Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-04 01:07:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2758: Make ROLE_ consistent

Browse Source
This commit is contained in:
Rob Winch
2015-01-29 16:57:56 -06:00
parent 753fdcaef0
commit 6627f76df7
17 changed files with 479 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/springframework/security/access/annotation/Jsr250MethodSecurityMetadataSource.java
+33 -1
View File
@@ -38,6 +38,24 @@ import org.springframework.security.access.method.AbstractFallbackMethodSecurity
*/
public class Jsr250MethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {
private String defaultRolePrefix = "ROLE_";
/**
* <p>
* Sets the default prefix to be added to {@link RolesAllowed}. For example, if {@code @RolesAllowed("ADMIN")} or {@code @RolesAllowed("ADMIN")} is used,
* then the role ROLE_ADMIN will be used when the defaultRolePrefix is "ROLE_" (default).
* </p>
*
* <p>
* If null or empty, then no default role prefix is used.
* </p>
*
* @param defaultRolePrefix the default prefix to add to roles. Default "ROLE_".
*/
public void setDefaultRolePrefix(String defaultRolePrefix) {
this.defaultRolePrefix = defaultRolePrefix;
}
protected Collection<ConfigAttribute> findAttributes(Class<?> clazz) {
return processAnnotations(clazz.getAnnotations());
}
@@ -69,11 +87,25 @@ public class Jsr250MethodSecurityMetadataSource extends AbstractFallbackMethodSe
RolesAllowed ra = (RolesAllowed) a;
for (String allowed : ra.value()) {
attributes.add(new Jsr250SecurityConfig(allowed));
String defaultedAllowed = getRoleWithDefaultPrefix(allowed);
attributes.add(new Jsr250SecurityConfig(defaultedAllowed));
}
return attributes;
}
}
return null;
}
private String getRoleWithDefaultPrefix(String role) {
if(role == null) {
return role;
}
if(defaultRolePrefix == null || defaultRolePrefix.length() == 0) {
return role;
}
if(role.startsWith(defaultRolePrefix)) {
return role;
}
return defaultRolePrefix + role;
}
}
core/src/main/java/org/springframework/security/access/expression/SecurityExpressionRoot.java
+48 -4
View File
@@ -24,6 +24,7 @@ public abstract class SecurityExpressionRoot implements SecurityExpressionOperat
private AuthenticationTrustResolver trustResolver;
private RoleHierarchy roleHierarchy;
private Set<String> roles;
private String defaultRolePrefix = "ROLE_";
/** Allows "permitAll" expression */
public final boolean permitAll = true;
@@ -49,22 +50,27 @@ public abstract class SecurityExpressionRoot implements SecurityExpressionOperat
}
public final boolean hasAuthority(String authority) {
return hasRole(authority);
return hasAnyAuthority(authority);
}
public final boolean hasAnyAuthority(String... authorities) {
return hasAnyRole(authorities);
return hasAnyAuthorityName(null, authorities);
}
public final boolean hasRole(String role) {
return getAuthoritySet().contains(role);
return hasAnyRole(role);
}
public final boolean hasAnyRole(String... roles) {
return hasAnyAuthorityName(defaultRolePrefix, roles);
}
private boolean hasAnyAuthorityName(String prefix, String... roles) {
Set<String> roleSet = getAuthoritySet();
for (String role : roles) {
if (roleSet.contains(role)) {
String defaultedRole = getRoleWithDefaultPrefix(prefix, role);
if (roleSet.contains(defaultedRole)) {
return true;
}
}
@@ -116,6 +122,23 @@ public abstract class SecurityExpressionRoot implements SecurityExpressionOperat
this.roleHierarchy = roleHierarchy;
}
/**
* <p>
* Sets the default prefix to be added to {@link #hasAnyRole(String...)} or
* {@link #hasRole(String)}. For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN") is passed in,
* then the role ROLE_ADMIN will be used when the defaultRolePrefix is "ROLE_" (default).
* </p>
*
* <p>
* If null or empty, then no default role prefix is used.
* </p>
*
* @param defaultRolePrefix the default prefix to add to roles. Default "ROLE_".
*/
public void setDefaultRolePrefix(String defaultRolePrefix) {
this.defaultRolePrefix = defaultRolePrefix;
}
private Set<String> getAuthoritySet() {
if (roles == null) {
roles = new HashSet<String>();
@@ -143,4 +166,25 @@ public abstract class SecurityExpressionRoot implements SecurityExpressionOperat
public void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
this.permissionEvaluator = permissionEvaluator;
}
/**
* Prefixes role with defaultRolePrefix if defaultRolePrefix is non-null and
* if role does not already start with defaultRolePrefix.
