auth: check username/password is empty string (#1402)

corgiboygsj · web-flow · commit 126d4017a092 · 2021-03-22T21:05:07.000+08:00
* auth: check username/password is empty string

* auth: modifiy userinfo verification on create/update
diff --git a/hugegraph-api/src/main/java/com/baidu/hugegraph/api/auth/UserAPI.java b/hugegraph-api/src/main/java/com/baidu/hugegraph/api/auth/UserAPI.java
@@ -34,6 +34,7 @@
 import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.Context;
 
+import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 
 import com.baidu.hugegraph.HugeGraph;
@@ -208,15 +209,15 @@ public HugeUser build() {
 
         @Override
         public void checkCreate(boolean isBatch) {
-            E.checkArgumentNotNull(this.name,
-                                   "The name of user can't be null");
-            E.checkArgumentNotNull(this.password,
-                                   "The password of user can't be null");
+            E.checkArgument(!StringUtils.isEmpty(this.name),
+                            "The name of user can't be null");
+            E.checkArgument(!StringUtils.isEmpty(this.password),
+                            "The password of user can't be null");
         }
 
         @Override
         public void checkUpdate() {
-            E.checkArgument(this.password != null ||
+            E.checkArgument(!StringUtils.isEmpty(this.password) ||
                             this.phone != null ||
                             this.email != null ||
                             this.avatar != null,
diff --git a/hugegraph-api/src/main/java/com/baidu/hugegraph/api/filter/AuthenticationFilter.java b/hugegraph-api/src/main/java/com/baidu/hugegraph/api/filter/AuthenticationFilter.java
@@ -37,6 +37,7 @@
 import javax.ws.rs.ext.Provider;
 import javax.xml.bind.DatatypeConverter;
 
+import org.apache.commons.lang3.StringUtils;
 import org.apache.tinkerpop.gremlin.server.auth.AuthenticationException;
 import org.glassfish.grizzly.http.server.Request;
 import org.glassfish.grizzly.utils.Charsets;
@@ -113,7 +114,11 @@ protected User authenticate(ContainerRequestContext context) {
 
         final String username = values[0];
         final String password = values[1];
-        assert username != null && password != null;
+
+        if (StringUtils.isEmpty(username) || StringUtils.isEmpty(password)) {
+            throw new BadRequestException(
+                      "Invalid syntax for username and password");
+        }
 
         // Validate the extracted credentials
         try {
