Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 01:36:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Standardize Mocked Request Paths

Browse Source 
Historically, Spring Security tests have set the servlet path
to indicate the path of a MockHttpServletRequest. This was needed
for AntPath and MvcRequestMatcher to correctly match the
specified request path.

This can leave MockHttpServletRequest in an inconsistent state
since requestURI is null while servletPath has a value.

For example, PathPatternRequestMatcher does not use the servlet path.
For tests to continue working both before and after the migration
from AntPath/MvcRequestMatcher to PathPatternRequestMatcher, the
mock requests should have a consistent representation of path
in getRequestURI and getServletPath.

This commit updates classes to use TestMockHttpServletRequests,
which ensures that the given path is applied to the servletPath and
requestURI, while also overriding with contextPath, servletPath,
and pathInfo when necessary.
This commit is contained in:
Josh Cummings
2025-06-30 12:24:16 -06:00
parent ef50ff29ad
commit 531c5cafdc
65 changed files with 553 additions and 721 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/test/java/org/springframework/security/web/FilterChainProxyTests.java
+2 -2
View File
@@ -64,6 +64,7 @@ import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoMoreInteractions;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* @author Luke Taylor
@@ -96,8 +97,7 @@ public class FilterChainProxyTests {
}).given(this.filter).doFilter(any(), any(), any());
this.fcp = new FilterChainProxy(new DefaultSecurityFilterChain(this.matcher, Arrays.asList(this.filter)));
this.fcp.setFilterChainValidator(mock(FilterChainProxy.FilterChainValidator.class));
this.request = new MockHttpServletRequest("GET", "");
this.request.setServletPath("/path");
this.request = get("/path").build();
this.response = new MockHttpServletResponse();
this.chain = mock(FilterChain.class);
}
web/src/test/java/org/springframework/security/web/FilterInvocationTests.java
+10 -26
View File
@@ -34,6 +34,7 @@ import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.mockito.Mockito.mock;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link FilterInvocation}.
@@ -45,14 +46,8 @@ public class FilterInvocationTests {
@Test
public void testGettersAndStringMethods() {
MockHttpServletRequest request = new MockHttpServletRequest(null, null);
request.setServletPath("/HelloWorld");
request.setPathInfo("/some/more/segments.html");
request.setServerName("localhost");
request.setScheme("http");
request.setServerPort(80);
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/HelloWorld/some/more/segments.html");
MockHttpServletRequest request = get().requestUri("/mycontext", "/HelloWorld", "/some/more/segments.html")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = mock(FilterChain.class);
FilterInvocation fi = new FilterInvocation(request, response, chain);
@@ -62,7 +57,7 @@ public class FilterInvocationTests {
assertThat(fi.getHttpResponse()).isEqualTo(response);
assertThat(fi.getChain()).isEqualTo(chain);
assertThat(fi.getRequestUrl()).isEqualTo("/HelloWorld/some/more/segments.html");
assertThat(fi.toString()).isEqualTo("filter invocation [/HelloWorld/some/more/segments.html]");
assertThat(fi.toString()).isEqualTo("filter invocation [GET /HelloWorld/some/more/segments.html]");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://localhost/mycontext/HelloWorld/some/more/segments.html");
}
@@ -89,34 +84,23 @@ public class FilterInvocationTests {
@Test
public void testStringMethodsWithAQueryString() {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("foo=bar");
request.setServletPath("/HelloWorld");
request.setServerName("localhost");
request.setScheme("http");
request.setServerPort(80);
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/HelloWorld");
MockHttpServletRequest request = get().requestUri("/mycontext", "/HelloWorld", null)
.queryString("foo=bar")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterInvocation fi = new FilterInvocation(request, response, mock(FilterChain.class));
assertThat(fi.getRequestUrl()).isEqualTo("/HelloWorld?foo=bar");
assertThat(fi.toString()).isEqualTo("filter invocation [/HelloWorld?foo=bar]");
assertThat(fi.toString()).isEqualTo("filter invocation [GET /HelloWorld?foo=bar]");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://localhost/mycontext/HelloWorld?foo=bar");
}
@Test
public void testStringMethodsWithoutAnyQueryString() {
MockHttpServletRequest request = new MockHttpServletRequest(null, null);
request.setServletPath("/HelloWorld");
request.setServerName("localhost");
request.setScheme("http");
request.setServerPort(80);
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/HelloWorld");
MockHttpServletRequest request = get().requestUri("/mycontext", "/HelloWorld", null).build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterInvocation fi = new FilterInvocation(request, response, mock(FilterChain.class));
assertThat(fi.getRequestUrl()).isEqualTo("/HelloWorld");
assertThat(fi.toString()).isEqualTo("filter invocation [/HelloWorld]");
assertThat(fi.toString()).isEqualTo("filter invocation [GET /HelloWorld]");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://localhost/mycontext/HelloWorld");
}
web/src/test/java/org/springframework/security/web/RequestMatcherRedirectFilterTests.java
+3 -5
View File
@@ -29,6 +29,7 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoInteractions;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests for {@link RequestMatcherRedirectFilter}.
@@ -44,9 +45,7 @@ public class RequestMatcherRedirectFilterTests {
RequestMatcherRedirectFilter filter = new RequestMatcherRedirectFilter(this.builder.matcher("/context"),
"/test");
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/context");
MockHttpServletRequest request = get("/context").build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain filterChain = mock(FilterChain.class);
@@ -63,8 +62,7 @@ public class RequestMatcherRedirectFilterTests {
RequestMatcherRedirectFilter filter = new RequestMatcherRedirectFilter(this.builder.matcher("/context"),
"/test");
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/test");
MockHttpServletRequest request = get("/test").build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain filterChain = mock(FilterChain.class);
web/src/test/java/org/springframework/security/web/access/ExceptionTranslationFilterTests.java
+10 -34
View File
@@ -58,6 +58,7 @@ import static org.mockito.BDDMockito.willThrow;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoMoreInteractions;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link ExceptionTranslationFilter}.
