diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a53d3eca4..de3e6dfa99 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## TBD + +### Bug fixes + +* Prevent potential SHA-1 hash mismatch in Bugsnag-Integrity header for session requests + [#1043](https://github.com/bugsnag/bugsnag-android/pull/1043) + ## 5.3.1 (2020-12-09) ### Bug fixes diff --git a/bugsnag-android-core/src/main/java/com/bugsnag/android/Session.java b/bugsnag-android-core/src/main/java/com/bugsnag/android/Session.java index bd11d3b8e1..2211b4636d 100644 --- a/bugsnag-android-core/src/main/java/com/bugsnag/android/Session.java +++ b/bugsnag-android-core/src/main/java/com/bugsnag/android/Session.java @@ -5,6 +5,7 @@ import java.io.File; import java.io.IOException; +import java.util.ArrayList; import java.util.Date; import java.util.concurrent.atomic.AtomicBoolean; import java.util.concurrent.atomic.AtomicInteger; @@ -41,13 +42,11 @@ static Session copySession(Session session) { Session(String id, Date startedAt, User user, boolean autoCaptured, Notifier notifier, Logger logger) { + this(null, notifier, logger); this.id = id; this.startedAt = new Date(startedAt.getTime()); this.user = user; - this.logger = logger; this.autoCaptured.set(autoCaptured); - this.file = null; - this.notifier = notifier; } Session(String id, Date startedAt, User user, int unhandledCount, int handledCount, @@ -61,7 +60,9 @@ static Session copySession(Session session) { Session(File file, Notifier notifier, Logger logger) { this.file = file; this.logger = logger; - this.notifier = notifier; + Notifier copy = new Notifier(notifier.getName(), notifier.getVersion(), notifier.getUrl()); + copy.setDependencies(new ArrayList<>(notifier.getDependencies())); + this.notifier = copy; } private void logNull(String property) { @@ -189,6 +190,10 @@ boolean isV2Payload() { return file != null && file.getName().endsWith("_v2.json"); } + Notifier getNotifier() { + return notifier; + } + @Override public void toStream(@NonNull JsonStream writer) throws IOException { if (file != null) { diff --git a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionSerializationTest.kt b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionSerializationTest.kt index 579bdb225b..00a221d60a 100644 --- a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionSerializationTest.kt +++ b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionSerializationTest.kt @@ -13,17 +13,14 @@ import java.util.Date internal class SessionSerializationTest { companion object { - private val notifier = Notifier() + private val notifier = Notifier("AndroidBugsnagNotifier", "9.9.9", "https://bugsnag.com") @JvmStatic @Parameters fun testCases(): Collection> { val session = Session("123", Date(0), User(null, null, null), 1, 0, notifier, NoopLogger) - notifier.version = "9.9.9" - notifier.name = "AndroidBugsnagNotifier" - notifier.url = "https://bugsnag.com" - session.setApp(generateApp()) - session.setDevice(generateDevice()) + session.app = generateApp() + session.device = generateDevice() return generateSerializationTestCases("session", session) } } diff --git a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTest.kt b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTest.kt index bdda3f2e4c..0f674f1c28 100644 --- a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTest.kt +++ b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTest.kt @@ -4,6 +4,7 @@ import org.junit.Assert.assertEquals import org.junit.Assert.assertFalse import org.junit.Assert.assertNotEquals import org.junit.Assert.assertNotNull +import org.junit.Assert.assertNotSame import org.junit.Assert.assertNull import org.junit.Assert.assertTrue import org.junit.Test @@ -96,6 +97,21 @@ class SessionTest { ).isV2Payload) } + @Test + fun testCloneNotifier() { + val original = Notifier() + val dep = Notifier("bugsnag-cobol") + original.dependencies = listOf(dep) + val payload = Session(null, original, NoopLogger) + val copy = payload.notifier + assertNotSame(original, copy) + assertNotSame(original.dependencies, copy.dependencies) + assertEquals(original.dependencies, copy.dependencies) + assertEquals(original.name, copy.name) + assertEquals(original.url, copy.url) + assertEquals(original.version, copy.version) + } + private fun validateSessionCopied(copy: Session) { with(session) { assertEquals(id, copy.id) diff --git a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerPauseResumeTest.kt b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerPauseResumeTest.kt index a084b6c40d..7291b8e6e1 100644 --- a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerPauseResumeTest.kt +++ b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerPauseResumeTest.kt @@ -48,6 +48,7 @@ internal class SessionTrackerPauseResumeTest { @Before fun setUp() { + `when`(client.getNotifier()).thenReturn(Notifier()) `when`(client.getAppContext()).thenReturn(context) `when`(client.getAppDataCollector()).thenReturn(appDataCollector) `when`(appDataCollector.generateApp()).thenReturn(app) diff --git a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerTest.java b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerTest.java index 476878bc76..8369527d04 100644 --- a/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerTest.java +++ b/bugsnag-android-core/src/test/java/com/bugsnag/android/SessionTrackerTest.java @@ -55,6 +55,7 @@ public class SessionTrackerTest { */ @Before public void setUp() { + when(client.getNotifier()).thenReturn(new Notifier()); when(client.getAppContext()).thenReturn(context); when(client.getAppDataCollector()).thenReturn(appDataCollector); when(appDataCollector.generateApp()).thenReturn(app);