From 2321fe8eb470bb9c297ab13e24d9e5478a33b651 Mon Sep 17 00:00:00 2001
From: Scott Theleman <synqotik@users.noreply.github.com>
Date: Thu, 13 Aug 2026 15:30:36 -0400
Subject: [PATCH 1/3] NMS-20180: Narrow anonymous menu-asset access to
 /ui-components/assets/**

The unpacked dist-menu artifact also ships an index.html (the Vite build
input) at /ui-components/, which nothing links to and which should not be
anonymously reachable; only assets/** needs the ROLE_ANONYMOUS rule from
NMS-20174. Document the deliberate login-page preload in bootstrap.jsp,
and pin the NMS-20174 access/quiet fixes with WebappIT smoke tests:
anonymous asset access with correct content types, index.html requiring
authentication, and login.jsp never executing the menu bundle.
---
 .../applicationContext-spring-security.xml    |  7 ++-
 .../src/main/webapp/includes/bootstrap.jsp    | 12 +++-
 .../java/org/opennms/smoketest/WebappIT.java  | 63 +++++++++++++++++++
 3 files changed, 79 insertions(+), 3 deletions(-)

diff --git a/opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml b/opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
index c32e660b1d7d..cae6c0778751 100644
--- a/opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
+++ b/opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
@@ -347,8 +347,11 @@
     <intercept-url pattern="/assets/**" access="hasAnyRole('ROLE_ANONYMOUS','ROLE_USER','ROLE_DASHBOARD')" />
     <!-- Vue menu bundle (static js/css/fonts). Must be anonymous: bootstrap.jsp preloads it from the
          login page, and an auth redirect there gets cached by Safari/Firefox as text/html for the
-         asset URL, breaking the menu on all JSP pages after login (NMS-20174). -->
-    <intercept-url pattern="/ui-components/**" access="hasAnyRole('ROLE_ANONYMOUS','ROLE_USER','ROLE_DASHBOARD')" />
+         asset URL, breaking the menu on all JSP pages after login (NMS-20174). Deliberately limited
+         to assets/**: the unpacked dist-menu artifact also ships an index.html (the Vite build
+         input) at /ui-components/, which nothing links to and which must not be anonymously
+         reachable (NMS-20180). -->
+    <intercept-url pattern="/ui-components/assets/**" access="hasAnyRole('ROLE_ANONYMOUS','ROLE_USER','ROLE_DASHBOARD')" />
 
     <intercept-url pattern="/admin/ng-requisitions/**" access="hasAnyRole('ROLE_PROVISION','ROLE_ADMIN')" />
     <intercept-url pattern="/admin/classification/index.jsp" access="hasAnyRole('ROLE_FLOW_MANAGER','ROLE_ADMIN')" />
diff --git a/opennms-webapp/src/main/webapp/includes/bootstrap.jsp b/opennms-webapp/src/main/webapp/includes/bootstrap.jsp
index 84cee97c54ee..0a5f2bf0e5ac 100644
--- a/opennms-webapp/src/main/webapp/includes/bootstrap.jsp
+++ b/opennms-webapp/src/main/webapp/includes/bootstrap.jsp
@@ -242,7 +242,17 @@
   </script>
   <link rel="stylesheet" href="<%= __baseHref %>ui-components/assets/index.css<%= __menuAssetsVersion %>" media="screen" />
   <%-- Start fetching/compiling the menu bundle now rather than when the parser
-       reaches its <script type="module"> tag near the end of the body. --%>
+       reaches its <script type="module"> tag near the end of the body.
+
+       These two links are deliberately emitted on 'quiet' pages too, including
+       the unauthenticated login page: preloading there warms the cache while
+       the user types their credentials, so the menu mounts instantly on the
+       first post-login page. This is only safe because the bundle is
+       anonymously accessible (see the /ui-components/assets/** rule in
+       applicationContext-spring-security.xml) — without that rule the preload
+       would cache an auth redirect as text/html under the asset URL and break
+       the menu on every JSP page after login (NMS-20174). Keep the two in
+       sync. --%>
   <link rel="modulepreload" href="<%= __baseHref %>ui-components/assets/index.js<%= __menuAssetsVersion %>" />
 </head>
 