@@ -86,13 +87,7 @@ public class ExceptionTranslationFilterTests {
@Test
public void testAccessDeniedWhenAnonymous() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
request.setServerPort(80);
request.setScheme("http");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
MockHttpServletRequest request = get().requestUri("/mycontext", "/secure/page.html", null).build();
// Setup the FilterChain to thrown an access denied exception
FilterChain fc = mockFilterChainWithException(new AccessDeniedException(""));
// Setup SecurityContextHolder, as filter needs to check if user is
@@ -129,13 +124,7 @@ public class ExceptionTranslationFilterTests {
@Test
public void testAccessDeniedWithRememberMe() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
request.setServerPort(80);
request.setScheme("http");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
MockHttpServletRequest request = get().requestUri("/mycontext", "/secure/page.html", null).build();
// Setup the FilterChain to thrown an access denied exception
FilterChain fc = mockFilterChainWithException(new AccessDeniedException(""));
// Setup SecurityContextHolder, as filter needs to check if user is remembered
@@ -155,8 +144,7 @@ public class ExceptionTranslationFilterTests {
@Test
public void testAccessDeniedWhenNonAnonymous() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
MockHttpServletRequest request = get("/secure/page.html").build();
// Setup the FilterChain to thrown an access denied exception
FilterChain fc = mockFilterChainWithException(new AccessDeniedException(""));
// Setup SecurityContextHolder, as filter needs to check if user is
@@ -178,8 +166,7 @@ public class ExceptionTranslationFilterTests {
@Test
public void testLocalizedErrorMessages() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
MockHttpServletRequest request = get("/secure/page.html").build();
// Setup the FilterChain to thrown an access denied exception
FilterChain fc = mockFilterChainWithException(new AccessDeniedException(""));
// Setup SecurityContextHolder, as filter needs to check if user is
@@ -202,13 +189,7 @@ public class ExceptionTranslationFilterTests {
@Test
public void redirectedToLoginFormAndSessionShowsOriginalTargetWhenAuthenticationException() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
request.setServerPort(80);
request.setScheme("http");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
MockHttpServletRequest request = get().requestUri("/mycontext", "/secure/page.html", null).build();
// Setup the FilterChain to thrown an authentication failure exception
FilterChain fc = mockFilterChainWithException(new BadCredentialsException(""));
// Test
@@ -225,13 +206,9 @@ public class ExceptionTranslationFilterTests {
public void redirectedToLoginFormAndSessionShowsOriginalTargetWithExoticPortWhenAuthenticationException()
throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
request.setServerPort(8080);
request.setScheme("http");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
MockHttpServletRequest request = get("http://localhost:8080")
.requestUri("/mycontext", "/secure/page.html", null)
.build();
// Setup the FilterChain to thrown an authentication failure exception
FilterChain fc = mockFilterChainWithException(new BadCredentialsException(""));
// Test
@@ -258,8 +235,7 @@ public class ExceptionTranslationFilterTests {
@Test
public void successfulAccessGrant() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
MockHttpServletRequest request = get("/secure/page.html").build();
// Test
ExceptionTranslationFilter filter = new ExceptionTranslationFilter(this.mockEntryPoint);
assertThat(filter.getAuthenticationEntryPoint()).isSameAs(this.mockEntryPoint);
web/src/test/java/org/springframework/security/web/access/channel/ChannelProcessingFilterTests.java
+4 -6
View File
@@ -32,6 +32,7 @@ import org.springframework.security.web.access.intercept.FilterInvocationSecurit
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.mockito.Mockito.mock;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link ChannelProcessingFilter}.
@@ -81,9 +82,8 @@ public class ChannelProcessingFilterTests {
filter.setChannelDecisionManager(new MockChannelDecisionManager(true, "SOME_ATTRIBUTE"));
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE");
filter.setSecurityMetadataSource(fids);
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/path").build();
request.setQueryString("info=now");
request.setServletPath("/path");
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, mock(FilterChain.class));
}
@@ -94,9 +94,8 @@ public class ChannelProcessingFilterTests {
filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "SOME_ATTRIBUTE"));
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE");
filter.setSecurityMetadataSource(fids);
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/path").build();
request.setQueryString("info=now");
request.setServletPath("/path");
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, mock(FilterChain.class));
}
@@ -107,9 +106,8 @@ public class ChannelProcessingFilterTests {
filter.setChannelDecisionManager(new MockChannelDecisionManager(false, "NOT_USED"));
MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "NOT_USED");
filter.setSecurityMetadataSource(fids);
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/PATH_NOT_MATCHING_CONFIG_ATTRIBUTE").build();
request.setQueryString("info=now");
request.setServletPath("/PATH_NOT_MATCHING_CONFIG_ATTRIBUTE");
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, mock(FilterChain.class));
}
web/src/test/java/org/springframework/security/web/access/channel/InsecureChannelProcessorTests.java
+7 -15
View File
@@ -27,6 +27,7 @@ import org.springframework.security.web.FilterInvocation;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.mockito.Mockito.mock;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link InsecureChannelProcessor}.
@@ -37,13 +38,9 @@ public class InsecureChannelProcessorTests {
@Test
public void testDecideDetectsAcceptableChannel() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("info=true");
request.setServerName("localhost");
request.setContextPath("/bigapp");
request.setServletPath("/servlet");
request.setScheme("http");
request.setServerPort(8080);
MockHttpServletRequest request = get("http://localhost:8080").requestUri("/bigapp", "/servlet", null)
.queryString("info=true")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterInvocation fi = new FilterInvocation(request, response, mock(FilterChain.class));
InsecureChannelProcessor processor = new InsecureChannelProcessor();
@@ -53,14 +50,9 @@ public class InsecureChannelProcessorTests {
@Test
public void testDecideDetectsUnacceptableChannel() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("info=true");
request.setServerName("localhost");
request.setContextPath("/bigapp");
request.setServletPath("/servlet");
request.setScheme("https");
request.setSecure(true);
request.setServerPort(8443);
MockHttpServletRequest request = get("https://localhost:8443").requestUri("/bigapp", "/servlet", null)
.queryString("info=true")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterInvocation fi = new FilterInvocation(request, response, mock(FilterChain.class));
InsecureChannelProcessor processor = new InsecureChannelProcessor();
web/src/test/java/org/springframework/security/web/access/channel/SecureChannelProcessorTests.java
+7 -15
View File
@@ -27,6 +27,7 @@ import org.springframework.security.web.FilterInvocation;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.mockito.Mockito.mock;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link SecureChannelProcessor}.
@@ -37,14 +38,9 @@ public class SecureChannelProcessorTests {
@Test
public void testDecideDetectsAcceptableChannel() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("info=true");
request.setServerName("localhost");
request.setContextPath("/bigapp");
request.setServletPath("/servlet");
request.setScheme("https");
request.setSecure(true);
request.setServerPort(8443);
MockHttpServletRequest request = get("https://localhost:8443").requestUri("/bigapp", "/servlet", null)
.queryString("info=true")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterInvocation fi = new FilterInvocation(request, response, mock(FilterChain.class));
SecureChannelProcessor processor = new SecureChannelProcessor();
@@ -54,13 +50,9 @@ public class SecureChannelProcessorTests {
@Test
public void testDecideDetectsUnacceptableChannel() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("info=true");
request.setServerName("localhost");
request.setContextPath("/bigapp");
request.setServletPath("/servlet");
request.setScheme("http");
request.setServerPort(8080);
MockHttpServletRequest request = get("http://localhost:8080").requestUri("/bigapp", "/servlet", null)
.queryString("info=true")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterInvocation fi = new FilterInvocation(request, response, mock(FilterChain.class));
SecureChannelProcessor processor = new SecureChannelProcessor();
web/src/test/java/org/springframework/security/web/access/expression/AbstractVariableEvaluationContextPostProcessorTests.java
+2 -2
View File
@@ -31,6 +31,7 @@ import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.web.FilterInvocation;
import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* @author Rob Winch
@@ -54,8 +55,7 @@ public class AbstractVariableEvaluationContextPostProcessorTests {
@BeforeEach
public void setup() {
this.processor = new VariableEvaluationContextPostProcessor();
this.request = new MockHttpServletRequest();
this.request.setServletPath("/");
this.request = get("/").build();
this.response = new MockHttpServletResponse();
this.invocation = new FilterInvocation(this.request, this.response, new MockFilterChain());
this.context = new StandardEvaluationContext();
web/src/test/java/org/springframework/security/web/access/intercept/DefaultFilterInvocationSecurityMetadataSourceTests.java
+4 -6
View File
@@ -33,6 +33,7 @@ import org.springframework.security.web.util.matcher.RequestMatcher;
import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.request;
/**
* Tests {@link DefaultFilterInvocationSecurityMetadataSource}.
@@ -141,12 +142,9 @@ public class DefaultFilterInvocationSecurityMetadataSourceTests {
private FilterInvocation createFilterInvocation(String servletPath, String pathInfo, String queryString,
String method) {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI(null);
request.setMethod(method);
request.setServletPath(servletPath);
request.setPathInfo(pathInfo);
request.setQueryString(queryString);
MockHttpServletRequest request = request(method).requestUri(null, servletPath, pathInfo)
.queryString(queryString)
.build();
return new FilterInvocation(request, new MockHttpServletResponse(), mock(FilterChain.class));
}
web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java
+2 -2
View File
@@ -53,6 +53,7 @@ import static org.mockito.Mockito.never;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoMoreInteractions;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link FilterSecurityInterceptor}.
@@ -188,8 +189,7 @@ public class FilterSecurityInterceptorTests {
private FilterInvocation createinvocation() {
MockHttpServletResponse response = new MockHttpServletResponse();
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secure/page.html");
MockHttpServletRequest request = get("/secure/page.html").build();
FilterChain chain = mock(FilterChain.class);
FilterInvocation fi = new FilterInvocation(request, response, chain);
return fi;
web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilterTests.java
+18 -18
View File
@@ -59,6 +59,9 @@ import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.Builder;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.post;
/**
* Tests {@link AbstractAuthenticationProcessingFilter}.
