Details
-
Bug
-
Resolution: Fixed
-
Low
-
6.7.0, 6.10.12, 7.14.1, 7.6.8
-
Severity 3 - Minor
-
Description
Issue Summary
Each Bitbucket Data Center user can have a personal project, where they can create their own repositories. When a user is renamed, their personal project's details are updated to match and a ProjectModifiedEvent is raised. If that rename is processed as part of directory synchronization, however, there's no context user. That means if any event listeners try to access the project without using the SecurityService to escalate permissions, the listener fails.
Steps to Reproduce
- Create a given user in LDAP
- Create a fork, or other repository, in that user's personal project
- Rename the user in LDAP
- Perform a directory synchronization in Crowd
Expected Results
Event listeners all run without error.
Actual Results
The HashingRepositoryEventListener attempts to look up repositories in the modified project and fails because there's no context user.
An exception similar to the following is logged:
2021-07-20 22:38:57,955 ERROR [AtlassianEvent::thread-5] c.a.s.i.e.AsyncBatchingInvokersTransformer There was an exception thrown trying to dispatch event 'com.atlassian.bitbucket.event.project.ProjectModifiedEvent[source=com.atlassian.stash.internal.crowd.HibernateUserDao@cdd01f4]' for the invoker 'SingleParameterMethodListenerInvoker{method=public void com.atlassian.stash.internal.mirror.hash.HashingRepositoryEventListener.onProjectModified(com.atlassian.bitbucket.event.project.ProjectModifiedEvent), listener=com.atlassian.stash.internal.mirror.hash.HashingRepositoryEventListener@7dc1988b} (monitored)'2021-07-20 22:38:57,955 ERROR [AtlassianEvent::thread-5] c.a.s.i.e.AsyncBatchingInvokersTransformer There was an exception thrown trying to dispatch event 'com.atlassian.bitbucket.event.project.ProjectModifiedEvent[source=com.atlassian.stash.internal.crowd.HibernateUserDao@cdd01f4]' for the invoker 'SingleParameterMethodListenerInvoker{method=public void com.atlassian.stash.internal.mirror.hash.HashingRepositoryEventListener.onProjectModified(com.atlassian.bitbucket.event.project.ProjectModifiedEvent), listener=com.atlassian.stash.internal.mirror.hash.HashingRepositoryEventListener@7dc1988b} (monitored)'java.lang.RuntimeException: An Authentication object was not found in the SecurityContext. Listener: com.atlassian.stash.internal.mirror.hash.HashingRepositoryEventListener event: com.atlassian.bitbucket.event.project.ProjectModifiedEvent
at com.atlassian.event.internal.SingleParameterMethodListenerInvoker.invoke(SingleParameterMethodListenerInvoker.java:57)
at com.atlassian.diagnostics.internal.platform.event.EventSystemMonitor.invokeMonitored(EventSystemMonitor.java:109)
at com.atlassian.diagnostics.internal.platform.event.MonitoredListenerInvoker.invoke(MonitoredListenerInvoker.java:38)
at com.atlassian.stash.internal.event.AsyncBatchingInvokersTransformer$AsyncInvokerBatch.invoke(AsyncBatchingInvokersTransformer.java:111)
at com.atlassian.event.internal.AsynchronousAbleEventDispatcher.lambda$null$0(AsynchronousAbleEventDispatcher.java:37)
at com.atlassian.sal.core.executor.ThreadLocalDelegateRunnable.run(ThreadLocalDelegateRunnable.java:34)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at com.atlassian.stash.internal.event.EventThreadFactory.lambda$createThread$0(EventThreadFactory.java:27) at java.base/java.lang.Thread.run(Thread.java:829)
... 1 frame trimmed
Caused by: org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:379)
at com.atlassian.stash.internal.repository.DefaultRepositoryService.findByProjectKey(DefaultRepositoryService.java:361)
at com.atlassian.stash.internal.repository.DefaultRepositoryService.findByProjectKey(DefaultRepositoryService.java:349)
at jdk.internal.reflect.GeneratedMethodAccessor1443.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at jdk.internal.reflect.GeneratedMethodAccessor382.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at com.atlassian.stash.internal.mirror.hash.HashingRepositoryEventListener.lambda$onProjectModified$0(HashingRepositoryEventListener.java:54)
at com.atlassian.bitbucket.util.PagedIterable.iterator(PagedIterable.java:27)
at java.base/java.lang.Iterable.spliterator(Iterable.java:101)
at com.atlassian.bitbucket.util.MoreStreams.streamIterable(MoreStreams.java:86)
at com.atlassian.bitbucket.util.PageUtils.toStream(PageUtils.java:206)
at com.atlassian.stash.internal.mirror.hash.HashingRepositoryEventListener.onProjectModified(HashingRepositoryEventListener.java:54)
at jdk.internal.reflect.GeneratedMethodAccessor2512.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at com.atlassian.event.internal.SingleParameterMethodListenerInvoker.invoke(SingleParameterMethodListenerInvoker.java:42)
... 9 common frames omitted
Workaround
There are no workarounds for this issue. Unless third party apps are installed this issue can only affect Data Center instances, however. HashRepositoryEventListener does nothing on Server licenses.