merge with default branch

scm-plugins/scm-hg-plugin/pom.xml

@@ -27,6 +27,7 @@
         </exclusion>
       </exclusions>
     </dependency>
+
   </dependencies>
 
   <build>

scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/HgEnvironment.java

@@ -38,6 +38,9 @@ package sonia.scm.repository;
 import com.google.inject.ProvisionException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import sonia.scm.security.AccessToken;
+import sonia.scm.security.CipherUtil;
+import sonia.scm.security.Xsrf;
 import sonia.scm.web.HgUtil;
 
 import javax.servlet.http.HttpServletRequest;
@@ -65,6 +68,8 @@ public final class HgEnvironment
 
   private static final String SCM_BEARER_TOKEN = "SCM_BEARER_TOKEN";
 
+  private static final String SCM_XSRF = "SCM_XSRF";
+
   //~--- constructors ---------------------------------------------------------
 
   /**
@@ -114,8 +119,9 @@ public final class HgEnvironment
     }
 
     try {
-      String credentials = hookManager.getCredentials();
-      environment.put(SCM_BEARER_TOKEN, credentials);
+      AccessToken accessToken = hookManager.getAccessToken();
+      environment.put(SCM_BEARER_TOKEN, CipherUtil.getInstance().encode(accessToken.compact()));
+      extractXsrfKey(environment, accessToken);
     } catch (ProvisionException e) {
       LOG.debug("could not create bearer token; looks like currently we are not in a request; probably you can ignore the following exception:", e);
     }
@@ -123,4 +129,8 @@ public final class HgEnvironment
     environment.put(ENV_URL, hookUrl);
     environment.put(ENV_CHALLENGE, hookManager.getChallenge());
   }
+
+  private static void extractXsrfKey(Map<String, String> environment, AccessToken accessToken) {
+    environment.put(SCM_XSRF, accessToken.<String>getCustom(Xsrf.TOKEN_KEY).orElse("-"));
+  }
 }

scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/HgHookManager.java

@@ -49,7 +49,6 @@ import sonia.scm.config.ScmConfigurationChangedEvent;
 import sonia.scm.net.ahc.AdvancedHttpClient;
 import sonia.scm.security.AccessToken;
 import sonia.scm.security.AccessTokenBuilderFactory;
-import sonia.scm.security.CipherUtil;
 import sonia.scm.util.HttpUtil;
 import sonia.scm.util.Util;
 
@@ -196,11 +195,9 @@ public class HgHookManager
     return this.challenge.equals(challenge);
   }
 
-  public String getCredentials()
+  public AccessToken getAccessToken()
   {
-    AccessToken accessToken = accessTokenBuilderFactory.create().build();
-
-    return CipherUtil.getInstance().encode(accessToken.compact());
+    return accessTokenBuilderFactory.create().build();
   }
 
   //~--- methods --------------------------------------------------------------
@@ -279,7 +276,7 @@ public class HgHookManager
     //J-
     return HttpUtil.getUriWithoutEndSeperator(
       MoreObjects.firstNonNull(
-        configuration.getBaseUrl(), 
+        configuration.getBaseUrl(),
         "http://localhost:8080/scm"
       )
     ).concat("/hook/hg/");

scm-plugins/scm-hg-plugin/src/main/resources/sonia/scm/python/scmhooks.py

@@ -41,6 +41,7 @@ import os, urllib, urllib2
 baseUrl = os.environ['SCM_URL']
 challenge = os.environ['SCM_CHALLENGE']
 token = os.environ['SCM_BEARER_TOKEN']
+xsrf = os.environ['SCM_XSRF']
 repositoryId = os.environ['SCM_REPOSITORY_ID']
 