diff --git a/smoke-test/src/test/java/org/opennms/smoketest/WebappIT.java b/smoke-test/src/test/java/org/opennms/smoketest/WebappIT.java
index dd17613a4018..98b744e19d0d 100644
--- a/smoke-test/src/test/java/org/opennms/smoketest/WebappIT.java
+++ b/smoke-test/src/test/java/org/opennms/smoketest/WebappIT.java
@@ -22,14 +22,17 @@
 package org.opennms.smoketest;
 
 import static io.restassured.RestAssured.given;
+import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
 import static org.hamcrest.text.MatchesPattern.matchesPattern;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 
 import java.io.IOException;
 import java.util.Arrays;
+import java.util.regex.Pattern;
 
 import org.apache.http.client.ClientProtocolException;
 import org.junit.After;
@@ -137,6 +140,66 @@ public void verifyCachingOnStaticAssets() {
             .header("Pragma", not("no-cache"));
   }
 
+  /**
+   * NMS-20174: the Vue menu bundle must be accessible without authentication.
+   * bootstrap.jsp preloads it from the (unauthenticated) login page; if that
+   * request is answered with an auth redirect instead, Safari and Firefox cache
+   * the text/html response under the asset URL and the menu never mounts on any
+   * JSP page after login.
+   */
+  @Test
+  public void verifyMenuBundleAssetsAreAnonymouslyAccessible() {
+    given().redirects().follow(false)
+        .get("ui-components/assets/index.js")
+        .then().assertThat()
+        .statusCode(200)
+        .header("Content-Type", containsString("javascript"));
+
+    given().redirects().follow(false)
+        .get("ui-components/assets/index.css")
+        .then().assertThat()
+        .statusCode(200)
+        .header("Content-Type", containsString("css"));
+  }
+
+  /**
+   * NMS-20180: only the menu bundle's assets/ directory is anonymous. The
+   * dist-menu artifact also ships an index.html (the Vite build input) at
+   * /ui-components/, which nothing links to and which must keep requiring
+   * authentication like any other page.
+   */
+  @Test
+  public void verifyMenuIndexHtmlRequiresAuthentication() {
+    given().redirects().follow(false)
+        .get("ui-components/index.html")
+        .then().assertThat()
+        .statusCode(302);
+  }
+
+  /**
+   * NMS-20174: the login page references the menu bundle only as preload links
+   * (deliberate cache warming for the first post-login page) and must never
+   * execute it. An unauthenticated menu run fires REST calls that trigger the
+   * browser's native basic-auth popup on the login page and pollute the
+   * post-login saved request (the password gate's Skip button then redirects
+   * to /rest, which browsers download as a file).
+   */
+  @Test
+  public void verifyLoginPageDoesNotExecuteMenuBundle() {
+    final String body = given()
+        .get("login.jsp")
+        .then().assertThat()
+        .statusCode(200)
+        .extract().response().body().asString();
+
+    // Positive control: the page still references the bundle (as a preload) —
+    // this keeps the negative assertion below meaningful if URLs change shape.
+    assertTrue("expected login.jsp to preload the menu bundle. Body: " + body,
+        body.contains("ui-components/assets/index.js"));
+    assertFalse("login.jsp must not contain a script tag executing the menu bundle. Body: " + body,
+        Pattern.compile("<script[^>]+ui-components/assets/index\\.js").matcher(body).find());
+  }
+
   /**
    * The Vue UI's static assets may be cached but must be revalidated on each use,
    * because their file names are not content-hashed and change between releases.

From 624359ca31843ba7b28a16a29542a74699ae6a9d Mon Sep 17 00:00:00 2001
From: Scott Theleman <synqotik@users.noreply.github.com>
Date: Thu, 13 Aug 2026 15:30:44 -0400
Subject: [PATCH 2/3] NMS-20180: Make saved-request URL matching independent of
 the default locale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Under a Turkish default locale, locale-sensitive toLowerCase() turns "I"
into a dotless ı, so a saved "/API" request would slip past the "/api"
prefix check added in NMS-20174. Use Locale.ROOT and cover it with a test
that runs the matcher under tr-TR.
---
 .../security/LoginModuleUtils.java               |  5 ++++-
 .../security/LoginModuleUtilsTest.java           | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/features/springframework-security/src/main/java/org/opennms/web/springframework/security/LoginModuleUtils.java b/features/springframework-security/src/main/java/org/opennms/web/springframework/security/LoginModuleUtils.java
index 6fb549816b54..541d6d2b2bca 100644
--- a/features/springframework-security/src/main/java/org/opennms/web/springframework/security/LoginModuleUtils.java
+++ b/features/springframework-security/src/main/java/org/opennms/web/springframework/security/LoginModuleUtils.java
@@ -26,6 +26,7 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashSet;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
 