@@ -75,13 +78,11 @@ public class AbstractAuthenticationProcessingFilterTests {
SimpleUrlAuthenticationFailureHandler failureHandler;
private MockHttpServletRequest createMockAuthenticationRequest() {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/j_mock_post");
request.setScheme("http");
request.setServerName("www.example.com");
request.setRequestURI("/mycontext/j_mock_post");
request.setContextPath("/mycontext");
return request;
return withMockAuthenticationRequest().build();
}
private Builder withMockAuthenticationRequest() {
return get("www.example.com").requestUri("/mycontext", "/j_mock_post", null);
}
@BeforeEach
@@ -100,12 +101,11 @@ public class AbstractAuthenticationProcessingFilterTests {
@Test
public void testDefaultProcessesFilterUrlMatchesWithPathParameter() {
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login;jsessionid=I8MIONOSTHOR");
MockHttpServletRequest request = post("/login;jsessionid=I8MIONOSTHOR").build();
MockHttpServletResponse response = new MockHttpServletResponse();
MockAuthenticationFilter filter = new MockAuthenticationFilter();
filter.setFilterProcessesUrl("/login");
DefaultHttpFirewall firewall = new DefaultHttpFirewall();
request.setServletPath("/login;jsessionid=I8MIONOSTHOR");
// the firewall ensures that path parameters are ignored
HttpServletRequest firewallRequest = firewall.getFirewalledRequest(request);
assertThat(filter.requiresAuthentication(firewallRequest, response)).isTrue();
@@ -114,9 +114,9 @@ public class AbstractAuthenticationProcessingFilterTests {
@Test
public void testFilterProcessesUrlVariationsRespected() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = createMockAuthenticationRequest();
request.setServletPath("/j_OTHER_LOCATION");
request.setRequestURI("/mycontext/j_OTHER_LOCATION");
MockHttpServletRequest request = withMockAuthenticationRequest()
.requestUri("/mycontext", "/j_OTHER_LOCATION", null)
.build();
// Setup our filter configuration
MockFilterConfig config = new MockFilterConfig(null, null);
// Setup our expectation that the filter chain will not be invoked, as we redirect
@@ -150,9 +150,9 @@ public class AbstractAuthenticationProcessingFilterTests {
@Test
public void testIgnoresAnyServletPathOtherThanFilterProcessesUrl() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = createMockAuthenticationRequest();
request.setServletPath("/some.file.html");
request.setRequestURI("/mycontext/some.file.html");
MockHttpServletRequest request = withMockAuthenticationRequest()
.requestUri("/mycontext", "/some.file.html", null)
.build();
// Setup our filter configuration
MockFilterConfig config = new MockFilterConfig(null, null);
// Setup our expectation that the filter chain will be invoked, as our request is
@@ -227,9 +227,9 @@ public class AbstractAuthenticationProcessingFilterTests {
@Test
public void testNormalOperationWithRequestMatcherAndAuthenticationManager() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = createMockAuthenticationRequest();
request.setServletPath("/j_eradicate_corona_virus");
request.setRequestURI("/mycontext/j_eradicate_corona_virus");
MockHttpServletRequest request = withMockAuthenticationRequest()
.requestUri("/mycontext", "/j_eradicate_corona_virus", null)
.build();
HttpSession sessionPreAuth = request.getSession();
// Setup our filter configuration
MockFilterConfig config = new MockFilterConfig(null, null);
web/src/test/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPointTests.java
+14 -47
View File
@@ -28,6 +28,7 @@ import org.springframework.security.web.PortMapperImpl;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link LoginUrlAuthenticationEntryPoint}.
@@ -73,12 +74,7 @@ public class LoginUrlAuthenticationEntryPointTests {
@Test
public void testHttpsOperationFromOriginalHttpUrl() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/some_path");
request.setScheme("http");
request.setServerName("www.example.com");
request.setContextPath("/bigWebApp");
request.setServerPort(80);
MockHttpServletRequest request = get("http://127.0.0.1").requestUri("/bigWebApp", "/some_path", null).build();
MockHttpServletResponse response = new MockHttpServletResponse();
LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint("/hello");
ep.setPortMapper(new PortMapperImpl());
@@ -87,17 +83,17 @@ public class LoginUrlAuthenticationEntryPointTests {
ep.setPortResolver(new MockPortResolver(80, 443));
ep.afterPropertiesSet();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("https://www.example.com/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("https://127.0.0.1/bigWebApp/hello");
request.setServerPort(8080);
response = new MockHttpServletResponse();
ep.setPortResolver(new MockPortResolver(8080, 8443));
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("https://www.example.com:8443/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("https://127.0.0.1:8443/bigWebApp/hello");
// Now test an unusual custom HTTP:HTTPS is handled properly
request.setServerPort(8888);
response = new MockHttpServletResponse();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("https://www.example.com:8443/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("https://127.0.0.1:8443/bigWebApp/hello");
PortMapperImpl portMapper = new PortMapperImpl();
Map<String, String> map = new HashMap<>();
map.put("8888", "9999");
@@ -110,17 +106,13 @@ public class LoginUrlAuthenticationEntryPointTests {
ep.setPortResolver(new MockPortResolver(8888, 9999));
ep.afterPropertiesSet();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("https://www.example.com:9999/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("https://127.0.0.1:9999/bigWebApp/hello");
}
@Test
public void testHttpsOperationFromOriginalHttpsUrl() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/some_path");
request.setScheme("https");
request.setServerName("www.example.com");
request.setContextPath("/bigWebApp");
request.setServerPort(443);
MockHttpServletRequest request = get("https://www.example.com:443").requestUri("/bigWebApp", "/some_path", null)
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint("/hello");
ep.setPortMapper(new PortMapperImpl());
@@ -149,13 +141,7 @@ public class LoginUrlAuthenticationEntryPointTests {
ep.setPortMapper(new PortMapperImpl());
