SEC-632: Explicit filter chain ordering is now achieved using "after" or "before". Setting the order value directly in the context is fragile due to potential future changes in the order values of standard filters.
This commit is contained in:
+4
-4
@@ -146,7 +146,7 @@ public class HttpSecurityBeanDefinitionParserTests {
|
||||
setContext(
|
||||
" <http auto-config='true'>" +
|
||||
" <intercept-url pattern='/**' access='ROLE_C' />" +
|
||||
" <intercept-url pattern='/secure*' method='DELETE' access='ROLE_SUPERVISOR' />" +
|
||||
" <intercept-url pattern='/secure*' method='DELETE' access='ROLE_SUPERVISOR' />" +
|
||||
" <intercept-url pattern='/secure*' method='POST' access='ROLE_A,ROLE_B' />" +
|
||||
" </http>" + AUTH_PROVIDER_XML);
|
||||
|
||||
@@ -199,14 +199,14 @@ public class HttpSecurityBeanDefinitionParserTests {
|
||||
setContext(
|
||||
"<http auto-config='true'/>" + AUTH_PROVIDER_XML +
|
||||
"<b:bean id='userFilter' class='org.springframework.security.util.MockFilter'>" +
|
||||
" <user-filter order='0'/>" +
|
||||
" <user-filter after='SESSION_CONTEXT_INTEGRATION_FILTER'/>" +
|
||||
"</b:bean>" +
|
||||
"<b:bean id='userFilter2' class='org.springframework.security.util.MockFilter'/>");
|
||||
List filters = getFilterChainProxy().getFilters("/someurl");
|
||||
|
||||
assertEquals(11, filters.size());
|
||||
assertTrue(filters.get(10) instanceof OrderedFilterBeanDefinitionDecorator.OrderedFilterDecorator);
|
||||
assertEquals("userFilter", ((OrderedFilterBeanDefinitionDecorator.OrderedFilterDecorator)filters.get(10)).getBeanName());
|
||||
assertTrue(filters.get(1) instanceof OrderedFilterBeanDefinitionDecorator.OrderedFilterDecorator);
|
||||
assertEquals("userFilter", ((OrderedFilterBeanDefinitionDecorator.OrderedFilterDecorator)filters.get(1)).getBeanName());
|
||||
}
|
||||
|
||||
@Test
|
||||
|
||||
@@ -68,8 +68,7 @@ public class X509TestUtils {
|
||||
* [signature omitted]
|
||||
* </pre>
|
||||
*/
|
||||
public static X509Certificate buildTestCertificate()
|
||||
throws Exception {
|
||||
public static X509Certificate buildTestCertificate() throws Exception {
|
||||
String cert = "-----BEGIN CERTIFICATE-----\n"
|
||||
+ "MIIEQTCCAymgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBkzEaMBgGA1UEAxMRTW9u\n"
|
||||
+ "a2V5IE1hY2hpbmUgQ0ExCzAJBgNVBAYTAlVLMREwDwYDVQQIEwhTY290bGFuZDEQ\n"
|
||||
|
||||
Reference in New Issue
Block a user