")).thenReturn(trillian);
+    doNothing().when(userDAO).modify(userCaptor.capture());
+
+    when(passwordService.encryptPassword(anyString())).thenAnswer(invocation -> invocation.getArgument(0));
+
+    userManager = new DefaultUserManager(passwordService, userDAO);
   }
 
   @Test(expected = InvalidPasswordException.class)
   public void shouldFailChangePasswordForWrongOldPassword() {
-    UserManager userManager = new DefaultUserManager(userDAO);
-
     userManager.changePasswordForLoggedInUser("wrongPassword", "$shiro1$secret");
   }
 
   @Test
   public void shouldSucceedChangePassword() {
-    ArgumentCaptor<User> userCaptor = ArgumentCaptor.forClass(User.class);
-
-    doNothing().when(userDAO).modify(userCaptor.capture());
-
-    UserManager userManager = new DefaultUserManager(userDAO);
-
     userManager.changePasswordForLoggedInUser("oldEncrypted", "newEncrypted");
 
     Assertions.assertThat(userCaptor.getValue().getPassword()).isEqualTo("newEncrypted");
   }
 
+  @Test
+  public void shouldEncryptChangedPassword() {
+    when(passwordService.encryptPassword("newPassword")).thenReturn("newEncrypted");
+
+    userManager.changePasswordForLoggedInUser("oldEncrypted", "newPassword");
+
+    Assertions.assertThat(userCaptor.getValue().getPassword()).isEqualTo("newEncrypted");
+  }
+
   @Test(expected = NotFoundException.class)
   public void shouldFailOverwritePasswordForMissingUser() {
-    UserManager userManager = new DefaultUserManager(userDAO);
-
     userManager.overwritePassword("notExisting", "---");
   }
 
@@ -106,25 +112,53 @@ public class DefaultUserManagerTest extends UserManagerTestBase {
     User trillian = new User("trillian");
     trillian.setExternal(true);
     when(userDAO.get("trillian")).thenReturn(trillian);
-    UserManager userManager = new DefaultUserManager(userDAO);
 
     userManager.overwritePassword("trillian", "---");
   }
 
   @Test
   public void shouldSucceedOverwritePassword() {
-    ArgumentCaptor<User> userCaptor = ArgumentCaptor.forClass(User.class);
-
-    doNothing().when(userDAO).modify(userCaptor.capture());
-
-    UserManager userManager = new DefaultUserManager(userDAO);
-
     userManager.overwritePassword("trillian", "newEncrypted");
 
     Assertions.assertThat(userCaptor.getValue().getPassword()).isEqualTo("newEncrypted");
   }
 
-  //~--- methods --------------------------------------------------------------
+  @Test
+  public void shouldEncryptOverwrittenPassword() {
+    when(passwordService.encryptPassword("newPassword")).thenReturn("newEncrypted");
+
+    userManager.overwritePassword("trillian", "newPassword");
+
+    Assertions.assertThat(userCaptor.getValue().getPassword()).isEqualTo("newEncrypted");
+  }
+
+  @Test
+  public void shouldEncryptPasswordOnModify() {
+    User zaphod = UserTestData.createZaphod();
+    when(passwordService.encryptPassword("password")).thenReturn("encrypted");
+
+    manager.create(zaphod);
+    zaphod.setPassword("password");
+    manager.modify(zaphod);
+
+    User otherUser = manager.get("zaphod");
+
+    assertNotNull(otherUser);
+    assertEquals("encrypted" , otherUser.getPassword());
+  }
+
+  @Test
+  public void shouldEncryptPasswordOnCreate() {
+    User zaphod = UserTestData.createZaphod();
+    zaphod.setPassword("password");
+    when(passwordService.encryptPassword("password")).thenReturn("encrypted");
+
+    manager.create(zaphod);
+
+    User otherUser = manager.get("zaphod");
+
+    assertEquals("encrypted", otherUser.getPassword());
+  }
 
   private XmlUserDAO createXmlUserDAO() {
     return new XmlUserDAO(new JAXBConfigurationStoreFactory(contextProvider, locationResolver, null));