Skip to content

Fix SUT password truncation when value contains # - #383

Open
NirBY wants to merge 5 commits into
Top-Q:masterfrom
NirBY:fix/sut-password-hash-truncation
Open

Fix SUT password truncation when value contains ##383
NirBY wants to merge 5 commits into
Top-Q:masterfrom
NirBY:fix/sut-password-hash-truncation

Conversation

@NirBY

@NirBY NirBY commented Aug 6, 2026

Copy link
Copy Markdown

Summary

  • SUT getValue incorrectly treated any value containing # as legacy Xerces [#text: ...] formatting and stripped the last character.
  • Added StringUtils.unwrapXercesTextNode that only unwraps when the value matches [#text: ...], preserving passwords like SXr0ng!ReaTxnly#2386.
  • Applied the same safe unwrap in SystemManagerImpl class/reference handling.

Test plan

  • Load a SUT element whose text contains # (e.g. password) and resolve ${sut:...}; confirm the full value is returned
  • Confirm a legacy-style [#text: com.example.Foo] value still unwraps to com.example.Foo
  • Smoke-run a scenario that reads SUT string properties with and without #

codex and others added 5 commits May 8, 2026 12:16
# Conflicts:
#	jsystem-core-projects/jsystemCore/pom.xml
Only unwrap legacy [#text: ...] node formatting so passwords and other values that contain # are preserved.

Co-authored-by: Cursor <cursoragent@cursor.com>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d462492ae6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread jsystem-parent/pom.xml
<groupId>org.jsystemtest</groupId>
<artifactId>jsystem-parent</artifactId>
<version>6.1.13-SNAPSHOT</version>
<version>6.1.12-SNAPSHOT</version>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep the project on the 6.1.13 development version

When this commit is applied on top of 678a08b, changing the parent and all child modules back to 6.1.12-SNAPSHOT makes subsequent builds and deployments publish under the previous development line rather than 6.1.13-SNAPSHOT. That can overwrite or consume stale 6.1.12 snapshot artifacts and is unrelated to the SUT parsing fix, so the existing 6.1.13 version should be preserved.

Useful? React with 👍 / 👎.

Comment on lines 234 to +235
AgentListTableModel(Vector<Object> model, Vector<String> columns) {
super(model, columns);
super();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Initialize the agents table with its supplied data

Whenever AgentsDialog.initDialog() is opened, this no-argument superclass call discards both the populated model and its columns. The resulting JTable has zero columns, and table.getColumnModel().getColumn(0) in the same initialization path immediately throws, so the Agents List dialog cannot open.

Useful? React with 👍 / 👎.

Comment on lines 135 to +136
AgentSelectTableModel(Vector<Object> model, Vector<String> columns) {
super(model, columns);
super();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Initialize the agent-selection table with its supplied data

Opening the Select Agents dialog now constructs an empty DefaultTableModel instead of using the discovered agents and three supplied columns. initDialog() subsequently accesses columns 0, 1, and 2, so it throws while opening; even without those accesses, getSelectedUrls() would always return an empty selection.

Useful? React with 👍 / 👎.

Comment on lines +39 to +41
final int responseCode = client.executeMethod(method);
handleResponseCode(method, responseCode);
return Integer.parseInt(method.getResponseBodyAsString());

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Release Difido HTTP connections after every request

During remote Difido reporting, this and every other request method now execute without a finally block calling method.releaseConnection(). Apache HttpClient keeps the connection associated with the method until it is released, so repeated test-detail and file requests leak/hold connections and can eventually stall reporting; error responses also leak because handleResponseCode() may throw.

Useful? React with 👍 / 👎.

dcipher.init(Cipher.DECRYPT_MODE, key);
// Decode base64 to get bytes
byte[] dec = new sun.misc.BASE64Decoder().decodeBuffer(str);
byte[] dec = Base64.getDecoder().decode(str);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve decoding of line-wrapped encrypted values

For existing encrypted values long enough to have been produced with line wrapping by the previous sun.misc.BASE64Encoder implementation, Base64.getDecoder() rejects the embedded CR/LF characters with IllegalArgumentException. This breaks decryption of previously persisted long passwords or secrets after upgrading; a MIME/whitespace-tolerant decoder is needed for backward compatibility.

Useful? React with 👍 / 👎.

Comment on lines 250 to +252
if("true".equals(JSystemProperties.getInstance().getPreferenceOrDefault(FrameworkOptions.SORT_ASSETS_TREE))){
Collections.sort(children);
Comparator comparator = Collections.reverseOrder();
Collections.sort(children,comparator);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Retain ascending asset-tree sorting

When SORT_ASSETS_TREE is enabled, replacing the former natural sort with Collections.reverseOrder() changes the assets tree from ascending to descending order because AssetNode.compareTo() compares names directly. The same reversal was added for test methods in TestCaseNode, so users requesting a sorted tree now see both levels in Z-to-A order.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants