From bb8a8e6d524af6b3da8d5b65cba35e07ed59bd27 Mon Sep 17 00:00:00 2001 From: Nikita Pal Date: Mon, 21 Sep 2026 13:37:28 +0530 Subject: [PATCH 1/2] fix: encode OpenShift group names in advanced authorization Group names with spaces (common for Active Directory) produced an unencoded Groups API path and failed with URISyntaxException when users opened the dashboard. Fixes https://issues.redhat.com/browse/CRW-13184 Signed-off-by: Nikita Pal Co-authored-by: Cursor --- .../OpenShiftAuthorizationCheckerImpl.java | 18 ++++++++-- .../OpenShiftAuthorizationCheckerTest.java | 36 +++++++++++++++++++ 2 files changed, 52 insertions(+), 2 deletions(-) diff --git a/infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerImpl.java b/infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerImpl.java index ac8816b4ec..356572982f 100644 --- a/infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerImpl.java +++ b/infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerImpl.java @@ -13,6 +13,7 @@ import static org.eclipse.che.commons.lang.StringUtils.strToSet; +import com.google.common.net.UrlEscapers; import io.fabric8.kubernetes.client.KubernetesClient; import io.fabric8.openshift.api.model.Group; import java.util.List; @@ -70,7 +71,7 @@ private boolean isAllowedUser(KubernetesClient client, String username) { } for (String groupName : allowGroups) { - Group group = client.resources(Group.class).withName(groupName).get(); + Group group = getGroup(client, groupName); if (group != null) { List users = group.getUsers(); if (users != null && users.contains(username)) { @@ -93,7 +94,7 @@ private boolean isDeniedUser(KubernetesClient client, String username) { } for (String groupName : denyGroups) { - Group group = client.resources(Group.class).withName(groupName).get(); + Group group = getGroup(client, groupName); if (group != null) { List users = group.getUsers(); if (users != null && users.contains(username)) { @@ -104,4 +105,17 @@ private boolean isDeniedUser(KubernetesClient client, String username) { return false; } + + /** + * Looks up an OpenShift Group by name. Group names are path-segment encoded so names containing + * spaces or other reserved URI characters (common for Active Directory groups) can be requested + * without triggering {@link java.net.URISyntaxException}. + */ + private static Group getGroup(KubernetesClient client, String groupName) { + return client.resources(Group.class).withName(encodeGroupName(groupName)).get(); + } + + static String encodeGroupName(String groupName) { + return UrlEscapers.urlPathSegmentEscaper().escape(groupName); + } } diff --git a/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java b/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java index 875c7cde6b..58ef4cdb9d 100644 --- a/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java +++ b/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java @@ -15,6 +15,8 @@ import io.fabric8.kubernetes.api.model.ObjectMetaBuilder; import io.fabric8.kubernetes.client.KubernetesClient; +import io.fabric8.kubernetes.client.dsl.MixedOperation; +import io.fabric8.kubernetes.client.dsl.Resource; import io.fabric8.kubernetes.client.server.mock.KubernetesMixedDispatcher; import io.fabric8.kubernetes.client.server.mock.KubernetesMockServer; import io.fabric8.mockwebserver.Context; @@ -143,4 +145,38 @@ public static Object[][] advancedAuthorizationData() { }, }; } + + @Test + public void encodeGroupNamePercentEncodesSpaces() { + Assert.assertEquals( + OpenShiftAuthorizationCheckerImpl.encodeGroupName("LD EIDP PTEC 3P40"), + "LD%20EIDP%20PTEC%203P40"); + Assert.assertEquals( + OpenShiftAuthorizationCheckerImpl.encodeGroupName("groupWithUser1"), "groupWithUser1"); + } + + @Test + @SuppressWarnings("unchecked") + public void shouldAuthorizeUserWhenAllowGroupNameContainsSpaces() + throws InfrastructureException { + Group groupWithSpaces = + new Group( + "v1", + "Group", + new ObjectMetaBuilder().withName("LD EIDP PTEC 3P40").build(), + List.of("user1")); + KubernetesClient mockClient = mock(KubernetesClient.class); + MixedOperation resources = mock(MixedOperation.class); + Resource resource = mock(Resource.class); + when(clientFactory.create()).thenReturn(mockClient); + when(mockClient.resources(Group.class)).thenReturn(resources); + when(resources.withName("LD%20EIDP%20PTEC%203P40")).thenReturn(resource); + when(resource.get()).thenReturn(groupWithSpaces); + + OpenShiftAuthorizationCheckerImpl authorizationChecker = + new OpenShiftAuthorizationCheckerImpl("", "LD EIDP PTEC 3P40", "", "", ",", clientFactory); + + Assert.assertTrue(authorizationChecker.isAuthorized(user1)); + Assert.assertFalse(authorizationChecker.isAuthorized(user2)); + } } From 281a879acde5970086e1c132b6e4613c16654162 Mon Sep 17 00:00:00 2001 From: Nikita Pal Date: Thu, 24 Sep 2026 10:30:38 +0530 Subject: [PATCH 2/2] fix: apply google-java-format to authorization changes --- .../authorization/OpenShiftAuthorizationCheckerTest.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java b/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java index 58ef4cdb9d..5a8406bbe2 100644 --- a/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java +++ b/infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/authorization/OpenShiftAuthorizationCheckerTest.java @@ -157,8 +157,7 @@ public void encodeGroupNamePercentEncodesSpaces() { @Test @SuppressWarnings("unchecked") - public void shouldAuthorizeUserWhenAllowGroupNameContainsSpaces() - throws InfrastructureException { + public void shouldAuthorizeUserWhenAllowGroupNameContainsSpaces() throws InfrastructureException { Group groupWithSpaces = new Group( "v1",