#29784 OpenAPI server: basic authentication of a technical user accepts an empty password when the configured password is empty (e.g. unset environment variable)

enhancement

major

#29659

TL Views: Popover-Element mit beliebigem Inhalt an einer auslösenden Schaltfläche

#29713

TL Views: a user cannot hide a tile of a <dashboard> and add it again later

#29755

React-UI: Auswahl in Objektlisten (<object-list selection>) – Karten direkt anwählbar

#29756

React view table: Excel export (parity with classic TableComponent) and generic download view action

#29757

React view table: show row count (total / filtered / selected) like the classic table

#29776

TL Views: Einheitliches Drag & Drop für Tabellen, Baum-Tabellen, Bäume und Kanban-Boards mit mehreren Drop-Operationen, Drop-Positionen und Drag-Arten

#29782

Concept: Discover right for the model based security (filtered object sources, masked form fields)

#29785

OpenAPI server: request bodies are not validated against the declared schema

#29786

MUI: Avatar (TLAvatar) mit Material UI darstellen

#29787

React UI: Atomare Bausteine (Schaltflächen, Menü-Auslöser, Checkboxen, Eingabefelder, Chips, …) sehen überall gleich aus und lassen sich durch eine Komponentenbibliothek (z.B. Material UI) ersetzen

#29797

XML import into existing data: resolve IDs against existing objects, skip known subtrees, optional references, language and variables from the input

#29799

Form dependencies: derived fields do not follow edited values; Java script functions cannot report what they read to the ScriptTracer

#29811

TL Views: a <button> ignores the display mode of its command and always shows icon and label

#29812

TL Views: a table column declares its own comparator; enumeration columns follow the enumeration's order

#29814

TL Views: no supported way for a server-side background source (a bus listener) to push a channel value into a view; only <start-job> does it through internal API

#29815

TL Views table: no per-row CSS class (a row cannot be marked as changed, stale or own)

#29816

TL Views table: a <computed-column> cannot be hidden by default (shown only through the column chooser)

#29821

Design System wave 3b: table, tree, column selection and text read the design system package

#29825

Design System: column selection of the React table – grouping as one select, checkbox first, visible and hidden columns apart

#29829

TL Views: Beschreibbarer Kanal, der aus anderen Kanälen vorbelegt wird

#29830

Transaction monitor: Select a time range or a revision range instead of a single day.

#29836

Design System wave 4a: dialog, window, drawer, snackbar and notice bar read the design system package

#29840

Persistent object wrapper hierarchy: remove dead and duplicated code, move stateless behavior into interface defaults, replace class identity checks

#29849

Configuration: an encrypted property value that is not a valid encrypted value is silently "decrypted" to garbage instead of being rejected

#29854

PowerPoint-Präsentationen aus TL-Script erzeugen: deklarative Folienbausteine, Export in eine Firmenvorlage, Analyse von Vorlagen

#29858

Privileged TL-Script functions: authorize a configured script as a whole by a command group on a computed security object

#29859

React-Einfachauswahl: Die aktuell gewählte Option fehlt in der Optionsliste

#29866

Design System wave 4b: app shell, app bar, sidebar and bottom bar read the design system package

#29870

Design System wave 4c: layout containers read the design system package

#29907

Entwicklerkommandos und Skript-Rekorder außerhalb des Produktivmodus für alle Benutzer

minor

#28605

Möglichkeit zum Download eines aufgezeichneten Skripts

#28995

Spaltenfilter sollte Comparator der Spalte bei Sortierung der Optionen berücksichtigen

#29801

TL Views: the split of <adaptive-detail> is configurable (size, unit, min-size on <selector> and <detail>; drawer width as drawer-size)

#29805

TL Views: a <value-input> is declared like a model attribute (mandatory, annotations) - a mandatory enumeration input offers no "no value" option

defect

critical

#29784

OpenAPI server: basic authentication of a technical user accepts an empty password when the configured password is empty (e.g. unset environment variable)

#29823

HistoryCompaction: Löschen von REVISION/REVISION_XREF und Umschreiben der Revisionsbereiche in je einer Transaktion lässt die Datenbank explodieren

major

#29580

RowSourceObserver: a disposed observer is still notified and throws NPE (_scope null) from DerivedViewChannel and GlobalModelEventForwarder

#29783

TLScriptFunctions: a script function is bound to an arbitrary overload of the same name, including a private one

#29788

Configuration: the error for an undecodable encrypted property echoes the value (e.g. a plain-text password) into the log

#29789

tl:generate-java fails on the first build after a TopLogic version change: it neither resolves the engine web fragments nor reads the project's own model sources

#29791

TL Views table: the row activation button runs the activation command without selecting its row, so commands reading the selection channel see another row (wrong breadcrumb label)

#29792

TL Views: a closed dialog (and a left tile-stack frame) stays visible for 1 s unless the application ships its own exit animation - move the demo's animations into the engine

