Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-03 08:51:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added checking of path ordering to FilterChainProxy to detect misplaced universal match ("/**").

Browse Source
This commit is contained in:
Luke Taylor
2007-10-26 13:51:32 +00:00
parent 1bcb62af2e
commit 55ef50a4df
3 changed files with 39 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/test/java/org/springframework/security/util/FilterChainProxyTests.java
+14 -5
View File
@@ -16,6 +16,11 @@
package org.springframework.security.util;
import org.junit.After;
import static org.junit.Assert.*;
import org.junit.Before;
import org.junit.Test;
import org.springframework.beans.factory.BeanCreationException;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
@@ -28,11 +33,6 @@ import org.springframework.security.intercept.web.MockFilterInvocationDefinition
import org.springframework.security.intercept.web.PathBasedFilterInvocationDefinitionMap;
import org.springframework.security.ui.webapp.AuthenticationProcessingFilter;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
import static org.junit.Assert.*;
import java.util.List;
/**
@@ -126,6 +126,15 @@ public class FilterChainProxyTests {
assertFalse(filter.isWasDestroyed());
}
@Test
public void misplacedUniversalPathShouldBeDetected() throws Exception {
try {
appCtx.getBean("newFilterChainProxyWrongPathOrder", FilterChainProxy.class);
fail("Expected BeanCreationException");
} catch (BeanCreationException expected) {
}
}
@Test
public void normalOperation() throws Exception {
FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChain", FilterChainProxy.class);
core/src/test/resources/org/springframework/security/util/filtertest-valid.xml
+9 -1
View File
@@ -18,7 +18,7 @@
*
* $Id$
-->
<beans xmlns="http://www.springframework.org/schema/beans"
<beans default-lazy-init="true" xmlns="http://www.springframework.org/schema/beans"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
@@ -62,6 +62,14 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc
</sec:filter-chain-map>
</bean>
<bean id="newFilterChainProxyWrongPathOrder" class="org.springframework.security.util.FilterChainProxy">
<sec:filter-chain-map pathType="ant">
<sec:filter-chain pattern="/foo/**" filters="mockFilter"/>
<sec:filter-chain pattern="/**" filters="sif,apf,mockFilter"/>
<sec:filter-chain pattern="/some/other/path/**" filters="sif,mockFilter,mockFilter2"/>
</sec:filter-chain-map>
</bean>
<bean id="newFilterChainProxyRegex" class="org.springframework.security.util.FilterChainProxy">
<sec:filter-chain-map pathType="regex">
<sec:filter-chain pattern="\A/foo/.*\Z" filters="mockFilter"/>