ep.setPortResolver(new MockPortResolver(80, 443));
ep.afterPropertiesSet();
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/some_path");
request.setContextPath("/bigWebApp");
request.setScheme("http");
request.setServerName("localhost");
request.setContextPath("/bigWebApp");
request.setServerPort(80);
MockHttpServletRequest request = get().requestUri("/bigWebApp", "/some_path", null).build();
MockHttpServletResponse response = new MockHttpServletResponse();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("http://localhost/bigWebApp/hello");
@@ -167,13 +153,8 @@ public class LoginUrlAuthenticationEntryPointTests {
ep.setPortResolver(new MockPortResolver(8888, 1234));
ep.setForceHttps(true);
ep.afterPropertiesSet();
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/some_path");
request.setContextPath("/bigWebApp");
request.setScheme("http");
request.setServerName("localhost");
request.setContextPath("/bigWebApp");
request.setServerPort(8888); // NB: Port we can't resolve
MockHttpServletRequest request = get("http://localhost:8888").requestUri("/bigWebApp", "/some_path", null)
.build(); // NB: Port we can't resolve
MockHttpServletResponse response = new MockHttpServletResponse();
ep.commence(request, response, null);
// Response doesn't switch to HTTPS, as we didn't know HTTP port 8888 to HTTP port
@@ -186,14 +167,7 @@ public class LoginUrlAuthenticationEntryPointTests {
LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint("/hello");
ep.setUseForward(true);
ep.afterPropertiesSet();
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/bigWebApp/some_path");
request.setServletPath("/some_path");
request.setContextPath("/bigWebApp");
request.setScheme("http");
request.setServerName("www.example.com");
request.setContextPath("/bigWebApp");
request.setServerPort(80);
MockHttpServletRequest request = get().requestUri("/bigWebApp", "/some_path", null).build();
MockHttpServletResponse response = new MockHttpServletResponse();
ep.commence(request, response, null);
assertThat(response.getForwardedUrl()).isEqualTo("/hello");
@@ -205,17 +179,10 @@ public class LoginUrlAuthenticationEntryPointTests {
ep.setUseForward(true);
ep.setForceHttps(true);
ep.afterPropertiesSet();
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/bigWebApp/some_path");
request.setServletPath("/some_path");
request.setContextPath("/bigWebApp");
request.setScheme("http");
request.setServerName("www.example.com");
request.setContextPath("/bigWebApp");
request.setServerPort(80);
MockHttpServletRequest request = get("http://127.0.0.1").requestUri("/bigWebApp", "/some_path", null).build();
MockHttpServletResponse response = new MockHttpServletResponse();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("https://www.example.com/bigWebApp/some_path");
assertThat(response.getRedirectedUrl()).isEqualTo("https://127.0.0.1/bigWebApp/some_path");
}
// SEC-1498
web/src/test/java/org/springframework/security/web/authentication/RequestMatcherDelegatingAuthenticationManagerResolverTests.java
+2 -2
View File
@@ -28,6 +28,7 @@ import org.springframework.security.web.servlet.util.matcher.PathPatternRequestM
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.mockito.Mockito.mock;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests for {@link RequestMatcherDelegatingAuthenticationManagerResolverTests}
@@ -48,8 +49,7 @@ public class RequestMatcherDelegatingAuthenticationManagerResolverTests {
.add(PathPatternRequestMatcher.withDefaults().matcher("/two/**"), this.two)
.build();
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/one/location");
request.setServletPath("/one/location");
MockHttpServletRequest request = get("/one/location").build();
assertThat(resolver.resolve(request)).isEqualTo(this.one);
}
web/src/test/java/org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilterTests.java
+5 -4
View File
@@ -39,6 +39,7 @@ import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.post;
/**
* Tests {@link UsernamePasswordAuthenticationFilter}.
@@ -128,10 +129,10 @@ public class UsernamePasswordAuthenticationFilterTests {
@Test
public void testSecurityContextHolderStrategyUsed() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login");
request.setServletPath("/login");
request.addParameter(UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_USERNAME_KEY, "rod");
request.addParameter(UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_PASSWORD_KEY, "koala");
MockHttpServletRequest request = post("/login")
.param(UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_USERNAME_KEY, "rod")
.param(UsernamePasswordAuthenticationFilter.SPRING_SECURITY_FORM_PASSWORD_KEY, "koala")
.build();
UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter();
filter.setAuthenticationManager(createAuthenticationManager());
SecurityContextHolderStrategy strategy = spy(SecurityContextHolder.getContextHolderStrategy());
web/src/test/java/org/springframework/security/web/authentication/logout/LogoutHandlerTests.java
+8 -8
View File
@@ -24,6 +24,8 @@ import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.web.firewall.DefaultHttpFirewall;
import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.post;
/**
* @author Luke Taylor
@@ -39,22 +41,20 @@ public class LogoutHandlerTests {
@Test
public void testRequiresLogoutUrlWorksWithPathParams() {
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/context/logout;someparam=blah");
MockHttpServletRequest request = post().requestUri("/context", "/logout;someparam=blah", null)
.queryString("otherparam=blah")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
request.setContextPath("/context");
request.setServletPath("/logout;someparam=blah");
request.setQueryString("otherparam=blah");
DefaultHttpFirewall fw = new DefaultHttpFirewall();
assertThat(this.filter.requiresLogout(fw.getFirewalledRequest(request), response)).isTrue();
}
@Test
public void testRequiresLogoutUrlWorksWithQueryParams() {
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/context/logout");
request.setContextPath("/context");
MockHttpServletRequest request = get().requestUri("/context", "/logout", null)
.queryString("otherparam=blah")
.build();
MockHttpServletResponse response = new MockHttpServletResponse();
request.setServletPath("/logout");
