From 549de2927e00e43831861c29a92b1a9be18631d8 Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Thu, 7 Feb 2008 15:03:27 +0000 Subject: [PATCH] SEC-641: Avoid direct use of external classes in namespace parsing. --- .../LdapServerBeanDefinitionParser.java | 46 ++++++++----------- .../OrderedFilterBeanDefinitionDecorator.java | 12 ++--- .../config/PasswordEncoderParser.java | 1 - .../providers/ldap/LdapAuthenticator.java | 5 +- 4 files changed, 28 insertions(+), 36 deletions(-) diff --git a/core/src/main/java/org/springframework/security/config/LdapServerBeanDefinitionParser.java b/core/src/main/java/org/springframework/security/config/LdapServerBeanDefinitionParser.java index 309dc15f6e..54401b4530 100644 --- a/core/src/main/java/org/springframework/security/config/LdapServerBeanDefinitionParser.java +++ b/core/src/main/java/org/springframework/security/config/LdapServerBeanDefinitionParser.java @@ -6,18 +6,15 @@ import org.springframework.beans.factory.xml.ParserContext; import org.springframework.beans.factory.xml.AbstractBeanDefinitionParser; import org.springframework.beans.factory.config.BeanDefinition; import org.springframework.beans.factory.support.RootBeanDefinition; +import org.springframework.beans.factory.support.BeanDefinitionBuilder; +import org.springframework.beans.factory.support.ManagedSet; import org.springframework.ldap.core.DirContextAdapter; import org.springframework.util.StringUtils; import org.w3c.dom.Element; -import org.apache.directory.server.configuration.MutableServerStartupConfiguration; -import org.apache.directory.server.core.partition.impl.btree.MutableBTreePartitionConfiguration; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; -import javax.naming.NamingException; -import java.util.HashSet; - /** * @author Luke Taylor * @version $Id$ @@ -89,24 +86,23 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser { * * Registers beans to create an embedded apache directory server. * - * @param element - * @param parserContext - * * @return the BeanDefinition for the ContextSource for the embedded server. * * @see ApacheDSContainer */ private RootBeanDefinition createEmbeddedServer(Element element, ParserContext parserContext) { - MutableServerStartupConfiguration configuration = new MutableServerStartupConfiguration(); - MutableBTreePartitionConfiguration partition = new MutableBTreePartitionConfiguration(); - - partition.setName("springsecurity"); + Object source = parserContext.extractSource(element); + BeanDefinitionBuilder configuration = BeanDefinitionBuilder.rootBeanDefinition("org.apache.directory.server.configuration.MutableServerStartupConfiguration"); + BeanDefinitionBuilder partition = BeanDefinitionBuilder.rootBeanDefinition("org.apache.directory.server.core.partition.impl.btree.MutableBTreePartitionConfiguration"); + configuration.setSource(source); + partition.setSource(source); DirContextAdapter rootContext = new DirContextAdapter(); rootContext.setAttributeValues("objectClass", new String[] {"top", "domain", "extensibleObject"}); rootContext.setAttributeValue("dc", "springsecurity"); - partition.setContextEntry(rootContext.getAttributes()); + partition.addPropertyValue("name", "springsecurity"); + partition.addPropertyValue("contextEntry", rootContext.getAttributes()); String suffix = element.getAttribute(ATT_ROOT_SUFFIX); @@ -114,14 +110,10 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser { suffix = OPT_DEFAULT_ROOT_SUFFIX; } - try { - partition.setSuffix(suffix); - } catch (NamingException e) { - parserContext.getReaderContext().error("Failed to set root name suffix to " + suffix, element, e); - } + partition.addPropertyValue("suffix", suffix); - HashSet partitions = new HashSet(1); - partitions.add(partition); + ManagedSet partitions = new ManagedSet(1); + partitions.add(partition.getBeanDefinition()); String port = element.getAttribute(ATT_PORT); @@ -129,13 +121,13 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser { port = OPT_DEFAULT_PORT; } - configuration.setLdapPort(Integer.parseInt(port)); + configuration.addPropertyValue("ldapPort", port); // We shut down the server ourself when the app context is closed so we don't need // the extra shutdown hook from apache DS itself. - configuration.setShutdownHookEnabled(false); - configuration.setExitVmOnShutdown(false); - configuration.setContextPartitionConfigurations(partitions); + configuration.addPropertyValue("shutdownHookEnabled", Boolean.FALSE); + configuration.addPropertyValue("exitVmOnShutdown", Boolean.FALSE); + configuration.addPropertyValue("contextPartitionConfigurations", partitions); String url = "ldap://127.0.0.1:" + port + "/" + suffix; @@ -144,9 +136,9 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser { contextSource.getPropertyValues().addPropertyValue("userDn", "uid=admin,ou=system"); contextSource.getPropertyValues().addPropertyValue("password", "secret"); - RootBeanDefinition apacheContainer = new RootBeanDefinition(ApacheDSContainer.class); - apacheContainer.setSource(parserContext.extractSource(element)); - apacheContainer.getConstructorArgumentValues().addGenericArgumentValue(configuration); + RootBeanDefinition apacheContainer = new RootBeanDefinition("org.springframework.security.config.ApacheDSContainer", null, null); + apacheContainer.setSource(source); + apacheContainer.getConstructorArgumentValues().addGenericArgumentValue(configuration.getBeanDefinition()); apacheContainer.getConstructorArgumentValues().addGenericArgumentValue(contextSource); String ldifs = element.getAttribute(ATT_LDIF_FILE); diff --git a/core/src/main/java/org/springframework/security/config/OrderedFilterBeanDefinitionDecorator.java b/core/src/main/java/org/springframework/security/config/OrderedFilterBeanDefinitionDecorator.java index 4489cf10ea..bf84421984 100644 --- a/core/src/main/java/org/springframework/security/config/OrderedFilterBeanDefinitionDecorator.java +++ b/core/src/main/java/org/springframework/security/config/OrderedFilterBeanDefinitionDecorator.java @@ -5,7 +5,7 @@ import org.springframework.beans.factory.xml.BeanDefinitionDecorator; import org.springframework.beans.factory.xml.ParserContext; import org.springframework.beans.factory.config.BeanDefinitionHolder; import org.springframework.beans.factory.config.BeanDefinition; -import org.springframework.beans.factory.support.RootBeanDefinition; +import org.springframework.beans.factory.support.BeanDefinitionBuilder; import org.springframework.core.Ordered; import org.springframework.util.StringUtils; import org.springframework.util.Assert; @@ -39,15 +39,15 @@ public class OrderedFilterBeanDefinitionDecorator implements BeanDefinitionDecor String order = getOrder(elt, parserContext); BeanDefinition filter = holder.getBeanDefinition(); - BeanDefinition wrapper = new RootBeanDefinition(OrderedFilterDecorator.class); - wrapper.getConstructorArgumentValues().addIndexedArgumentValue(0, holder.getBeanName()); - wrapper.getConstructorArgumentValues().addIndexedArgumentValue(1, filter); + BeanDefinitionBuilder wrapper = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.config.OrderedFilterBeanDefinitionDecorator$OrderedFilterDecorator"); + wrapper.addConstructorArg(holder.getBeanName()); + wrapper.addConstructorArg(filter); if (StringUtils.hasText(order)) { - wrapper.getPropertyValues().addPropertyValue("order", order); + wrapper.addPropertyValue("order", order); } - return new BeanDefinitionHolder(wrapper, holder.getBeanName()); + return new BeanDefinitionHolder(wrapper.getBeanDefinition(), holder.getBeanName()); } /** diff --git a/core/src/main/java/org/springframework/security/config/PasswordEncoderParser.java b/core/src/main/java/org/springframework/security/config/PasswordEncoderParser.java index 57609544b3..b9052009e0 100644 --- a/core/src/main/java/org/springframework/security/config/PasswordEncoderParser.java +++ b/core/src/main/java/org/springframework/security/config/PasswordEncoderParser.java @@ -5,7 +5,6 @@ import org.springframework.security.providers.encoding.Md5PasswordEncoder; import org.springframework.security.providers.encoding.ShaPasswordEncoder; import org.springframework.security.providers.encoding.BaseDigestPasswordEncoder; import org.springframework.security.providers.ldap.authenticator.LdapShaPasswordEncoder; -import org.springframework.beans.factory.xml.BeanDefinitionParser; import org.springframework.beans.factory.xml.ParserContext; import org.springframework.beans.factory.config.BeanDefinition; import org.springframework.beans.factory.config.RuntimeBeanReference; diff --git a/core/src/main/java/org/springframework/security/providers/ldap/LdapAuthenticator.java b/core/src/main/java/org/springframework/security/providers/ldap/LdapAuthenticator.java index 205dd4d92f..bed5b2e076 100644 --- a/core/src/main/java/org/springframework/security/providers/ldap/LdapAuthenticator.java +++ b/core/src/main/java/org/springframework/security/providers/ldap/LdapAuthenticator.java @@ -24,11 +24,12 @@ import org.springframework.ldap.core.DirContextOperations; *

* The LdapAuthenticationProvider calls this interface to authenticate a user * and obtain the information for that user from the directory. - *

- * * * @author Luke Taylor * @version $Id$ + * + * @see org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator + * @see org.springframework.security.ldap.populator.UserDetailsServiceLdapAuthoritiesPopulator */ public interface LdapAuthenticator { //~ Methods ========================================================================================================