Bamboo groups API error, if group name contain quotes (&quote; , %22 , " )
Asked by Joshua Greenman:

Hi

I have external Active Directory integration with groups that contain quotes in their name (example: che"ck), and since our last upgrade from version 6.10.2 to 8.0.0 we are having trouble to edit plan permission or view group details/members because those requests use the **/rest/api/latest/admin/groups/{name : (.+)?}/more-members?filter**endpoint that return http error code 400 - bad request.

i tried different tomcat versions (from tomcat 8.5.X to 9.0.X) with no success

i also tried empty tomcat application locally and checked <http://localhost:8085/che>"ck endpoint that returned http error 404 not found, so i dont think its tomcat issue

i also tried the confluence API (7.13.0) with the same groups with no problem at all.

Any suggestions?


Answers:
author: Shay
body: We found in our AD that (groups) SamAccountName values are missing single/double quotes.  
So, we decided to switch "Group_Name" from AD CN to AD samAccountName in Bamboo CWD_GROUP table.  
In addition, we tried to preserve CWD_GROUP.id in order to maintain existing permissions and prevent the creation of new groups.  
We did the following steps:  
1. We synced the samAccountName from AD to CWD_Group.Description.  
2. We took a DB backup and created 3 temp tables from the below:  
a. CWD_GROUP --\> CWD_GROUP_TMP  
b. CWD_MEMBERSHIP --\> CWD_MEMBERSHIP_TMP  
c. ACL_ENTRY --\> ACL_ENTRY_TMP  
3. We switched between CWD_GROUP.group_name (also lower_group_name) and CWD_GROUP.description (AD.SamAccounName).  
4. We updated cwd_membership.parent_name (and lower_parent_name) from the "new" CWD_GROUP.Group_Name.  
5. We found that we also need to update cwd_membership.child_name (and lower_child_name) when the membership_type is "group_group".  
6. We updated ACL_ENTRY.SID to the "new" Group_Names.  
7. We edited the relevant directory (under "User Directory" --\>"Group Schema Setting") and changed the map of "Group Name Attribute" from CN to SamAccountName and ran Full Sync.  
Btw, the auto refresh of this page doesn't work.  
The steps above seem to solve the problem.  
But now when we are clicking on the group_name under Administration --\> Groups, the value of Group_Name (SamAccountName) is obtained which is less clear than its display name (CN).  
Therefore, in future versions consider presenting the group description (in our case - cn) in addition to the Group_Name.  
Thanks in advance,  
Shay


author: Eduardo Alvarenga
body: Hello [@Joshua Greenman](/t5/user/viewprofilepage/user-id/2133622)

Can you share the full error message so we can understand it better?

Regards,

Eduardo Alvarenga  
Atlassian Support APAC

comments: author: Shay
body: Hello [Eduardo,](https://community.atlassian.com/t5/user/viewprofilepage/user-id/4365410)

The same error does not occur for users who have quotes in their name.

Looks like you're not encoding the group names.

In addition, when we try to remove those groups from plan permissions, we encounter the same error.

Thanks,

Shay


author: Joshua Greenman
body: hi [@Eduardo Alvarenga](/t5/user/viewprofilepage/user-id/4365410)

i tried to reproduce the problem with the latest bamboo version with bamboo official docker image but the result are the same.

*** ** * ** ***

![Screenshot.png](https://community.atlassian.com/t5/image/serverpage/image-id/195701iB655B53DBE74C9FB/image-size/large?v=v2&px=999 "Screenshot.png")

![Screenshot-podman.png](https://community.atlassian.com/t5/image/serverpage/image-id/195702i4CFC7C03F614CB44/image-size/large?v=v2&px=999 "Screenshot-podman.png")

*** ** * ** ***

Joshua


author: Eduardo Alvarenga
body: Hello [@Joshua Greenman](/t5/user/viewprofilepage/user-id/2133622)

This sounds like a good use for the STRICT_QUOTE_ESCAPING property.

That setting was deprecated on Tomcat 8. Instead, you need to add something like this to your **\<bamboo-install\>/conf/web.xml** under servlet class **org.apache.jasper.servlet.JspServlet**:

```
<init-param>
  <param-name>strictQuoteEscaping</param-name>
  <param-value>false</param-value>
</init-param>
```

Regards,

Eduardo Alvarenga  
Atlassian Support APAC


author: Joshua Greenman
body: Hello [@Eduardo Alvarenga](/t5/user/viewprofilepage/user-id/4365410)

Thank you for answer me unfortunately it didn't help

*** ** * ** ***

![screenshot.png](https://community.atlassian.com/t5/image/serverpage/image-id/195805iC5F4EAB90DFC4DF3/image-size/large?v=v2&px=999 "screenshot.png")


author: Eduardo Alvarenga
body: Hello [@Joshua Greenman](/t5/user/viewprofilepage/user-id/2133622)

Apologies for the unworking configuration. The following characters are considered "XSS_RELATED_CHARACTERS" and are banned from being used by requests.

```
[\"'<>\\\\]
```

I cannot explain at this stage how that worked on older versions of Bamboo. The source code relates to that protection since 2015. Maybe a JDK x Tomcat combination in an older release that got badly implemented.