request.setQueryString("param=blah");
assertThat(this.filter.requiresLogout(request, response)).isTrue();
}
web/src/test/java/org/springframework/security/web/authentication/ott/GenerateOneTimeTokenFilterTests.java
+4 -4
View File
@@ -38,6 +38,7 @@ import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.verify;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.post;
/**
* Tests for {@link GenerateOneTimeTokenWebFilter}
@@ -55,7 +56,7 @@ public class GenerateOneTimeTokenFilterTests {
private static final String USERNAME = "user";
private final MockHttpServletRequest request = new MockHttpServletRequest();
private MockHttpServletRequest request;
private final MockHttpServletResponse response = new MockHttpServletResponse();
@@ -63,9 +64,7 @@ public class GenerateOneTimeTokenFilterTests {
@BeforeEach
void setup() {
this.request.setMethod("POST");
this.request.setServletPath("/ott/generate");
this.request.setRequestURI("/ott/generate");
this.request = post("/ott/generate").build();
}
@Test
@@ -87,6 +86,7 @@ public class GenerateOneTimeTokenFilterTests {
void filterWhenUsernameFormParamIsEmptyThenNull() throws ServletException, IOException {
given(this.oneTimeTokenService.generate(ArgumentMatchers.any(GenerateOneTimeTokenRequest.class)))
.willReturn((new DefaultOneTimeToken(TOKEN, USERNAME, Instant.now())));
GenerateOneTimeTokenFilter filter = new GenerateOneTimeTokenFilter(this.oneTimeTokenService,
this.successHandler);
web/src/test/java/org/springframework/security/web/authentication/ui/DefaultOneTimeTokenSubmitPageGeneratingFilterTests.java
+6 -8
View File
@@ -27,6 +27,7 @@ import org.springframework.mock.web.MockHttpServletResponse;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests for {@link DefaultOneTimeTokenSubmitPageGeneratingFilter}
@@ -37,7 +38,7 @@ class DefaultOneTimeTokenSubmitPageGeneratingFilterTests {
DefaultOneTimeTokenSubmitPageGeneratingFilter filter = new DefaultOneTimeTokenSubmitPageGeneratingFilter();
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/login/ott");
MockHttpServletRequest request;
MockHttpServletResponse response = new MockHttpServletResponse();
@@ -45,9 +46,7 @@ class DefaultOneTimeTokenSubmitPageGeneratingFilterTests {
@BeforeEach
void setup() {
this.request.setMethod("GET");
this.request.setServletPath("/login/ott");
this.request.setRequestURI("/login/ott");
this.request = get("/login/ott").build();
}
@Test
@@ -80,10 +79,9 @@ class DefaultOneTimeTokenSubmitPageGeneratingFilterTests {
@Test
void setContextThenGenerates() throws Exception {
this.request.setContextPath("/context");
this.request.setRequestURI("/context/login/ott");
MockHttpServletRequest request = get().requestUri("/context", "/login/ott", null).build();
this.filter.setLoginProcessingUrl("/login/another");
this.filter.doFilterInternal(this.request, this.response, this.filterChain);
this.filter.doFilterInternal(request, this.response, this.filterChain);
String response = this.response.getContentAsString();
assertThat(response).contains("<form class=\"login-form\" action=\"/context/login/another\" method=\"post\">");
}
@@ -101,7 +99,7 @@ class DefaultOneTimeTokenSubmitPageGeneratingFilterTests {
void filterThenRenders() throws Exception {
this.request.setParameter("token", "this<>!@#\"");
this.filter.setLoginProcessingUrl("/login/another");
this.filter.setResolveHiddenInputs((request) -> Map.of("_csrf", "csrf-token-value"));
this.filter.setResolveHiddenInputs((r) -> Map.of("_csrf", "csrf-token-value"));
this.filter.doFilterInternal(this.request, this.response, this.filterChain);
String response = this.response.getContentAsString();
assertThat(response).isEqualTo(
web/src/test/java/org/springframework/security/web/authentication/www/BasicAuthenticationFilterTests.java
+19 -37
View File
@@ -61,6 +61,7 @@ import static org.mockito.Mockito.never;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoMoreInteractions;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link BasicAuthenticationFilter}.
@@ -94,8 +95,7 @@ public class BasicAuthenticationFilterTests {
@Test
public void testFilterIgnoresRequestsContainingNoAuthorizationHeader() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/some_file.html");
MockHttpServletRequest request = get("/some_file.html").build();
final MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = mock(FilterChain.class);
this.filter.doFilter(request, response, chain);
@@ -113,9 +113,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void testInvalidBasicAuthorizationTokenIsIgnored() throws Exception {
String token = "NOT_A_VALID_TOKEN_AS_MISSING_COLON";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
request.setSession(new MockHttpSession());
final MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = mock(FilterChain.class);
@@ -127,9 +126,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void invalidBase64IsIgnored() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic NOT_VALID_BASE64");
request.setServletPath("/some_file.html");
request.setSession(new MockHttpSession());
final MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = mock(FilterChain.class);
@@ -143,9 +141,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void testNormalOperation() throws Exception {
String token = "rod:koala";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
// Test
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
FilterChain chain = mock(FilterChain.class);
@@ -172,9 +169,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void doFilterWhenSchemeLowercaseThenCaseInsensitveMatchWorks() throws Exception {
String token = "rod:koala";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
// Test
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
FilterChain chain = mock(FilterChain.class);
@@ -187,9 +183,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void doFilterWhenSchemeMixedCaseThenCaseInsensitiveMatchWorks() throws Exception {
String token = "rod:koala";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "BaSiC " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
FilterChain chain = mock(FilterChain.class);
this.filter.doFilter(request, new MockHttpServletResponse(), chain);
@@ -200,9 +195,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void testOtherAuthorizationSchemeIsIgnored() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "SOME_OTHER_AUTHENTICATION_SCHEME");
request.setServletPath("/some_file.html");
FilterChain chain = mock(FilterChain.class);
this.filter.doFilter(request, new MockHttpServletResponse(), chain);
verify(chain).doFilter(any(ServletRequest.class), any(ServletResponse.class));
@@ -222,9 +216,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void testSuccessLoginThenFailureLoginResultsInSessionLosingToken() throws Exception {
String token = "rod:koala";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
final MockHttpServletResponse response1 = new MockHttpServletResponse();
FilterChain chain = mock(FilterChain.class);
this.filter.doFilter(request, response1, chain);
@@ -240,7 +233,6 @@ public class BasicAuthenticationFilterTests {
chain = mock(FilterChain.class);
this.filter.doFilter(request, response2, chain);
verify(chain, never()).doFilter(any(ServletRequest.class), any(ServletResponse.class));
request.setServletPath("/some_file.html");
// Test - the filter chain will not be invoked, as we get a 401 forbidden response
MockHttpServletResponse response = response2;
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
@@ -250,9 +242,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void testWrongPasswordContinuesFilterChainIfIgnoreFailureIsTrue() throws Exception {
String token = "rod:WRONG_PASSWORD";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
request.setSession(new MockHttpSession());
this.filter = new BasicAuthenticationFilter(this.manager);
assertThat(this.filter.isIgnoreFailure()).isTrue();
@@ -266,9 +257,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void testWrongPasswordReturnsForbiddenIfIgnoreFailureIsFalse() throws Exception {
String token = "rod:WRONG_PASSWORD";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
request.setSession(new MockHttpSession());
assertThat(this.filter.isIgnoreFailure()).isFalse();
final MockHttpServletResponse response = new MockHttpServletResponse();
@@ -284,9 +274,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void skippedOnErrorDispatch() throws Exception {
String token = "bad:credentials";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error");
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = mock(FilterChain.class);
@@ -307,10 +296,9 @@ public class BasicAuthenticationFilterTests {
given(this.manager.authenticate(not(eq(rodRequest)))).willThrow(new BadCredentialsException(""));
this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
String token = "rod:äöü";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization",
"Basic " + CodecTestUtils.encodeBase64(token.getBytes(StandardCharsets.UTF_8)));
request.setServletPath("/some_file.html");
MockHttpServletResponse response = new MockHttpServletResponse();
// Test
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
@@ -336,10 +324,9 @@ public class BasicAuthenticationFilterTests {
this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
this.filter.setCredentialsCharset("ISO-8859-1");
String token = "rod:äöü";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization",
"Basic " + CodecTestUtils.encodeBase64(token.getBytes(StandardCharsets.ISO_8859_1)));
request.setServletPath("/some_file.html");
MockHttpServletResponse response = new MockHttpServletResponse();
// Test
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
@@ -367,10 +354,9 @@ public class BasicAuthenticationFilterTests {
this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
this.filter.setCredentialsCharset("ISO-8859-1");
String token = "rod:äöü";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization",
"Basic " + CodecTestUtils.encodeBase64(token.getBytes(StandardCharsets.UTF_8)));
request.setServletPath("/some_file.html");
MockHttpServletResponse response = new MockHttpServletResponse();
// Test
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
@@ -383,9 +369,8 @@ public class BasicAuthenticationFilterTests {
@Test
public void requestWhenEmptyBasicAuthorizationHeaderTokenThenUnauthorized() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic ");
request.setServletPath("/some_file.html");
request.setSession(new MockHttpSession());
final MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = mock(FilterChain.class);
@@ -401,9 +386,8 @@ public class BasicAuthenticationFilterTests {
SecurityContextRepository securityContextRepository = mock(SecurityContextRepository.class);
this.filter.setSecurityContextRepository(securityContextRepository);
String token = "rod:koala";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/some_file.html").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/some_file.html");
MockHttpServletResponse response = new MockHttpServletResponse();
// Test
assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
@@ -496,9 +480,8 @@ public class BasicAuthenticationFilterTests {
public void doFilterWhenCustomAuthenticationConverterThatIgnoresRequestThenIgnores() throws Exception {
this.filter.setAuthenticationConverter(new TestAuthenticationConverter());
String token = "rod:koala";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/ignored").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/ignored");
FilterChain filterChain = mock(FilterChain.class);
MockHttpServletResponse response = new MockHttpServletResponse();
this.filter.doFilter(request, response, filterChain);
@@ -513,9 +496,8 @@ public class BasicAuthenticationFilterTests {
public void doFilterWhenCustomAuthenticationConverterRequestThenAuthenticate() throws Exception {
this.filter.setAuthenticationConverter(new TestAuthenticationConverter());
String token = "rod:koala";
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletRequest request = get("/ok").build();
request.addHeader("Authorization", "Basic " + CodecTestUtils.encodeBase64(token));
request.setServletPath("/ok");
FilterChain filterChain = mock(FilterChain.class);
MockHttpServletResponse response = new MockHttpServletResponse();
this.filter.doFilter(request, response, filterChain);
web/src/test/java/org/springframework/security/web/authentication/www/DigestAuthenticationFilterTests.java
+2 -2
View File
@@ -53,6 +53,7 @@ import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* Tests {@link DigestAuthenticationFilter}.
@@ -131,8 +132,7 @@ public class DigestAuthenticationFilterTests {
this.filter = new DigestAuthenticationFilter();
this.filter.setUserDetailsService(uds);
this.filter.setAuthenticationEntryPoint(ep);
this.request = new MockHttpServletRequest("GET", REQUEST_URI);
this.request.setServletPath(REQUEST_URI);
this.request = get(REQUEST_URI).build();
}
@Test
web/src/test/java/org/springframework/security/web/debug/DebugFilterTests.java
+2 -4
View File
@@ -41,6 +41,7 @@ import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.verify;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* @author Rob Winch
@@ -120,10 +121,7 @@ public class DebugFilterTests {
@Test
public void doFilterLogsProperly() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setMethod("GET");
request.setServletPath("/path");
request.setPathInfo("/");
MockHttpServletRequest request = get().requestUri(null, "/path", "/").build();
request.addHeader("A", "A Value");
request.addHeader("A", "Another Value");
request.addHeader("B", "B Value");
web/src/test/java/org/springframework/security/web/firewall/DefaultHttpFirewallTests.java
+2 -2
View File
@@ -21,6 +21,7 @@ import org.junit.jupiter.api.Test;
import org.springframework.mock.web.MockHttpServletRequest;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* @author Luke Taylor
@@ -34,8 +35,7 @@ public class DefaultHttpFirewallTests {
public void unnormalizedPathsAreRejected() {
DefaultHttpFirewall fw = new DefaultHttpFirewall();
for (String path : this.unnormalizedPaths) {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath(path);
MockHttpServletRequest request = get().requestUri(path).build();
assertThatExceptionOfType(RequestRejectedException.class)
.isThrownBy(() -> fw.getFirewalledRequest(request));
request.setPathInfo(path);
web/src/test/java/org/springframework/security/web/firewall/StrictHttpFirewallTests.java
+2 -2
View File
@@ -27,6 +27,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
/**
* @author Rob Winch
@@ -112,8 +113,7 @@ public class StrictHttpFirewallTests {
@Test
public void getFirewalledRequestWhenServletPathNotNormalizedThenThrowsRequestRejectedException() {
for (String path : this.unnormalizedPaths) {
this.request = new MockHttpServletRequest("GET", "");
this.request.setServletPath(path);
this.request = get().requestUri(path).build();
assertThatExceptionOfType(RequestRejectedException.class)
.isThrownBy(() -> this.firewall.getFirewalledRequest(this.request));
}
web/src/test/java/org/springframework/security/web/servlet/TestMockHttpServletRequests.java
+169
View File
@@ -0,0 +1,169 @@
/*
* Copyright 2004-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.servlet;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.function.Consumer;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import org.springframework.http.HttpMethod;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.util.StringUtils;
public final class TestMockHttpServletRequests {
private TestMockHttpServletRequests() {
}
public static Builder get() {
return new Builder(HttpMethod.GET);
}
public static Builder get(String url) {
return get().applyUrl(url);
}
public static Builder post() {
return new Builder(HttpMethod.POST);
}
public static Builder post(String url) {
return post().applyUrl(url);
}
public static Builder request(String method) {
return new Builder(HttpMethod.valueOf(method));
}
public static final class Builder {
private static final Pattern URL = Pattern.compile("((?<scheme>https?)://)?"
+ "((?<hostname>[^:/]+)(:(?<port>\\d+))?)?" + "(?<path>[^?]+)?" + "(\\?(?<query>.*))?");
private final HttpMethod method;
private String requestUri;
private final Map<String, String> parameters = new LinkedHashMap<>();
private String scheme = MockHttpServletRequest.DEFAULT_SCHEME;
private int port = MockHttpServletRequest.DEFAULT_SERVER_PORT;
private String hostname = MockHttpServletRequest.DEFAULT_SERVER_NAME;
private String contextPath;
private String servletPath;
private String pathInfo;
private String queryString;
private Builder(HttpMethod method) {
this.method = method;
}
private Builder applyUrl(String url) {
Matcher matcher = URL.matcher(url);
if (matcher.matches()) {
applyElement(this::scheme, matcher.group("scheme"));
applyElement(this::port, matcher.group("port"));
applyElement(this::serverName, matcher.group("hostname"));
applyElement(this::requestUri, matcher.group("path"));
applyElement(this::queryString, matcher.group("query"));
}
return this;
}
private <T> void applyElement(Consumer<T> apply, T value) {
if (value != null) {
apply.accept(value);
}
}
public Builder requestUri(String contextPath, String servletPath, String pathInfo) {
this.contextPath = contextPath;
this.servletPath = servletPath;
this.pathInfo = pathInfo;
this.requestUri = Stream.of(contextPath, servletPath, pathInfo)
.filter(StringUtils::hasText)
.collect(Collectors.joining());
return this;
}
public Builder requestUri(String requestUri) {
return requestUri(null, requestUri, null);
}
public Builder param(String name, String value) {
this.parameters.put(name, value);
return this;
}
private Builder port(String port) {
if (port != null) {
this.port = Integer.parseInt(port);
}
return this;
}
public Builder port(int port) {
this.port = port;
return this;
}
public Builder queryString(String queryString) {
this.queryString = queryString;
return this;
}
public Builder scheme(String scheme) {
this.scheme = scheme;
return this;
}
public Builder serverName(String serverName) {
this.hostname = serverName;
return this;
}
public MockHttpServletRequest build() {
MockHttpServletRequest request = new MockHttpServletRequest();
applyElement(request::setContextPath, this.contextPath);
applyElement(request::setContextPath, this.contextPath);
applyElement(request::setMethod, this.method.name());
applyElement(request::setParameters, this.parameters);
applyElement(request::setPathInfo, this.pathInfo);
applyElement(request::setServletPath, this.servletPath);
applyElement(request::setScheme, this.scheme);
applyElement(request::setServerPort, this.port);
applyElement(request::setServerName, this.hostname);
applyElement(request::setQueryString, this.queryString);
applyElement(request::setRequestURI, this.requestUri);
request.setSecure("https".equals(this.scheme));
return request;
}
}
}
web/src/test/java/org/springframework/security/web/util/matcher/RegexRequestMatcherTests.java
+2 -2
View File
@@ -28,6 +28,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.mockito.BDDMockito.given;
import static org.springframework.security.web.servlet.TestMockHttpServletRequests.get;
import static org.springframework.security.web.util.matcher.RegexRequestMatcher.regexMatcher;
/**
@@ -50,8 +51,7 @@ public class RegexRequestMatcherTests {
@Test
public void matchesIfHttpMethodAndPathMatch() {
RegexRequestMatcher matcher = new RegexRequestMatcher(".*", "GET");
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/anything");
request.setServletPath("/anything");
MockHttpServletRequest request = get("/anything").build();
assertThat(matcher.matches(request)).isTrue();
}