*
* @param defaultRolePrefix
* @param role
* @return
*/
private static String getRoleWithDefaultPrefix(String defaultRolePrefix, String role) {
if(role == null) {
return role;
}
if(defaultRolePrefix == null || defaultRolePrefix.length() == 0) {
return role;
}
if(role.startsWith(defaultRolePrefix)) {
return role;
}
return defaultRolePrefix + role;
}
}
core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java
+19
View File
@@ -37,6 +37,7 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
private ParameterNameDiscoverer parameterNameDiscoverer = new DefaultSecurityParameterNameDiscoverer();
private PermissionCacheOptimizer permissionCacheOptimizer = null;
private String defaultRolePrefix = "ROLE_";
public DefaultMethodSecurityExpressionHandler() {
}
@@ -57,6 +58,7 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr
root.setPermissionEvaluator(getPermissionEvaluator());
root.setTrustResolver(trustResolver);
root.setRoleHierarchy(getRoleHierarchy());
root.setDefaultRolePrefix(defaultRolePrefix);
return root;
}
@@ -172,4 +174,21 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr
public void setReturnObject(Object returnObject, EvaluationContext ctx) {
((MethodSecurityExpressionOperations)ctx.getRootObject().getValue()).setReturnObject(returnObject);
}
/**
* <p>
* Sets the default prefix to be added to {@link #hasAnyRole(String...)} or
* {@link #hasRole(String)}. For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN") is passed in,
* then the role ROLE_ADMIN will be used when the defaultRolePrefix is "ROLE_" (default).
* </p>
*
* <p>
* If null or empty, then no default role prefix is used.
* </p>
*
* @param defaultRolePrefix the default prefix to add to roles. Default "ROLE_".
*/
public void setDefaultRolePrefix(String defaultRolePrefix) {
this.defaultRolePrefix = defaultRolePrefix;
}
}
core/src/test/java/org/springframework/security/access/annotation/BusinessService.java
+3
View File
@@ -47,6 +47,9 @@ public interface BusinessService extends Serializable {
@RolesAllowed({"ROLE_USER"})
public void someUserMethod2();
@RolesAllowed({"USER"})
public void rolesAllowedUser();
public int someOther(String s);
public int someOther(int input);
core/src/test/java/org/springframework/security/access/annotation/BusinessServiceImpl.java
+3
View File
@@ -49,4 +49,7 @@ public class BusinessServiceImpl<E extends Entity> implements BusinessService {
return null;
}
public void rolesAllowedUser() {
}
}
core/src/test/java/org/springframework/security/access/annotation/ExpressionProtectedBusinessServiceImpl.java
+4
View File
@@ -49,4 +49,8 @@ public class ExpressionProtectedBusinessServiceImpl implements BusinessService {
public void methodWithBeanNamePropertyAccessExpression(String x) {
}
public void rolesAllowedUser() {
}
}
core/src/test/java/org/springframework/security/access/annotation/Jsr250BusinessServiceImpl.java
+4
View File
@@ -50,4 +50,8 @@ public class Jsr250BusinessServiceImpl implements BusinessService {
return null;
}
@RolesAllowed({"USER"})
public void rolesAllowedUser() {
}
}
core/src/test/java/org/springframework/security/access/annotation/Jsr250MethodDefinitionSourceTests.java → core/src/test/java/org/springframework/security/access/annotation/Jsr250MethodSecurityMetadataSourceTests.java
+55 -10
View File
@@ -24,6 +24,7 @@ import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.intercept.method.MockMethodInvocation;
@@ -32,10 +33,17 @@ import org.springframework.security.access.intercept.method.MockMethodInvocation
* @author Luke Taylor
* @author Ben Alex
*/
public class Jsr250MethodDefinitionSourceTests {
Jsr250MethodSecurityMetadataSource mds = new Jsr250MethodSecurityMetadataSource();
A a = new A();
UserAllowedClass userAllowed = new UserAllowedClass();
public class Jsr250MethodSecurityMetadataSourceTests {
Jsr250MethodSecurityMetadataSource mds;
A a;
UserAllowedClass userAllowed;
@Before
public void setup() {
mds = new Jsr250MethodSecurityMetadataSource();
a = new A();
userAllowed = new UserAllowedClass();
}
private ConfigAttribute[] findAttributes(String methodName) throws Exception {
return mds.findAttributes(a.getClass().getMethod(methodName), null).toArray(new ConfigAttribute[0]);