Please refrain from using such characters on groups and usernames.

Kind regards,

Eduardo Alvarenga  
Atlassian Support APAC


author: Shay
body: Hello @[Eduardo,](https://community.atlassian.com/t5/user/viewprofilepage/user-id/4365410)

The same error does not occur for users who have quotes in their name.

Even when you click on Groups in the side menu and then type quotes in the search bar, you get a list of all the groups that have quotes in their name.

Groups---\> Search---\> "

[https://bamboo_url/rest/api/latest/admin/groups?filter=%22\&limit=100\&start=100\&_=xxxxxx](https://bamboo_url/rest/api/latest/admin/groups?filter=%22&limit=100&start=100&_=xxxxxx)

Request Method: Get

Status Code: 200

Can you please check how the following function is different and why the following URL does not work compared to the others above?

**/rest/api/latest/admin/groups/{name : (.+)?}/more-members?filter**

In addition, when we try to remove those groups from plan permissions, we encounter the same error (Status Code: 400).

Can you guide us how to remove these problematic groups from plan permissions, directly from Oracle DB?

Thanks,

Shay


author: Eduardo Alvarenga
body: Newer versions of Bamboo won't allow users with quotes to be created. You can explore the "acl_entry" table in the database to remove the access lists.

E.g. To find the ACLs of the **ABC-DFG** plan run the following SQL:

```
SELECT b.build_id,
       b.full_key,
       aoi.id,
       ae.*
FROM   build b
JOIN   acl_object_identity aoi
  ON   b.build_id = aoi.object_id_identity
JOIN   acl_entry ae
  ON   ae.acl_object_identity = aoi.id
WHERE  b.full_key = 'ABC-DFG'
```

For more complete queries please check the following KB:

* [How to retrieve user and group access mappings / permissions from the Bamboo database](https://confluence.atlassian.com/bamkb/how-to-retrieve-user-and-group-access-mappings-permissions-from-the-bamboo-database-859516551.html)

It is highly advised to [open a Support case](https://support.atlassian.com/contact) with Atlassian in case you have more issues with your Bamboo instance. Please do not modify the database directly as it may break things. Have a full backup.

Regards,

Eduardo Alvarenga  
Atlassian Support APAC


author: Shay
body: Hello [@Eduardo Alvarenga](/t5/user/viewprofilepage/user-id/4365410)  
Thanks a lot for your answer.  
+ [@Joshua Greenman](/t5/user/viewprofilepage/user-id/2133622)  
We found in our AD that (groups) SamAccountName values are missing single/double quotes.  
So, we decided to switch "Group_Name" from AD CN to AD samAccountName in Bamboo CWD_GROUP table.  
In addition, we tried to preserve CWD_GROUP.id in order to maintain existing permissions and prevent the creation of new groups.  
We did the following steps:  
1. We synced the samAccountName from AD to CWD_Group.Description.  
2. We took a DB backup and created 3 temp tables from the below:  
a. CWD_GROUP --\> CWD_GROUP_TMP  
b. CWD_MEMBERSHIP --\> CWD_MEMBERSHIP_TMP  
c. ACL_ENTRY --\> ACL_ENTRY_TMP  
3. We switched between CWD_GROUP.group_name (also lower_group_name) and CWD_GROUP.description (AD.SamAccounName).  
4. We updated cwd_membership.parent_name (and lower_parent_name) from the "new" CWD_GROUP.Group_Name.  
5. We found that we also need to update cwd_membership.child_name (and lower_child_name) when the membership_type is "group_group".  
6. We updated ACL_ENTRY.SID to the "new" Group_Names.  
7. We edited the relevant directory (under "User Directory" --\>"Group Schema Setting") and changed the map of "Group Name Attribute" from CN to SamAccountName and ran Full Sync.  
Btw, the auto refresh of this page doesn't work.  
The steps above seem to solve the problem.  
But now when we are clicking on the group_name under Administration --\> Groups, the value of Group_Name (SamAccountName) is obtained which is less clear than its display name (CN).  
Therefore, in future versions consider presenting the group description (in our case - cn) in addition to the Group_Name.  
Thanks in advance,  
Shay