@@ -158,7 +159,9 @@ public static boolean isInvalidSavedRequestUrl(String url) {
             return true;
         }
 
-        String urlLower = url.toLowerCase();
+        // Locale.ROOT: under a Turkish default locale, "I".toLowerCase() is a
+        // dotless ı, so "/API" would no longer match the "/api" prefix.
+        String urlLower = url.toLowerCase(Locale.ROOT);
 
         return Arrays.stream(INVALID_SAVED_REQUEST_URL_SUFFIXES).anyMatch(urlLower::endsWith)
                 || Arrays.stream(INVALID_SAVED_REQUEST_URL_PREFIXES)
diff --git a/features/springframework-security/src/test/java/org/opennms/web/springframework/security/LoginModuleUtilsTest.java b/features/springframework-security/src/test/java/org/opennms/web/springframework/security/LoginModuleUtilsTest.java
index 798540269067..bec11ae0ee8a 100644
--- a/features/springframework-security/src/test/java/org/opennms/web/springframework/security/LoginModuleUtilsTest.java
+++ b/features/springframework-security/src/test/java/org/opennms/web/springframework/security/LoginModuleUtilsTest.java
@@ -24,6 +24,8 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
+import java.util.Locale;
+
 import org.junit.Test;
 
 public class LoginModuleUtilsTest {
@@ -55,6 +57,20 @@ public void testRestAndApiUrlsAreInvalid() {
         assertTrue(LoginModuleUtils.isInvalidSavedRequestUrl("/REST/menu"));
     }
 
+    @Test
+    public void testMatchingIsDefaultLocaleIndependent() {
+        // Under a Turkish default locale, locale-sensitive toLowerCase() turns
+        // "I" into a dotless ı, so "/API" would slip past the "/api" prefix.
+        final Locale defaultLocale = Locale.getDefault();
+        try {
+            Locale.setDefault(new Locale("tr", "TR"));
+            assertTrue(LoginModuleUtils.isInvalidSavedRequestUrl("/API/v2/nodes"));
+            assertTrue(LoginModuleUtils.isInvalidSavedRequestUrl("/API"));
+        } finally {
+            Locale.setDefault(defaultLocale);
+        }
+    }
+
     @Test
     public void testPageUrlsAreValid() {
         assertFalse(LoginModuleUtils.isInvalidSavedRequestUrl("/index.jsp"));

From 6fabacc1661501d87a49044c323a766e0faef704 Mon Sep 17 00:00:00 2001
From: Scott Theleman <synqotik@users.noreply.github.com>
Date: Thu, 13 Aug 2026 15:30:51 -0400
Subject: [PATCH 3/3] NMS-20180: Assert regular menu items do not cancel the
 anchor navigation

The "does not cancel navigation for regular items" test only checked that
performLogout was not called, so an unconditional preventDefault() (breaking
navigation for every self-service item) would still pass. Assert
event.defaultPrevented is false so the test covers what its name claims.
---
 ui/tests/components/Menu/UserSelfServiceMenuItem.test.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/tests/components/Menu/UserSelfServiceMenuItem.test.ts b/ui/tests/components/Menu/UserSelfServiceMenuItem.test.ts
index e36b36196b01..ba5a1f0bba7f 100644
--- a/ui/tests/components/Menu/UserSelfServiceMenuItem.test.ts
+++ b/ui/tests/components/Menu/UserSelfServiceMenuItem.test.ts
@@ -122,5 +122,6 @@ describe('UserSelfServiceMenuItem.vue', () => {
     await nextTick()
 
     expect(performLogout).not.toHaveBeenCalled()
+    expect(event.defaultPrevented).toBe(false)
   })
 })