 def printMessages(ui, msgs):
@@ -59,6 +60,7 @@ def callHookUrl(ui, repo, hooktype, node):
     proxy_handler = urllib2.ProxyHandler({})
     opener = urllib2.build_opener(proxy_handler)
     req = urllib2.Request(url, data)
+    req.add_header("X-XSRF-Token", xsrf)
     conn = opener.open(req)
     if 200 <= conn.code < 300:
       ui.debug( "scm-hook " + hooktype + " success with status code " + str(conn.code) + "\n" )
@@ -101,7 +103,7 @@ def preHook(ui, repo, hooktype, node=None, source=None, pending=None, **kwargs):
   # older mercurial versions
   if pending != None:
     pending()
-  
+
   # newer mercurial version
   # we have to make in-memory changes visible to external process
   # this does not happen automatically, because mercurial treat our hooks as internal hooks

scm-plugins/scm-hg-plugin/src/test/java/sonia/scm/repository/HgEnvironmentTest.java

@@ -0,0 +1,54 @@
+package sonia.scm.repository;
+
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import sonia.scm.security.AccessToken;
+import sonia.scm.security.Xsrf;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import static java.util.Optional.empty;
+import static java.util.Optional.of;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.entry;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class HgEnvironmentTest {
+
+  @Mock
+  HgRepositoryHandler handler;
+  @Mock
+  HgHookManager hookManager;
+
+  @Test
+  void shouldExtractXsrfTokenWhenSet() {
+    AccessToken accessToken = mock(AccessToken.class);
+    when(accessToken.compact()).thenReturn("");
+    when(accessToken.getCustom(Xsrf.TOKEN_KEY)).thenReturn(of("XSRF Token"));
+    when(hookManager.getAccessToken()).thenReturn(accessToken);
+
+    Map<String, String> environment = new HashMap<>();
+    HgEnvironment.prepareEnvironment(environment, handler, hookManager);
+
+    assertThat(environment).contains(entry("SCM_XSRF", "XSRF Token"));
+  }
+
+  @Test
+  void shouldIgnoreXsrfWhenNotSetButStillContainDummy() {
+    AccessToken accessToken = mock(AccessToken.class);
+    when(accessToken.compact()).thenReturn("");
+    when(accessToken.getCustom(Xsrf.TOKEN_KEY)).thenReturn(empty());
+    when(hookManager.getAccessToken()).thenReturn(accessToken);
+
+    Map<String, String> environment = new HashMap<>();
+    HgEnvironment.prepareEnvironment(environment, handler, hookManager);
+
+    assertThat(environment).containsKeys("SCM_XSRF");
+  }
+}

scm-plugins/scm-hg-plugin/src/test/java/sonia/scm/repository/HgTestUtil.java

@@ -38,6 +38,7 @@ package sonia.scm.repository;
 import org.junit.Assume;
 import sonia.scm.SCMContext;
 import sonia.scm.TempDirRepositoryLocationResolver;
+import sonia.scm.security.AccessToken;
 import sonia.scm.store.InMemoryConfigurationStoreFactory;
 
 import javax.servlet.http.HttpServletRequest;
@@ -107,7 +108,6 @@ public final class HgTestUtil
     RepositoryLocationResolver repositoryLocationResolver = new TempDirRepositoryLocationResolver(directory);
     HgRepositoryHandler handler =
       new HgRepositoryHandler(new InMemoryConfigurationStoreFactory(), new HgContextProvider(), repositoryLocationResolver, null, null);
-    Path repoDir = directory.toPath();
     handler.init(context);
 
     return handler;
@@ -128,7 +128,9 @@ public final class HgTestUtil
       "http://localhost:8081/scm/hook/hg/");
     when(hookManager.createUrl(any(HttpServletRequest.class))).thenReturn(
       "http://localhost:8081/scm/hook/hg/");
-    when(hookManager.getCredentials()).thenReturn("");
+    AccessToken accessToken = mock(AccessToken.class);
+    when(accessToken.compact()).thenReturn("");
+    when(hookManager.getAccessToken()).thenReturn(accessToken);
 
     return hookManager;
   }