Skip to content

Fail correctly when connecting to a server with an unknown server identifier #542

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Oct 26, 2018

Conversation

technige
Copy link
Contributor

@technige technige commented Oct 23, 2018

While we currently parse the "server" string returned in the INIT metadata to extract the server version, no logic existed to validate the product part of that string. Indeed, an unexpected product name would have caused the internal regex to fail and an unhelpful error would surface. This PR raises a new UntrustedServerException in the case that the product string does not identify Neo4j.

@technige technige changed the title [1.7.1] Block untrusted servers Fail correctly when connecting to a server with an unknown server identifier Oct 23, 2018
@@ -71,11 +72,25 @@ public void onRecord( Value[] fields )
throw new UnsupportedOperationException();
}

private static ServerVersion extractServerVersion( Map<String,Value> metadata )
private static ServerVersion extractServerVersion( Map<String,Value> metadata ) throws UntrustedServerException
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

throws can be removed because UntrustedServerException is a runtime exception

}
else
{
throw new UntrustedServerException( "Server does not identify as a genuine Neo4j instance" );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice to include the received product string in the error message


private static final String NEO4J_IN_DEV_VERSION_STRING = "Neo4j/dev";
private static final Pattern PATTERN =
Pattern.compile( "(Neo4j/)?(\\d+)\\.(\\d+)(?:\\.)?(\\d*)(\\.|-|\\+)?([0-9A-Za-z-.]*)?" );
Pattern.compile( "([^/]*)/(\\d+)\\.(\\d+)(?:\\.)?(\\d*)(\\.|-|\\+)?([0-9A-Za-z-.]*)?" );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will match strings like "/3.5.0" where the product part is absent. It is okay?

@@ -141,6 +142,10 @@ public boolean lessThanOrEqual(ServerVersion other)

private int compareTo( ServerVersion o )
{
if ( !product.equals( o.product ) )
{
throw new IllegalArgumentException("Comparing different products");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice to include product names in the error message

public static final ServerVersion v3_1_0 = new ServerVersion( 3, 1, 0 );
public static final ServerVersion v3_0_0 = new ServerVersion( 3, 0, 0 );
public static final ServerVersion vInDev = new ServerVersion( Integer.MAX_VALUE, Integer.MAX_VALUE, Integer.MAX_VALUE );
public static final ServerVersion v3_5_0 = new ServerVersion( "Neo4j", 3, 5, 0 );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Constant for string "Neo4j" would be nice

@lutovich lutovich force-pushed the 1.7-block-untrusted-servers branch from 9ebba3d to 1f1898e Compare October 26, 2018 11:12
@lutovich lutovich merged commit 7de97f4 into 1.7 Oct 26, 2018
@lutovich lutovich deleted the 1.7-block-untrusted-servers branch October 26, 2018 13:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants