Removal of deprecated methods and classes.
This commit is contained in:
Luke Taylor
+4
-4
@@ -42,10 +42,6 @@ public class MethodSecurityInterceptor extends AbstractSecurityInterceptor imple
|
||||
|
||||
//~ Methods ========================================================================================================
|
||||
|
||||
public MethodSecurityMetadataSource getSecurityMetadataSource() {
|
||||
return this.securityMetadataSource;
|
||||
}
|
||||
|
||||
public Class<? extends Object> getSecureObjectClass() {
|
||||
return MethodInvocation.class;
|
||||
}
|
||||
@@ -72,6 +68,10 @@ public class MethodSecurityInterceptor extends AbstractSecurityInterceptor imple
|
||||
return result;
|
||||
}
|
||||
|
||||
public MethodSecurityMetadataSource getSecurityMetadataSource() {
|
||||
return this.securityMetadataSource;
|
||||
}
|
||||
|
||||
public SecurityMetadataSource obtainSecurityMetadataSource() {
|
||||
return this.securityMetadataSource;
|
||||
}
|
||||
|
||||
-11
@@ -60,17 +60,6 @@ public class MethodSecurityMetadataSourceAdvisor extends AbstractPointcutAdvisor
|
||||
|
||||
//~ Constructors ===================================================================================================
|
||||
|
||||
/**
|
||||
* @deprecated use the decoupled approach instead
|
||||
*/
|
||||
MethodSecurityMetadataSourceAdvisor(MethodSecurityInterceptor advice) {
|
||||
Assert.notNull(advice.getSecurityMetadataSource(), "Cannot construct a MethodSecurityMetadataSourceAdvisor using a " +
|
||||
"MethodSecurityInterceptor that has no SecurityMetadataSource configured");
|
||||
|
||||
this.interceptor = advice;
|
||||
this.attributeSource = advice.getSecurityMetadataSource();
|
||||
}
|
||||
|
||||
/**
|
||||
* Alternative constructor for situations where we want the advisor decoupled from the advice. Instead the advice
|
||||
* bean name should be set. This prevents eager instantiation of the interceptor
|
||||
|
||||
-75
@@ -1,75 +0,0 @@
|
||||
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.access.method;
|
||||
|
||||
import java.beans.PropertyEditorSupport;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Iterator;
|
||||
import java.util.LinkedHashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Properties;
|
||||
|
||||
import org.springframework.beans.propertyeditors.PropertiesEditor;
|
||||
import org.springframework.security.access.ConfigAttribute;
|
||||
import org.springframework.security.access.SecurityConfig;
|
||||
import org.springframework.util.StringUtils;
|
||||
|
||||
|
||||
/**
|
||||
* Property editor to assist with the setup of a {@link MethodSecurityMetadataSource}.
|
||||
* <p>
|
||||
* The class creates and populates a {@link MapBasedMethodSecurityMetadataSource}.
|
||||
*
|
||||
* @author Ben Alex
|
||||
* @deprecated use method annotations or the protect-pointcut support from the namespace
|
||||
*/
|
||||
public class MethodSecurityMetadataSourceEditor extends PropertyEditorSupport {
|
||||
//~ Methods ========================================================================================================
|
||||
|
||||
@SuppressWarnings("unchecked")
|
||||
public void setAsText(String s) throws IllegalArgumentException {
|
||||
if ((s == null) || "".equals(s)) {
|
||||
setValue(new MapBasedMethodSecurityMetadataSource());
|
||||
return;
|
||||
}
|
||||
|
||||
// Use properties editor to tokenize the string
|
||||
PropertiesEditor propertiesEditor = new PropertiesEditor();
|
||||
propertiesEditor.setAsText(s);
|
||||
|
||||
Properties props = (Properties) propertiesEditor.getValue();
|
||||
|
||||
// Now we have properties, process each one individually
|
||||
Map<String, List<ConfigAttribute>> mappings = new LinkedHashMap<String, List<ConfigAttribute>>();
|
||||
|
||||
for (Iterator iter = props.keySet().iterator(); iter.hasNext();) {
|
||||
String name = (String) iter.next();
|
||||
String value = props.getProperty(name);
|
||||
|
||||
String[] tokens = StringUtils.commaDelimitedListToStringArray(value);
|
||||
List<ConfigAttribute> attributes = new ArrayList<ConfigAttribute>(tokens.length);
|
||||
|
||||
for(String token : tokens) {
|
||||
attributes.add(new SecurityConfig(token));
|
||||
}
|
||||
|
||||
mappings.put(name, attributes);
|
||||
}
|
||||
|
||||
setValue(new MapBasedMethodSecurityMetadataSource(mappings));
|
||||
}
|
||||
}
|
||||
+2
-11
@@ -15,13 +15,11 @@
|
||||
|
||||
package org.springframework.security.authentication;
|
||||
|
||||
import org.springframework.security.core.GrantedAuthority;
|
||||
|
||||
|
||||
import java.io.Serializable;
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
|
||||
import org.springframework.security.core.GrantedAuthority;
|
||||
|
||||
|
||||
/**
|
||||
* Represents an anonymous <code>Authentication</code>.
|
||||
@@ -37,13 +35,6 @@ public class AnonymousAuthenticationToken extends AbstractAuthenticationToken im
|
||||
|
||||
//~ Constructors ===================================================================================================
|
||||
|
||||
/**
|
||||
* @deprecated use the second constructor
|
||||
*/
|
||||
public AnonymousAuthenticationToken(String key, Object principal, GrantedAuthority[] authorities) {
|
||||
this(key, principal, Arrays.asList(authorities));
|
||||
}
|
||||
|
||||
/**
|
||||
* Constructor.
|
||||
*
|
||||
|
||||
-8
@@ -15,7 +15,6 @@
|
||||
|
||||
package org.springframework.security.authentication;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.Collection;
|
||||
|
||||
import org.springframework.security.core.GrantedAuthority;
|
||||
@@ -52,13 +51,6 @@ public class UsernamePasswordAuthenticationToken extends AbstractAuthenticationT
|
||||
setAuthenticated(false);
|
||||
}
|
||||
|
||||
/**
|
||||
* @deprecated use the list of authorities version
|
||||
*/
|
||||
public UsernamePasswordAuthenticationToken(Object principal, Object credentials, GrantedAuthority[] authorities) {
|
||||
this(principal, credentials, Arrays.asList(authorities));
|
||||
}
|
||||
|
||||
/**
|
||||
* This constructor should only be used by <code>AuthenticationManager</code> or <code>AuthenticationProvider</code>
|
||||
* implementations that are satisfied with producing a trusted (i.e. {@link #isAuthenticated()} = <code>true</code>)
|
||||
|
||||
@@ -1,165 +0,0 @@
|
||||
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.util;
|
||||
|
||||
import java.io.UnsupportedEncodingException;
|
||||
import java.security.spec.KeySpec;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.SecretKey;
|
||||
import javax.crypto.SecretKeyFactory;
|
||||
import javax.crypto.spec.DESedeKeySpec;
|
||||
|
||||
import org.springframework.core.NestedRuntimeException;
|
||||
import org.springframework.security.core.codec.Base64;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
/**
|
||||
* A static utility class that can encrypt and decrypt text.
|
||||
*
|
||||
* <p>This class is useful if you have simple needs and wish to use the DESede
|
||||
* encryption cipher. More sophisticated requirements will need to use the
|
||||
* Java crypto libraries directly.
|
||||
*
|
||||
* @author Alan Stewart
|
||||
* @author Ben Alex
|
||||
* @deprecated Use a dedicated encryption library instead.
|
||||
*/
|
||||
@Deprecated
|
||||
public final class EncryptionUtils {
|
||||
|
||||
/**
|
||||
* This is a static class that should not be instantiated.
|
||||
*/
|
||||
private EncryptionUtils() {}
|
||||
|
||||
/**
|
||||
* Converts a String into a byte array using UTF-8, falling back to the
|
||||
* platform's default character set if UTF-8 fails.
|
||||
*
|
||||
* @param input the input (required)
|
||||
* @return a byte array representation of the input string
|
||||
*/
|
||||
public static byte[] stringToByteArray(String input) {
|
||||
Assert.hasLength(input, "Input required");
|
||||
try {
|
||||
return input.getBytes("UTF-8");
|
||||
} catch (UnsupportedEncodingException fallbackToDefault) {
|
||||
return input.getBytes();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts a byte array into a String using UTF-8, falling back to the
|
||||
* platform's default character set if UTF-8 fails.
|
||||
*
|
||||
* @param byteArray the byte array to convert (required)
|
||||
* @return a string representation of the byte array
|
||||
*/
|
||||
public static String byteArrayToString(byte[] byteArray) {
|
||||
Assert.notNull(byteArray, "ByteArray required");
|
||||
Assert.isTrue(byteArray.length > 0, "ByteArray cannot be empty");
|
||||
try {
|
||||
return new String(byteArray, "UTF8");
|
||||
} catch (final UnsupportedEncodingException e) {
|
||||
return new String(byteArray);
|
||||
}
|
||||
}
|
||||
|
||||
private static byte[] cipher(String key, byte[] passedBytes, int cipherMode) throws EncryptionException {
|
||||
try {
|
||||
final KeySpec keySpec = new DESedeKeySpec(stringToByteArray(key));
|
||||
final SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DESede");
|
||||
final Cipher cipher = Cipher.getInstance("DESede/ECB/PKCS5Padding");
|
||||
final SecretKey secretKey = keyFactory.generateSecret(keySpec);
|
||||
cipher.init(cipherMode, secretKey);
|
||||
return cipher.doFinal(passedBytes);
|
||||
} catch (final Exception e) {
|
||||
throw new EncryptionException(e.getMessage(), e);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Encrypts the inputString using the key.
|
||||
*
|
||||
* @param key at least 24 character long key (required)
|
||||
* @param inputString the string to encrypt (required)
|
||||
* @return the encrypted version of the inputString
|
||||
* @throws EncryptionException in the event of an encryption failure
|
||||
*/
|
||||
public static String encrypt(String key, String inputString) throws EncryptionException {
|
||||
isValidKey(key);
|
||||
final byte[] cipherText = cipher(key, stringToByteArray(inputString), Cipher.ENCRYPT_MODE);
|
||||
return byteArrayToString(Base64.encode(cipherText));
|
||||
}
|
||||
|
||||
/**
|
||||
* Encrypts the inputBytes using the key.
|
||||
*
|
||||
* @param key at least 24 character long key (required)
|
||||
* @param inputBytes the bytes to encrypt (required)
|
||||
* @return the encrypted version of the inputBytes
|
||||
* @throws EncryptionException in the event of an encryption failure
|
||||
*/
|
||||
public static byte[] encrypt(String key, byte[] inputBytes) throws EncryptionException {
|
||||
isValidKey(key);
|
||||
return Base64.encode(cipher(key, inputBytes, Cipher.ENCRYPT_MODE));
|
||||
}
|
||||
|
||||
/**
|
||||
* Decrypts the inputString using the key.
|
||||
*
|
||||
* @param key the key used to originally encrypt the string (required)
|
||||
* @param inputString the encrypted string (required)
|
||||
* @return the decrypted version of inputString
|
||||
* @throws EncryptionException in the event of an encryption failure
|
||||
*/
|
||||
public static String decrypt(String key, String inputString) throws EncryptionException {
|
||||
Assert.hasText(key, "A key is required to attempt decryption");
|
||||
final byte[] cipherText = cipher(key, Base64.decode(stringToByteArray(inputString)), Cipher.DECRYPT_MODE);
|
||||
return byteArrayToString(cipherText);
|
||||
}
|
||||
|
||||
/**
|
||||
* Decrypts the inputBytes using the key.
|
||||
*
|
||||
* @param key the key used to originally encrypt the string (required)
|
||||
* @param inputBytes the encrypted bytes (required)
|
||||
* @return the decrypted version of inputBytes
|
||||
* @throws EncryptionException in the event of an encryption failure
|
||||
*/
|
||||
public static byte[] decrypt(String key, byte[] inputBytes) throws EncryptionException {
|
||||
Assert.hasText(key, "A key is required to attempt decryption");
|
||||
return cipher(key, Base64.decode(inputBytes), Cipher.DECRYPT_MODE);
|
||||
}
|
||||
|
||||
private static void isValidKey(String key) {
|
||||
Assert.hasText(key, "A key to perform the encryption is required");
|
||||
Assert.isTrue(key.length() >= 24, "Key must be at least 24 characters long");
|
||||
}
|
||||
|
||||
public static class EncryptionException extends NestedRuntimeException {
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
public EncryptionException(String message, Throwable t) {
|
||||
super(message, t);
|
||||
}
|
||||
|
||||
public EncryptionException(String message) {
|
||||
super(message);
|
||||
}
|
||||
}
|
||||
}
|
||||
-87
@@ -1,87 +0,0 @@
|
||||
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.access.annotation;
|
||||
|
||||
import static org.junit.Assert.assertEquals;
|
||||
|
||||
import java.util.Collection;
|
||||
import java.util.List;
|
||||
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.springframework.security.access.ConfigAttribute;
|
||||
import org.springframework.security.access.SecurityConfig;
|
||||
import org.springframework.security.access.annotation.test.Entity;
|
||||
import org.springframework.security.access.annotation.test.PersonServiceImpl;
|
||||
import org.springframework.security.access.annotation.test.Service;
|
||||
import org.springframework.security.access.intercept.method.MockMethodInvocation;
|
||||
import org.springframework.security.access.method.MapBasedMethodSecurityMetadataSource;
|
||||
import org.springframework.security.access.method.MethodSecurityMetadataSourceEditor;
|
||||
|
||||
|
||||
/**
|
||||
* Extra tests to demonstrate generics behaviour with <code>MapBasedMethodDefinitionSource</code>.
|
||||
*
|
||||
* @author Ben Alex
|
||||
*/
|
||||
@SuppressWarnings("deprecation")
|
||||
public class MethodDefinitionSourceEditorTigerTests {
|
||||
private MockMethodInvocation makeUpper;
|
||||
private MockMethodInvocation makeLower;
|
||||
|
||||
@Before
|
||||
public void createMethodInvocations() throws Exception {
|
||||
makeUpper = new MockMethodInvocation(new PersonServiceImpl(), Service.class,"makeUpperCase", Entity.class);
|
||||
makeLower = new MockMethodInvocation(new PersonServiceImpl(), Service.class,"makeLowerCase", Entity.class);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testConcreteClassInvocations() throws Exception {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText(
|
||||
"org.springframework.security.access.annotation.test.Service.makeLower*=ROLE_FROM_INTERFACE\r\n" +
|
||||
"org.springframework.security.access.annotation.test.Service.makeUpper*=ROLE_FROM_INTERFACE\r\n" +
|
||||
"org.springframework.security.access.annotation.test.ServiceImpl.makeUpper*=ROLE_FROM_IMPLEMENTATION");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
assertEquals(3, map.getMethodMapSize());
|
||||
|
||||
Collection<ConfigAttribute> returnedMakeLower = map.getAttributes(makeLower);
|
||||
List<ConfigAttribute> expectedMakeLower = SecurityConfig.createList("ROLE_FROM_INTERFACE");
|
||||
assertEquals(expectedMakeLower, returnedMakeLower);
|
||||
|
||||
Collection<ConfigAttribute> returnedMakeUpper = map.getAttributes(makeUpper);
|
||||
List<ConfigAttribute> expectedMakeUpper = SecurityConfig.createList(new String[]{"ROLE_FROM_IMPLEMENTATION"});
|
||||
assertEquals(expectedMakeUpper, returnedMakeUpper);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testBridgeMethodResolution() throws Exception {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText(
|
||||
"org.springframework.security.access.annotation.test.PersonService.makeUpper*=ROLE_FROM_INTERFACE\r\n" +
|
||||
"org.springframework.security.access.annotation.test.ServiceImpl.makeUpper*=ROLE_FROM_ABSTRACT\r\n" +
|
||||
"org.springframework.security.access.annotation.test.PersonServiceImpl.makeUpper*=ROLE_FROM_PSI");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
assertEquals(3, map.getMethodMapSize());
|
||||
|
||||
Collection<ConfigAttribute> returnedMakeUpper = map.getAttributes(makeUpper);
|
||||
List<ConfigAttribute> expectedMakeUpper = SecurityConfig.createList("ROLE_FROM_PSI");
|
||||
assertEquals(expectedMakeUpper, returnedMakeUpper);
|
||||
}
|
||||
|
||||
}
|
||||
+11
-32
@@ -15,43 +15,31 @@
|
||||
|
||||
package org.springframework.security.access.intercept.aopalliance;
|
||||
|
||||
import static org.mockito.Mockito.*;
|
||||
|
||||
import java.lang.reflect.Method;
|
||||
|
||||
import junit.framework.TestCase;
|
||||
|
||||
import org.springframework.security.TargetObject;
|
||||
import org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor;
|
||||
import org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor;
|
||||
import org.springframework.security.access.method.MapBasedMethodSecurityMetadataSource;
|
||||
import org.springframework.security.access.method.MethodSecurityMetadataSourceEditor;
|
||||
import org.springframework.security.access.SecurityConfig;
|
||||
import org.springframework.security.access.method.MethodSecurityMetadataSource;
|
||||
|
||||
/**
|
||||
* Tests {@link MethodSecurityMetadataSourceAdvisor}.
|
||||
*
|
||||
* @author Ben Alex
|
||||
*/
|
||||
@SuppressWarnings("deprecation")
|
||||
public class MethodSecurityMetadataSourceAdvisorTests extends TestCase {
|
||||
//~ Methods ========================================================================================================
|
||||
|
||||
private MethodSecurityInterceptor getInterceptor() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_NOT_USED");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
|
||||
MethodSecurityInterceptor msi = new MethodSecurityInterceptor();
|
||||
msi.setSecurityMetadataSource(map);
|
||||
|
||||
return msi;
|
||||
}
|
||||
|
||||
public void testAdvisorReturnsFalseWhenMethodInvocationNotDefined()
|
||||
throws Exception {
|
||||
public void testAdvisorReturnsFalseWhenMethodInvocationNotDefined() throws Exception {
|
||||
Class<TargetObject> clazz = TargetObject.class;
|
||||
Method method = clazz.getMethod("makeLowerCase", new Class[] {String.class});
|
||||
|
||||
MethodSecurityMetadataSourceAdvisor advisor = new MethodSecurityMetadataSourceAdvisor(getInterceptor());
|
||||
MethodSecurityMetadataSource mds = mock(MethodSecurityMetadataSource.class);
|
||||
when(mds.getAttributes(method, clazz)).thenReturn(null);
|
||||
MethodSecurityMetadataSourceAdvisor advisor = new MethodSecurityMetadataSourceAdvisor("", mds ,"");
|
||||
assertFalse(advisor.getPointcut().getMethodMatcher().matches(method, clazz));
|
||||
}
|
||||
|
||||
@@ -60,18 +48,9 @@ public class MethodSecurityMetadataSourceAdvisorTests extends TestCase {
|
||||
Class<TargetObject> clazz = TargetObject.class;
|
||||
Method method = clazz.getMethod("countLength", new Class[] {String.class});
|
||||
|
||||
MethodSecurityMetadataSourceAdvisor advisor = new MethodSecurityMetadataSourceAdvisor(getInterceptor());
|
||||
MethodSecurityMetadataSource mds = mock(MethodSecurityMetadataSource.class);
|
||||
when(mds.getAttributes(method, clazz)).thenReturn(SecurityConfig.createList("ROLE_A"));
|
||||
MethodSecurityMetadataSourceAdvisor advisor = new MethodSecurityMetadataSourceAdvisor("", mds ,"");
|
||||
assertTrue(advisor.getPointcut().getMethodMatcher().matches(method, clazz));
|
||||
}
|
||||
|
||||
public void testDetectsImproperlyConfiguredAdvice() {
|
||||
MethodSecurityInterceptor msi = new MethodSecurityInterceptor();
|
||||
|
||||
try {
|
||||
new MethodSecurityMetadataSourceAdvisor(msi);
|
||||
fail("Should have detected null SecurityMetadataSource and thrown AopConfigException");
|
||||
} catch (IllegalArgumentException expected) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
-224
@@ -1,224 +0,0 @@
|
||||
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.access.intercept.method;
|
||||
|
||||
import java.lang.reflect.AccessibleObject;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.Collection;
|
||||
import java.util.List;
|
||||
|
||||
import junit.framework.TestCase;
|
||||
|
||||
import org.aopalliance.intercept.MethodInvocation;
|
||||
import org.springframework.security.ITargetObject;
|
||||
import org.springframework.security.OtherTargetObject;
|
||||
import org.springframework.security.TargetObject;
|
||||
import org.springframework.security.access.ConfigAttribute;
|
||||
import org.springframework.security.access.SecurityConfig;
|
||||
import org.springframework.security.access.method.MapBasedMethodSecurityMetadataSource;
|
||||
import org.springframework.security.access.method.MethodSecurityMetadataSourceEditor;
|
||||
|
||||
|
||||
/**
|
||||
* Tests {@link MethodSecurityMetadataSourceEditor} and its associated {@link MapBasedMethodSecurityMetadataSource}.
|
||||
*
|
||||
* @author Ben Alex
|
||||
*/
|
||||
@SuppressWarnings("deprecation")
|
||||
public class MethodSecurityMetadataSourceEditorTests extends TestCase {
|
||||
//~ Methods ========================================================================================================
|
||||
|
||||
public final void setUp() throws Exception {
|
||||
super.setUp();
|
||||
}
|
||||
|
||||
public void testClassNameNotFoundResultsInException() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
|
||||
try {
|
||||
editor.setAsText("org.springframework.security.DOES_NOT_EXIST_NAME=FOO,BAR");
|
||||
fail("Should have given IllegalArgumentException");
|
||||
} catch (IllegalArgumentException expected) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testClassNameNotInProperFormatResultsInException() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
|
||||
try {
|
||||
editor.setAsText("DOES_NOT_EXIST_NAME=FOO,BAR");
|
||||
fail("Should have given IllegalArgumentException");
|
||||
} catch (IllegalArgumentException expected) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testClassNameValidButMethodNameInvalidResultsInException() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
|
||||
try {
|
||||
editor.setAsText("org.springframework.security.TargetObject.INVALID_METHOD=FOO,BAR");
|
||||
fail("Should have given IllegalArgumentException");
|
||||
} catch (IllegalArgumentException expected) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testConcreteClassInvocationsAlsoReturnDefinitionsAgainstInterface() throws Exception {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText(
|
||||
"org.springframework.security.ITargetObject.computeHashCode*=ROLE_FROM_INTERFACE\r\n" +
|
||||
"org.springframework.security.ITargetObject.makeLower*=ROLE_FROM_INTERFACE\r\n" +
|
||||
"org.springframework.security.ITargetObject.makeUpper*=ROLE_FROM_INTERFACE\r\n" +
|
||||
"org.springframework.security.TargetObject.computeHashCode*=ROLE_FROM_TO\r\n" +
|
||||
"org.springframework.security.OtherTargetObject.computeHashCode*=ROLE_FROM_OTO\r\n" +
|
||||
"org.springframework.security.OtherTargetObject.makeUpper*=ROLE_FROM_IMPLEMENTATION");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
assertEquals(6, map.getMethodMapSize());
|
||||
|
||||
Collection<ConfigAttribute> returnedMakeLower = map.getAttributes(new MockMethodInvocation(ITargetObject.class, "makeLowerCase", new Class[] {String.class}, new OtherTargetObject()));
|
||||
List<ConfigAttribute> expectedMakeLower = SecurityConfig.createList("ROLE_FROM_INTERFACE");
|
||||
assertEquals(expectedMakeLower, returnedMakeLower);
|
||||
|
||||
Collection<ConfigAttribute> returnedMakeUpper = map.getAttributes(new MockMethodInvocation(ITargetObject.class, "makeUpperCase", new Class[] {String.class}, new OtherTargetObject()));
|
||||
List<ConfigAttribute> expectedMakeUpper = SecurityConfig.createList("ROLE_FROM_IMPLEMENTATION");
|
||||
assertEquals(expectedMakeUpper, returnedMakeUpper);
|
||||
|
||||
Collection<ConfigAttribute> returnedComputeHashCode = map.getAttributes(new MockMethodInvocation(ITargetObject.class, "computeHashCode", new Class[] {String.class}, new OtherTargetObject()));
|
||||
List<ConfigAttribute> expectedComputeHashCode = SecurityConfig.createList("ROLE_FROM_OTO");
|
||||
assertEquals(expectedComputeHashCode, returnedComputeHashCode);
|
||||
|
||||
returnedComputeHashCode = map.getAttributes(new MockMethodInvocation(ITargetObject.class, "computeHashCode", new Class[] {String.class}, new TargetObject()));
|
||||
expectedComputeHashCode = SecurityConfig.createList("ROLE_FROM_TO");
|
||||
assertEquals(expectedComputeHashCode, returnedComputeHashCode);
|
||||
}
|
||||
|
||||
public void testEmptyStringReturnsEmptyMap() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText("");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
assertEquals(0, map.getMethodMapSize());
|
||||
}
|
||||
|
||||
public void testIterator() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText(
|
||||
"org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY\r\norg.springframework.security.TargetObject.make*=ROLE_NINE,ROLE_SUPERVISOR");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
|
||||
assertEquals(5, map.getAllConfigAttributes().size());
|
||||
}
|
||||
|
||||
public void testMultiMethodParsing() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText(
|
||||