#29800

Model patch of an existing database fails when a class gains a generalization and overrides its attributes in the same change

#29806

WrapperGenerator: every top-level class of a module with a singleton extends StructuredElement (regression of #26716)

#29807

WrapperGenerator: classifier constants of two enumerations collide, the generated factory does not compile

#29808

TL Views: the <on-submit> command of a text or number <value-input> runs on Enter only, not when the field is left with a changed value

#29810

TL Views: the selection channel of a <tree> keeps an object deleted in another view, and scripts over it fail

#29813

TL Views: a <tree> does not react to a change of an object it does not display yet, so a node that becomes a child of a shown node does not appear

#29822

CompactHistoryTask: Wartungsfenster bleibt nach dem Lauf aktiv, Task-Ende geht im Neustart der Persistenzschicht verloren

#29824

TL Views table: "Standard wiederherstellen" in the column selection drops a declared group-by (and does not restore the declared sort)

#29837

TestCompileJSPs modifies the module's source webapp and breaks concurrently running scripted tests of the same module

#29838

ClusterManager: a database connection that failed in a cluster transaction is returned to the pool and keeps failing every refetch

#29846

Changing the type of a column with content fails on Oracle (ORA-01439) and of an indexed column on MS SQL Server

#29848

ReportQueueTest.testAddJob fails sporadically: the queue thread may process the job before the test checks that it is queued

#29871

TestZipper.testEmptyFolder fails depending on the order in which the file system lists a folder

#29878

React UI does not react behind a proxy that buffers or refuses the window event stream

minor

#29766

TL-Script add() wirft UnsupportedOperationException bei Multi-Referenz auf transientem Objekt

#29804

XML import: line and column of a message location are formatted with a thousands separator ("line 4,433")

#29809

TL Views: a <value-input type="tl.core:Binary"> shows the file name as text instead of the binary field (no upload, no download)

task

minor

#29790

Upgrade guide 7.11 to 8.0: add the Maven >= 3.8.9 requirement, state that 7.10.x applications can follow it, and point to it from the release notes

#29793

Developer docs: recipe for an application-defined primitive type whose display depends on the owning object (custom datatype, value class, type-level storage, label provider, input control)

defect

critical

#29784

OpenAPI server: basic authentication of a technical user accepts an empty password when the configured password is empty (e.g. unset environment variable)

OpenAPI

Scenario

An application protects an OpenAPI server operation with basic authentication of a technical user. The credentials come from aliases resolved from the environment, as is usual for deployments:

{{{#!xml <entry name="%API_USER%" value="${env:api_user:service}" /> <entry name="%API_PASSWD%" value="${env:api_passwd}" /> }}} {{{#!xml <basic-auth-server-secret domain="Api"> <login user="%API_USER%" password="%API_PASSWD%"/> </basic-auth-server-secret> }}}

In a deployment where api_passwd is not set, the application starts without an error, and the operation accepts requests with user service and an empty password.

Found while reviewing the TopLogic release notes application, whose CMS management API can rewrite the public website. Analysed in the source of tl-engine 8.0.0-alpha9 / master.

Analysis

DefaultAliasManager.replaceWithEnvironment resolves an unset ${env:...} without a default to the empty string and only logs an info message ("Using empty alias").
EncodingConfigurationValueProvider.getValue passes an empty value through unchanged; only a non-empty value is decrypted. So LoginCredentials#getPassword() is "". @Mandatory does not reject it, because the property is set.
BasicTechnicalAuthenticator.authenticateUser accepts a request whenever the sent LoginCredentials (user, password) is contained in the configured set (equality by value). The empty password sent by the client equals the empty configured password.

The silent fallback thus turns a missing secret into an open endpoint.

The API key authentication has the same defect: an api-key-server-secret whose api-key resolves to the empty string accepts a request that sends an empty key (empty header, query parameter or cookie), as technical user or as the account named by user-id.

Expected

A technical user with an empty password is a configuration error:

The server secret refuses an empty password, so the application fails to start or the operation is disabled with an error in the log.
At the latest, the authenticator never accepts an empty password.

Lösung

Basic-Authentifizierung (technischer Benutzer) und API-Key-Authentifizierung des OpenAPI-Servers ignorieren ein Secret mit leerem Passwort bzw. leerem API-Key und schreiben einen Fehler ins Log, der die Domain und den Benutzer bzw. Parameter nennt. Bleibt für die Domain kein gültiges Secret übrig, ist die Operation wie bei einem fehlenden Secret nicht authentifizierbar (Antwort 500, Fehlende-Secret-Meldung). Die Anwendung startet weiterhin.
Zusätzlich weisen beide Authentifizierungen einen Request mit leerem Passwort bzw. leerem API-Key immer ab, unabhängig von der Konfiguration.
Der OpenAPI-Client (Zugangsdaten für den Aufruf fremder Dienste) ist nicht betroffen und bleibt unverändert.