@@ -45,7 +53,7 @@ public class Jsr250MethodDefinitionSourceTests {
public void methodWithRolesAllowedHasCorrectAttribute() throws Exception {
ConfigAttribute[] accessAttributes = findAttributes("adminMethod");
assertEquals(1, accessAttributes.length);
assertEquals("ADMIN", accessAttributes[0].toString());
assertEquals("ROLE_ADMIN", accessAttributes[0].toString());
}
@Test
@@ -71,7 +79,41 @@ public class Jsr250MethodDefinitionSourceTests {
public void methodRoleOverridesClassRole() throws Exception {
Collection<ConfigAttribute> accessAttributes = mds.findAttributes(userAllowed.getClass().getMethod("adminMethod"), null);
assertEquals(1, accessAttributes.size());
assertEquals("ADMIN", accessAttributes.toArray()[0].toString());
assertEquals("ROLE_ADMIN", accessAttributes.toArray()[0].toString());
}
@Test
public void customDefaultRolePrefix() throws Exception {
mds.setDefaultRolePrefix("CUSTOMPREFIX_");
ConfigAttribute[] accessAttributes = findAttributes("adminMethod");
assertEquals(1, accessAttributes.length);
assertEquals("CUSTOMPREFIX_ADMIN", accessAttributes[0].toString());
}
@Test
public void emptyDefaultRolePrefix() throws Exception {
mds.setDefaultRolePrefix("");
ConfigAttribute[] accessAttributes = findAttributes("adminMethod");
assertEquals(1, accessAttributes.length);
assertEquals("ADMIN", accessAttributes[0].toString());
}
@Test
public void nullDefaultRolePrefix() throws Exception {
mds.setDefaultRolePrefix(null);
ConfigAttribute[] accessAttributes = findAttributes("adminMethod");
assertEquals(1, accessAttributes.length);
assertEquals("ADMIN", accessAttributes[0].toString());
}
@Test
public void alreadyHasDefaultPrefix() throws Exception {
ConfigAttribute[] accessAttributes = findAttributes("roleAdminMethod");
assertEquals(1, accessAttributes.length);
assertEquals("ROLE_ADMIN", accessAttributes[0].toString());
}
// JSR-250 Spec Tests
@@ -98,7 +140,7 @@ public class Jsr250MethodDefinitionSourceTests {
Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
assertEquals(1, accessAttributes.size());
assertEquals("DERIVED", accessAttributes.toArray()[0].toString());
assertEquals("ROLE_DERIVED", accessAttributes.toArray()[0].toString());
}
@Test
@@ -108,7 +150,7 @@ public class Jsr250MethodDefinitionSourceTests {
Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
assertEquals(1, accessAttributes.size());
assertEquals("DERIVED", accessAttributes.toArray()[0].toString());
assertEquals("ROLE_DERIVED", accessAttributes.toArray()[0].toString());
}
@Test
@@ -118,7 +160,7 @@ public class Jsr250MethodDefinitionSourceTests {
Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
assertEquals(1, accessAttributes.size());
assertEquals("EXPLICIT", accessAttributes.toArray()[0].toString());
assertEquals("ROLE_EXPLICIT", accessAttributes.toArray()[0].toString());
}
/**
@@ -151,7 +193,7 @@ public class Jsr250MethodDefinitionSourceTests {
Collection<ConfigAttribute> accessAttributes = mds.getAttributes(mi);
assertEquals(1, accessAttributes.size());
assertEquals("DERIVED", accessAttributes.toArray()[0].toString());
assertEquals("ROLE_DERIVED", accessAttributes.toArray()[0].toString());
}
//~ Inner Classes ======================================================================================================
@@ -163,6 +205,9 @@ public class Jsr250MethodDefinitionSourceTests {
@RolesAllowed("ADMIN")
public void adminMethod() {}
@RolesAllowed("ROLE_ADMIN")
public void roleAdminMethod() {}
@PermitAll
public void permitAllMethod() {}
}
core/src/test/java/org/springframework/security/access/expression/SecurityExpressionRootTests.java
+74 -8
View File
@@ -3,9 +3,11 @@ package org.springframework.security.access.expression;
import static org.junit.Assert.*;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
import static org.fest.assertions.Assertions.*;
import java.util.Collection;
import org.junit.Before;
import org.junit.Test;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.authentication.AuthenticationTrustResolver;
@@ -20,11 +22,17 @@ import org.springframework.security.core.authority.AuthorityUtils;
* @since 3.0
*/
public class SecurityExpressionRootTests {