"org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY\r\norg.springframework.security.TargetObject.make*=ROLE_NINE,ROLE_SUPERVISOR");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
assertEquals(3, map.getMethodMapSize());
|
||||
}
|
||||
|
||||
public void testMultiMethodParsingWhereLaterMethodsOverrideEarlierMethods() throws Exception {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText(
|
||||
"org.springframework.security.TargetObject.*=ROLE_GENERAL\r\norg.springframework.security.TargetObject.makeLower*=ROLE_LOWER\r\norg.springframework.security.TargetObject.make*=ROLE_MAKE\r\norg.springframework.security.TargetObject.makeUpper*=ROLE_UPPER");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
assertEquals(14, map.getMethodMapSize());
|
||||
|
||||
Collection<ConfigAttribute> returnedMakeLower = map.getAttributes(new MockMethodInvocation(ITargetObject.class,
|
||||
"makeLowerCase", new Class[] {String.class}, new TargetObject()));
|
||||
List<ConfigAttribute> expectedMakeLower = SecurityConfig.createList("ROLE_LOWER");
|
||||
assertEquals(expectedMakeLower, returnedMakeLower);
|
||||
|
||||
Collection<ConfigAttribute> returnedMakeUpper = map.getAttributes(new MockMethodInvocation(ITargetObject.class,
|
||||
"makeUpperCase", new Class[] {String.class}, new TargetObject()));
|
||||
List<ConfigAttribute> expectedMakeUpper = SecurityConfig.createList("ROLE_UPPER");
|
||||
assertEquals(expectedMakeUpper, returnedMakeUpper);
|
||||
|
||||
Collection<ConfigAttribute> returnedCountLength = map.getAttributes(new MockMethodInvocation(ITargetObject.class,
|
||||
"countLength", new Class[] {String.class}, new TargetObject()));
|
||||
List<ConfigAttribute> expectedCountLength = SecurityConfig.createList("ROLE_GENERAL");
|
||||
assertEquals(expectedCountLength, returnedCountLength);
|
||||
}
|
||||
|
||||
public void testNullIsReturnedByMethodSecurityMetadataSourceWhenMethodInvocationNotDefined() throws Exception {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
|
||||
Collection<ConfigAttribute> configAttributeDefinition = map.getAttributes(new MockMethodInvocation(
|
||||
ITargetObject.class, "makeLowerCase", new Class[] {String.class}, new TargetObject()));
|
||||
assertNull(configAttributeDefinition);
|
||||
}
|
||||
|
||||
public void testNullReturnsEmptyMap() {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText(null);
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
assertEquals(0, map.getMethodMapSize());
|
||||
}
|
||||
|
||||
public void testSingleMethodParsing() throws Exception {
|
||||
MethodSecurityMetadataSourceEditor editor = new MethodSecurityMetadataSourceEditor();
|
||||
editor.setAsText("org.springframework.security.TargetObject.countLength=ROLE_ONE,ROLE_TWO,RUN_AS_ENTRY");
|
||||
|
||||
MapBasedMethodSecurityMetadataSource map = (MapBasedMethodSecurityMetadataSource) editor.getValue();
|
||||
|
||||
Collection<ConfigAttribute> returnedCountLength = map.getAttributes(new MockMethodInvocation(ITargetObject.class,
|
||||
"countLength", new Class[] {String.class}, new TargetObject()));
|
||||
assertEquals(SecurityConfig.createList("ROLE_ONE", "ROLE_TWO", "RUN_AS_ENTRY"), returnedCountLength);
|
||||
}
|
||||
|
||||
//~ Inner Classes ==================================================================================================
|
||||
|
||||
private class MockMethodInvocation implements MethodInvocation {
|
||||
private Method method;
|
||||
private Object targetObject;
|
||||
|
||||
public MockMethodInvocation(Class<?> clazz, String methodName, Class<?>[] parameterTypes, Object targetObject)
|
||||
throws NoSuchMethodException {
|
||||
this.method = clazz.getMethod(methodName, parameterTypes);
|
||||
this.targetObject = targetObject;
|
||||
}
|
||||
|
||||
public Object[] getArguments() {
|
||||
return null;
|
||||
}
|
||||
|
||||
public Method getMethod() {
|
||||
return method;
|
||||
}
|
||||
|
||||
public AccessibleObject getStaticPart() {
|
||||
return null;
|
||||
}
|
||||
|
||||
public Object getThis() {
|
||||
return targetObject;
|
||||
}
|
||||
|
||||
public Object proceed() throws Throwable {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,120 +0,0 @@
|
||||
/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.util;
|
||||
|
||||
import junit.framework.TestCase;
|
||||
|
||||
import org.springframework.security.util.EncryptionUtils.EncryptionException;
|
||||
|
||||
/**
|
||||
* JUnit tests for EncryptionUtils.
