Changeset 18650 in josm for trunk/src/org/openstreetmap/josm/spi

Timestamp:

2023-02-08T18:31:58+01:00 (22 months ago)

Author:

taylor.smock

Message:

Fix #20768: Add OAuth 2.0 support

This also fixes #21607: authentication buttons are unavailable when credentials
are set.

Location:

trunk/src/org/openstreetmap/josm/spi/preferences

Files:

• AbstractPreferences.java (modified) (3 diffs)
• IPreferences.java (modified) (2 diffs)

trunk/src/org/openstreetmap/josm/spi/preferences/AbstractPreferences.java

@@ -2 +2 @@
 package org.openstreetmap.josm.spi.preferences;
 
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
+import java.util.Set;
 import java.util.TreeMap;
 import java.util.stream.Collectors;
 
+import org.openstreetmap.josm.io.DefaultProxySelector;
+import org.openstreetmap.josm.io.auth.CredentialsAgent;
+import org.openstreetmap.josm.io.auth.CredentialsManager;
 import org.openstreetmap.josm.tools.Logging;
 import org.openstreetmap.josm.tools.Utils;
@@ -17 +25 @@
  */
 public abstract class AbstractPreferences implements IPreferences {
+    /** The preference key for sensitive keys */
+    private static final String KEY_SENSITIVE_KEYS = "sensitive.keys";
+
+    /** A set of sensitive keys that should not be seen/distributed outside of specific callers (like a {@link CredentialsAgent}) */
+    private static final Set<String> SENSITIVE_KEYS = new HashSet<>();
 
     @Override
@@ -176 +189 @@
                 .collect(Collectors.toCollection(LinkedList::new));
     }
+
+    @Override
+    public void addSensitive(CredentialsAgent caller, String key) {
+        if (SENSITIVE_KEYS.isEmpty()) {
+            populateSensitiveKeys();
+        }
+        if (CredentialsManager.getInstance().getCredentialsAgentClass().equals(caller.getClass())) {
+            SENSITIVE_KEYS.add(key);
+            putList("sensitive.keys", SENSITIVE_KEYS.stream().sorted().collect(Collectors.toList()));
+        }
+    }
+
+    @Override
+    public Collection<String> getSensitive() {
+        if (SENSITIVE_KEYS.isEmpty()) {
+            populateSensitiveKeys();
+        }
+        return Collections.unmodifiableSet(SENSITIVE_KEYS);
+    }
+
+    @Override
+    public void removeSensitive(String key) {
+        if (KEY_SENSITIVE_KEYS.equals(key)) {
+            throw new IllegalArgumentException(KEY_SENSITIVE_KEYS + " cannot be removed from the sensitive key list.");
+        }
+        // Reset the key first -- avoid race conditions where a sensitive value might be visible if we start restricting access in the future.
+        put(key, null);
+        SENSITIVE_KEYS.remove(key);
+        putList(KEY_SENSITIVE_KEYS, SENSITIVE_KEYS.stream().sorted().collect(Collectors.toList()));
+    }
+
+    /**
+     * Populate the sensitive key set from preferences
+     */
+    private void populateSensitiveKeys() {
+        SENSITIVE_KEYS.addAll(getList(KEY_SENSITIVE_KEYS, Arrays.asList("sensitive.keys", "osm-server.username", "osm-server.password",
+                DefaultProxySelector.PROXY_USER, DefaultProxySelector.PROXY_PASS,
+                "oauth.access-token.key", "oauth.access-token.secret")));
+    }
 }

trunk/src/org/openstreetmap/josm/spi/preferences/IPreferences.java

@@ -2 +2 @@
 package org.openstreetmap.josm.spi.preferences;
 
+import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+
+import org.openstreetmap.josm.io.auth.CredentialsAgent;
 
 /**
@@ -240 +243 @@
      */
     Set<String> getKeySet();
+
+    /**
+     * Add sensitive keys
+     * @param caller The calling agent
+     * @param key The key that may contain sensitive information
+     * @since 18650
+     */
+    void addSensitive(CredentialsAgent caller, String key);
+
+    /**
+     * Get sensitive keys
+     * @return The sensitive keys
+     * @since 18650
+     */
+    Collection<String> getSensitive();
+
+    /**
+     * Remove sensitive keys. This removes the key from the sensitive list <i>and</i>
+     * removes the stored preference value.
+     * @param key The key to remove
+     * @since 18650
+     */
+    void removeSensitive(String key);
 }