Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-02 16:27:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Default AntPathRequestMatcher to be case sensitive

Browse Source 
Issue gh-3831
This commit is contained in:
Rob Winch
2016-04-20 10:41:02 -05:00
parent 6fa1588de9
commit 7fe0a135ec
6 changed files with 81 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy
+41 -41
View File
@@ -136,17 +136,17 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
}
def debugFilterHandlesMissingAndEmptyFilterChains() {
when:
xml.debug()
xml.http(pattern: '/unprotected', security: 'none')
createAppContext()
then:
Filter debugFilter = appContext.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN);
MockHttpServletRequest request = new MockHttpServletRequest()
request.setServletPath("/unprotected");
debugFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
request.setServletPath("/nomatch");
debugFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
when:
xml.debug()
xml.http(pattern: '/unprotected', security: 'none')
createAppContext()
then:
Filter debugFilter = appContext.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN);
MockHttpServletRequest request = new MockHttpServletRequest()
request.setServletPath("/unprotected");
debugFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
request.setServletPath("/nomatch");
debugFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
}
def regexPathsWorkCorrectly() {
@@ -254,39 +254,39 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
attrs.contains(new SecurityConfig("ROLE_B"))
}
def httpMethodMatchIsSupportedForRequiresChannel() {
httpAutoConfig {
'intercept-url'(pattern: '/anyurl')
'intercept-url'(pattern: '/anyurl', 'method':'GET',access: 'ROLE_ADMIN', 'requires-channel': 'https')
}
createAppContext()
def httpMethodMatchIsSupportedForRequiresChannel() {
httpAutoConfig {
'intercept-url'(pattern: '/anyurl')
'intercept-url'(pattern: '/anyurl', 'method':'GET',access: 'ROLE_ADMIN', 'requires-channel': 'https')
}
createAppContext()
def fids = getFilter(ChannelProcessingFilter).getSecurityMetadataSource();
def attrs = fids.getAttributes(createFilterinvocation("/anyurl", "GET"));
def attrsPost = fids.getAttributes(createFilterinvocation("/anyurl", "POST"));
def fids = getFilter(ChannelProcessingFilter).getSecurityMetadataSource();
def attrs = fids.getAttributes(createFilterinvocation("/anyurl", "GET"));
def attrsPost = fids.getAttributes(createFilterinvocation("/anyurl", "POST"));
expect:
attrs.size() == 1
attrs.contains(new SecurityConfig("REQUIRES_SECURE_CHANNEL"))
attrsPost == null
}
expect:
attrs.size() == 1
attrs.contains(new SecurityConfig("REQUIRES_SECURE_CHANNEL"))
attrsPost == null
}
def httpMethodMatchIsSupportedForRequiresChannelAny() {
httpAutoConfig {
'intercept-url'(pattern: '/**')
'intercept-url'(pattern: '/**', 'method':'GET',access: 'ROLE_ADMIN', 'requires-channel': 'https')
}
createAppContext()
def httpMethodMatchIsSupportedForRequiresChannelAny() {
httpAutoConfig {
'intercept-url'(pattern: '/**')
'intercept-url'(pattern: '/**', 'method':'GET',access: 'ROLE_ADMIN', 'requires-channel': 'https')
}
createAppContext()
def fids = getFilter(ChannelProcessingFilter).getSecurityMetadataSource();
def attrs = fids.getAttributes(createFilterinvocation("/anyurl", "GET"));
def attrsPost = fids.getAttributes(createFilterinvocation("/anyurl", "POST"));
def fids = getFilter(ChannelProcessingFilter).getSecurityMetadataSource();
def attrs = fids.getAttributes(createFilterinvocation("/anyurl", "GET"));
def attrsPost = fids.getAttributes(createFilterinvocation("/anyurl", "POST"));
expect:
attrs.size() == 1
attrs.contains(new SecurityConfig("REQUIRES_SECURE_CHANNEL"))
attrsPost == null
}
expect:
attrs.size() == 1
attrs.contains(new SecurityConfig("REQUIRES_SECURE_CHANNEL"))
attrsPost == null
}
def oncePerRequestAttributeIsSupported() {
xml.http('once-per-request': 'false') {
@@ -498,7 +498,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
createAppContext()
def fis = getFilter(FilterSecurityInterceptor)
def fids = fis.securityMetadataSource
Collection attrs = fids.getAttributes(createFilterinvocation("/someurl", null));
Collection attrs = fids.getAttributes(createFilterinvocation("/someUrl", null));
expect:
attrs.size() == 1
@@ -716,7 +716,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
def httpFirewallInjectionIsSupported() {
xml.'http-firewall'(ref: 'fw')
xml.http() {
'form-login'()
'form-login'()
}
bean('fw', DefaultHttpFirewall)
createAppContext()
config/src/test/groovy/org/springframework/security/config/http/PlaceHolderAndELConfigTests.groovy
+2 -2
View File
@@ -39,7 +39,7 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {
// SEC-1201
def interceptUrlsAndFormLoginSupportPropertyPlaceholders() {
System.setProperty("secure.Url", "/Secure");
System.setProperty("secure.Url", "/secure");
System.setProperty("secure.role", "ROLE_A");
System.setProperty("login.page", "/loginPage");
System.setProperty("default.target", "/defaultTarget");
@@ -60,7 +60,7 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {
// SEC-1309
def interceptUrlsAndFormLoginSupportEL() {
System.setProperty("secure.url", "/Secure");
System.setProperty("secure.url", "/secure");
System.setProperty("secure.role", "ROLE_A");
System.setProperty("login.page", "/loginPage");
System.setProperty("default.target", "/defaultTarget");
config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeRequestsTests.java
+3 -2
View File
@@ -40,6 +40,7 @@ import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextImpl;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import static org.assertj.core.api.Assertions.assertThat;
@@ -151,7 +152,7 @@ public class AuthorizeRequestsTests {
// @formatter:off
http
.authorizeRequests()
.antMatchers("/user/{user}").access("#user == 'user'")
.requestMatchers(new AntPathRequestMatcher("/user/{user}", null, false)).access("#user == 'user'")
.anyRequest().denyAll();
// @formatter:on
}
@@ -192,7 +193,7 @@ public class AuthorizeRequestsTests {
// @formatter:off
http
.authorizeRequests()
.antMatchers("/user/{userName}").access("#userName == 'user'")
.requestMatchers(new AntPathRequestMatcher("/user/{userName}", null, false)).access("#userName == 'user'")
.anyRequest().denyAll();
// @formatter:on
}