|
||||
*
|
||||
* @author Alan Stewart
|
||||
* @author Ben Alex
|
||||
*/
|
||||
@SuppressWarnings("deprecation")
|
||||
public class EncryptionUtilsTests extends TestCase {
|
||||
private final static String STRING_TO_ENCRYPT = "Alan K Stewart";
|
||||
private final static String ENCRYPTION_KEY = "123456789012345678901234567890";
|
||||
|
||||
public void testEncryptsUsingDESEde() throws EncryptionException {
|
||||
final String encryptedString = EncryptionUtils.encrypt(ENCRYPTION_KEY, STRING_TO_ENCRYPT);
|
||||
assertEquals("3YIE8sIbaEoqGZZrHamFGQ==", encryptedString);
|
||||
}
|
||||
|
||||
public void testEncryptByteArrayUsingDESEde() {
|
||||
final byte[] encryptedArray = EncryptionUtils.encrypt(ENCRYPTION_KEY, EncryptionUtils.stringToByteArray(STRING_TO_ENCRYPT));
|
||||
assertEquals("3YIE8sIbaEoqGZZrHamFGQ==", EncryptionUtils.byteArrayToString(encryptedArray));
|
||||
}
|
||||
|
||||
public void testEncryptionKeyCanContainLetters() throws EncryptionException {
|
||||
final String encryptedString = EncryptionUtils.encrypt("ASDF asdf 1234 8983 jklasdf J2Jaf8", STRING_TO_ENCRYPT);
|
||||
assertEquals("v4+DQoClx6qm5tJwBcRrkw==", encryptedString);
|
||||
}
|
||||
|
||||
public void testDecryptsUsingDESEde() throws EncryptionException {
|
||||
final String encryptedString = "3YIE8sIbaEoqGZZrHamFGQ==";
|
||||
final String decryptedString = EncryptionUtils.decrypt(ENCRYPTION_KEY, encryptedString);
|
||||
assertEquals(STRING_TO_ENCRYPT, decryptedString);
|
||||
}
|
||||
|
||||
public void testDecryptByteArrayUsingDESEde() {
|
||||
final byte[] encrypted = EncryptionUtils.stringToByteArray("3YIE8sIbaEoqGZZrHamFGQ==");
|
||||
final byte[] decrypted = EncryptionUtils.decrypt(ENCRYPTION_KEY, encrypted);
|
||||
assertEquals(STRING_TO_ENCRYPT, EncryptionUtils.byteArrayToString(decrypted));
|
||||
}
|
||||
|
||||
public void testFailEncryptWithNullEncryptionKey() {
|
||||
try {
|
||||
EncryptionUtils.encrypt(null, STRING_TO_ENCRYPT);
|
||||
fail();
|
||||
} catch (IllegalArgumentException e) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testFailEncryptWithEmptyEncryptionKey() {
|
||||
try {
|
||||
EncryptionUtils.encrypt("", STRING_TO_ENCRYPT);
|
||||
fail();
|
||||
} catch (IllegalArgumentException e) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void teastFailEncryptWithShortEncryptionKey() {
|
||||
try {
|
||||
EncryptionUtils.encrypt("01234567890123456789012", STRING_TO_ENCRYPT);
|
||||
fail();
|
||||
} catch (IllegalArgumentException e) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testFailDecryptWithEmptyString() {
|
||||
try {
|
||||
EncryptionUtils.decrypt(ENCRYPTION_KEY, "");
|
||||
fail();
|
||||
} catch (IllegalArgumentException e) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testFailEncryptWithEmptyString() {
|
||||
try {
|
||||
EncryptionUtils.encrypt(ENCRYPTION_KEY, "");
|
||||
fail();
|
||||
} catch (IllegalArgumentException e) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testFailEncryptWithNullString() {
|
||||
try {
|
||||
EncryptionUtils.encrypt(ENCRYPTION_KEY, (String) null);
|
||||
fail();
|
||||
} catch (IllegalArgumentException e) {
|
||||
assertTrue(true);
|
||||
}
|
||||
}
|
||||
|
||||
public void testEncryptAndDecrypt() throws EncryptionException {
|
||||
final String stringToEncrypt = "Alan Stewart";
|
||||
final String encryptedString = EncryptionUtils.encrypt(ENCRYPTION_KEY, stringToEncrypt);
|
||||
final String decryptedString = EncryptionUtils.decrypt(ENCRYPTION_KEY, encryptedString);
|
||||
assertEquals(stringToEncrypt, decryptedString);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user