Merge branch 'main' into readonly-per-repository

Author: ikhoon

dependencies.toml

@@ -3,14 +3,14 @@
 #     If its classes are exposed in Javadoc, update offline links as well.
 #
 [versions]
-armeria = "1.39.0"
+armeria = "1.40.0"
 assertj = "3.27.7"
 awaitility = "4.3.0"
 bouncycastle = "1.84"
 caffeine = "3.2.4"
 checkstyle = "10.3.3"
 conscrypt = "2.5.2"
-controlplane = "1.0.52"
+controlplane = "1.0.53"
 # Ensure that we use the same ZooKeeper version as what Curator depends on.
 # See: https://github.com/apache/curator/blob/master/pom.xml
 #      (Switch to the right tag to find out the right version.)
@@ -19,19 +19,19 @@ curator = "5.9.0"
 cron-utils = "9.2.0"
 diffutils = "1.3.0"
 download = "5.7.0"
-dropwizard-metrics = "4.2.38"
+dropwizard-metrics = "4.2.39"
 eddsa = "0.3.0"
 findbugs = "3.0.2"
 freemarker = "2.3.34"
 futures-completable = "0.3.6"
-grpc-java = "1.81.0"
+grpc-java = "1.82.0"
 guava = "33.6.0-jre"
 guava-failureaccess = "1.0.1"
 hamcrest-library = "3.0"
 hibernate-validator6 = "6.2.5.Final"
 hibernate-validator8 = "8.0.3.Final"
 hibernate-validator9 = "9.1.0.Final"
-jackson = "2.21.3"
+jackson = "2.22.0"
 javassist = "3.31.0-GA"
 javax-annotation = "1.3.2"
 javax-inject = "1"
@@ -43,7 +43,7 @@ jetty-alpn-agent = "2.0.10"
 jgit6 = "6.10.1.202505221210-r"
 junit4 = "4.13.2"
 # junit6 requires java 17
-junit5 = "5.14.2"
+junit5 = "5.14.4"
 junit-pioneer = "2.3.0"
 jsch = "0.1.55"
 # Don't update `json-path` version
@@ -56,41 +56,41 @@ jmh-core = "1.37"
 jmh-gradle-plugin = "0.7.3"
 jxr = "0.2.1"
 kubernetes-client = "7.7.0"
-logback15 = "1.5.32"
-micrometer = "1.16.5"
-mina-sshd = "2.17.1"
+logback15 = "1.5.34"
+micrometer = "1.17.0"
+mina-sshd = "2.18.0"
 mockito = "5.23.0"
-nimbus-jose-jwt = "10.9"
+nimbus-jose-jwt = "10.9.1"
 nexus-publish-plugin = "2.0.0"
 node-gradle-plugin = "7.1.0"
 osdetector = "1.7.3"
 owasp = "1.4.0"
-proguard = "7.8.1"
-prometheus-metrics = "1.6.1"
-protobuf = "3.25.8"
-protobuf-gradle-plugin = "0.9.5"
+proguard = "7.9.1"
+prometheus-metrics = "1.8.0"
+protobuf = "3.25.9"
+protobuf-gradle-plugin = "0.10.0"
 quartz = "2.5.2"
 reflections = "0.9.11"
 rocksdb = "10.10.1.1"
-shadow-gradle-plugin = "8.3.9"
+shadow-gradle-plugin = "9.4.2"
 # Don't update `shiro` version
 shiro = "1.3.2"
-slf4j2 = "2.0.17"
+slf4j2 = "2.0.18"
 # Ensure that we use the same Snappy version as what Curator depends on.
 # See: https://github.com/apache/curator/blob/master/pom.xml
 snappy = "1.1.10.8"
 sphinx = "2.10.1"
 spring-boot2 = "2.7.18"
-spring-boot3 = "3.5.10"
-spring-boot4 = "4.0.6"
+spring-boot3 = "3.5.15"
+spring-boot4 = "4.1.0"
 spring-test-junit5 = "1.5.0"
 testcontainers = "2.0.5"
 thrift09 = { strictly = "0.9.3-1" }
 # Ensure that we use the same ZooKeeper version as what Curator depends on.
 # See: https://github.com/apache/curator/blob/master/pom.xml
 #      (Switch to the right tag to find out the right version.)
 zookeeper = "3.9.3"
-zstd = "1.5.7-8"
+zstd = "1.5.7-11"
 
 [boms]
 armeria = { module = "com.linecorp.armeria:armeria-bom", version.ref = "armeria" }

gradle.properties

@@ -1,5 +1,5 @@
 group=com.linecorp.centraldogma
-version=0.83.1-SNAPSHOT
+version=0.84.1-SNAPSHOT
 projectName=Central Dogma
 projectUrl=https://line.github.io/centraldogma/
 projectDescription=Highly-available version-controlled service configuration repository based on Git, ZooKeeper and HTTP/2

it/mirror/src/test/java/com/linecorp/centraldogma/it/mirror/git/ZoneAwareMirrorTest.java