final static Authentication JOE = new TestingAuthenticationToken("joe", "pass", "A", "B");
final static Authentication JOE = new TestingAuthenticationToken("joe", "pass", "ROLE_A", "ROLE_B");
SecurityExpressionRoot root;
@Before
public void setup() {
root = new SecurityExpressionRoot(JOE) {};
}
@Test
public void denyAllIsFalsePermitAllTrue() throws Exception {
SecurityExpressionRoot root = new SecurityExpressionRoot(JOE) {};
assertFalse(root.denyAll());
assertFalse(root.denyAll);
assertTrue(root.permitAll());
@@ -33,7 +41,6 @@ public class SecurityExpressionRootTests {
@Test
public void rememberMeIsCorrectlyDetected() throws Exception {
SecurityExpressionRoot root = new SecurityExpressionRoot(JOE) {};
AuthenticationTrustResolver atr = mock(AuthenticationTrustResolver.class);
root.setTrustResolver(atr);
when(atr.isRememberMe(JOE)).thenReturn(true);
@@ -43,20 +50,79 @@ public class SecurityExpressionRootTests {
@Test
public void roleHierarchySupportIsCorrectlyUsedInEvaluatingRoles() throws Exception {
SecurityExpressionRoot root = new SecurityExpressionRoot(JOE) {};
root.setRoleHierarchy(new RoleHierarchy() {
public Collection<GrantedAuthority> getReachableGrantedAuthorities(Collection<? extends GrantedAuthority> authorities) {
return AuthorityUtils.createAuthorityList("C");
return AuthorityUtils.createAuthorityList("ROLE_C");
}
});
assertTrue(root.hasRole("C"));
assertTrue(root.hasAuthority("C"));
assertTrue(root.hasAuthority("ROLE_C"));
assertFalse(root.hasRole("A"));
assertFalse(root.hasRole("B"));
assertTrue(root.hasAnyRole("C", "A", "B"));
assertTrue(root.hasAnyAuthority("C", "A", "B"));
assertTrue(root.hasAnyAuthority("ROLE_C", "ROLE_A", "ROLE_B"));
assertFalse(root.hasAnyRole("A", "B"));
}
@Test
public void hasRoleAddsDefaultPrefix() throws Exception {
assertThat(root.hasRole("A")).isTrue();
assertThat(root.hasRole("NO")).isFalse();
}
@Test
public void hasRoleEmptyPrefixDoesNotAddsDefaultPrefix() throws Exception {
root.setDefaultRolePrefix("");
assertThat(root.hasRole("A")).isFalse();
assertThat(root.hasRole("ROLE_A")).isTrue();
}
@Test
public void hasRoleNullPrefixDoesNotAddsDefaultPrefix() throws Exception {
root.setDefaultRolePrefix(null);
assertThat(root.hasRole("A")).isFalse();
assertThat(root.hasRole("ROLE_A")).isTrue();
}
@Test
public void hasRoleDoesNotAddDefaultPrefixForAlreadyPrefixedRoles() throws Exception {
SecurityExpressionRoot root = new SecurityExpressionRoot(JOE) {};
assertThat(root.hasRole("ROLE_A")).isTrue();
assertThat(root.hasRole("ROLE_NO")).isFalse();
}
@Test
public void hasAnyRoleAddsDefaultPrefix() throws Exception {
assertThat(root.hasAnyRole("NO","A")).isTrue();
assertThat(root.hasAnyRole("NO","NOT")).isFalse();
}
@Test
public void hasAnyRoleDoesNotAddDefaultPrefixForAlreadyPrefixedRoles() throws Exception {
assertThat(root.hasAnyRole("ROLE_NO","ROLE_A")).isTrue();
assertThat(root.hasAnyRole("ROLE_NO","ROLE_NOT")).isFalse();
}
@Test
public void hasAnyRoleEmptyPrefixDoesNotAddsDefaultPrefix() throws Exception {
root.setDefaultRolePrefix("");
assertThat(root.hasRole("A")).isFalse();
assertThat(root.hasRole("ROLE_A")).isTrue();
}
@Test
public void hasAnyRoleNullPrefixDoesNotAddsDefaultPrefix() throws Exception {
root.setDefaultRolePrefix(null);
assertThat(root.hasAnyRole("A")).isFalse();
assertThat(root.hasAnyRole("ROLE_A")).isTrue();
}
@Test
public void hasAuthorityDoesNotAddDefaultPrefix() throws Exception {
assertThat(root.hasAuthority("A")).isFalse();
assertThat(root.hasAnyAuthority("NO","A")).isFalse();
assertThat(root.hasAnyAuthority("ROLE_A","NOT")).isTrue();
}
}
core/src/test/java/org/springframework/security/access/expression/method/MethodExpressionVoterTests.java
+1 -1
View File
@@ -19,7 +19,7 @@ import org.springframework.security.util.SimpleMethodInvocation;
@SuppressWarnings("unchecked")
public class MethodExpressionVoterTests {
private TestingAuthenticationToken joe = new TestingAuthenticationToken("joe", "joespass", "blah");
private TestingAuthenticationToken joe = new TestingAuthenticationToken("joe", "joespass", "ROLE_blah");
private PreInvocationAuthorizationAdviceVoter am =
new PreInvocationAuthorizationAdviceVoter(new ExpressionBasedPreInvocationAdvice());