@@ -184,6 +184,25 @@ void shouldWarnUnknownZoneForScheduledJob() throws Exception {
         final CentralDogmaRepository repo = client.forRepo(FOO_PROJ, Project.REPO_DOGMA);
         final String mirrorId = TEST_MIRROR_ID + "-unknown-zone";
         final String unknownZone = "unknown-zone";
+
+        // Create a valid SSH credential so that the mirror can be loaded and reach the zone validation.
+        // Otherwise, the git+ssh mirror fails to be constructed and is skipped before the zone is checked.
+        final BlockingWebClient webClient = WebClient.builder("http://127.0.0.1:" + serverPort)
+                                                     .auth(AuthToken.ofOAuth2(accessToken))
+                                                     .build()
+                                                     .blocking();
+        final CreateCredentialRequest credential =
+                getCreateCredentialRequest(FOO_PROJ, "bar-unknown-zone");
+        final ResponseEntity<PushResultDto> credentialResponse =
+                webClient.prepare()
+                         .post("/api/v1/projects/{proj}/repos/{repo}/credentials")
+                         .pathParam("proj", FOO_PROJ)
+                         .pathParam("repo", "bar-unknown-zone")
+                         .contentJson(credential)
+                         .asJson(PushResultDto.class)
+                         .execute();
+        assertThat(credentialResponse.status()).isEqualTo(HttpStatus.CREATED);
+
         final MirrorConfig mirrorConfig =
                 new MirrorConfig(mirrorId,
                                  true,
@@ -194,7 +213,7 @@ void shouldWarnUnknownZoneForScheduledJob() throws Exception {
                                  URI.create("git+ssh://github.com/line/centraldogma-authtest.git/#main"),
                                  null,
                                  null,
-                                 credentialName("foo", "bar-unknown-zone", "credential-id"),
+                                 credentialName(FOO_PROJ, "bar-unknown-zone", PRIVATE_KEY_FILE),
                                  unknownZone);
         final Change<JsonNode> change = Change.ofJsonUpsert(
                 "/repos/bar-unknown-zone/mirrors/" + mirrorId + ".json",

server-auth/shiro/src/main/java/com/linecorp/centraldogma/server/auth/shiro/realm/SearchFirstActiveDirectoryRealm.java

@@ -20,7 +20,6 @@
 import static java.util.Objects.requireNonNull;
 
 import java.time.Duration;
-import java.util.regex.Pattern;
 
 import javax.naming.AuthenticationException;
 import javax.naming.NamingEnumeration;
@@ -58,18 +57,16 @@
  */
 public class SearchFirstActiveDirectoryRealm extends ActiveDirectoryRealm {
 
-    private static final Pattern USERNAME_PLACEHOLDER = Pattern.compile("\\{0}");
+    private static final String USERNAME_PLACEHOLDER = "{0}";
     private static final String DEFAULT_SEARCH_FILTER = "cn={0}";
     private static final int DEFAULT_SEARCH_TIMEOUT_MILLIS = (int) Duration.ofSeconds(10).toMillis();
 
-    @Nullable
     private String searchFilter = DEFAULT_SEARCH_FILTER;
     private int searchTimeoutMillis = DEFAULT_SEARCH_TIMEOUT_MILLIS;
 
     /**
      * Returns a search filter string.
      */
-    @Nullable
     protected String getSearchFilter() {
         return searchFilter;
     }
@@ -78,7 +75,10 @@ protected String getSearchFilter() {
      * Sets a search filter string.
      */
     protected void setSearchFilter(String searchFilter) {
-        this.searchFilter = requireNonNull(searchFilter, "searchFilter");
+        requireNonNull(searchFilter, "searchFilter");
+        checkArgument(searchFilter.contains("{0}"),
+                      "searchFilter must contain '{0}' placeholder: %s", searchFilter);
+        this.searchFilter = searchFilter;
     }
 
     /**
@@ -157,11 +157,9 @@ protected String findUserDn(LdapContextFactory ldapContextFactory, String userna
             ctrl.setSearchScope(SearchControls.SUBTREE_SCOPE);
             ctrl.setTimeLimit(searchTimeoutMillis);
 
-            final String filter =
-                    searchFilter != null ? USERNAME_PLACEHOLDER.matcher(searchFilter)
-                                                               .replaceAll(username)
-                                         : username;
-            final NamingEnumeration<SearchResult> result = ctx.search(searchBase, filter, ctrl);
+            final String escaped = encodeLdapFilter(username);
+            final String filtered = searchFilter.replace(USERNAME_PLACEHOLDER, escaped);
+            final NamingEnumeration<SearchResult> result = ctx.search(searchBase, filtered, ctrl);
             try {
                 if (!result.hasMore()) {
                     return null;
@@ -175,6 +173,40 @@ protected String findUserDn(LdapContextFactory ldapContextFactory, String userna
         }
     }
 
+    /**
+     * Escapes special characters in the given value for use in an LDAP search filter,
+     * as specified in <a href="https://datatracker.ietf.org/doc/html/rfc4515#section-3">RFC 4515 §3</a>.
+     */
+    static String encodeLdapFilter(String value) {
+        if (value == null) {
+            return "";
+        }
+        final StringBuilder sb = new StringBuilder(value.length());
+        for (int i = 0; i < value.length(); i++) {
+            final char c = value.charAt(i);
+            switch (c) {
+                case '\\':
+                    sb.append("\\5c");
+                    break;
+                case '*':
+                    sb.append("\\2a");
+                    break;
+                case '(':
+                    sb.append("\\28");
+                    break;
+                case ')':
+                    sb.append("\\29");
+                    break;
+                case '\0':
+                    sb.append("\\00");
+                    break;
+                default:
+                    sb.append(c);
+            }
+        }
+        return sb.toString();
+    }
+
     private static UsernamePasswordToken ensureUsernamePasswordToken(AuthenticationToken token) {
         if (token instanceof UsernamePasswordToken) {
             return (UsernamePasswordToken) token;