SEC-3097: Change CsrfRequestPostProcessor to use TestCsrfTokenRepository

This ensures that when using a wrapped HttpServletRequest (i.e. Spring
Session) that the CSRF token test support still works.

test/src/main/java/org/springframework/security/test/web/servlet/request/SecurityMockMvcRequestPostProcessors.java

@@ -316,6 +316,10 @@ public final class SecurityMockMvcRequestPostProcessors {
 		public MockHttpServletRequest postProcessRequest(MockHttpServletRequest request) {
 
 			CsrfTokenRepository repository = WebTestUtils.getCsrfTokenRepository(request);
+			if(!(repository instanceof TestCsrfTokenRepository)) {
+				repository = new TestCsrfTokenRepository(repository);
+				WebTestUtils.setCsrfTokenRepository(request, repository);
+			}
 			CsrfToken token = repository.generateToken(request);
 			repository.saveToken(token, request, new MockHttpServletResponse());
 			String tokenValue = useInvalidToken ? "invalid" + token.getToken() : token
@@ -352,6 +356,36 @@ public final class SecurityMockMvcRequestPostProcessors {
 
 		private CsrfRequestPostProcessor() {
 		}
+
+
+
+		/**
+		 * Used to wrap the CsrfTokenRepository to provide support for testing
+		 * when the request is wrapped (i.e. Spring Session is in use).
+		 */
+		static class TestCsrfTokenRepository implements
+				CsrfTokenRepository {
+			final static String ATTR_NAME = TestCsrfTokenRepository.class
+					.getName().concat(".TOKEN");
+
+			private final CsrfTokenRepository delegate;
+
+			private TestCsrfTokenRepository(CsrfTokenRepository delegate) {
+				this.delegate = delegate;
+			}
+
+			public CsrfToken generateToken(HttpServletRequest request) {
+				return delegate.generateToken(request);
+			}
+
+			public void saveToken(CsrfToken token, HttpServletRequest request, HttpServletResponse response) {
+				request.setAttribute(ATTR_NAME, token);
+			}
+
+			public CsrfToken loadToken(HttpServletRequest request) {
+				return (CsrfToken) request.getAttribute(ATTR_NAME);
+			}
+		}
 	}
 
 	public static class DigestRequestPostProcessor implements RequestPostProcessor {

test/src/main/java/org/springframework/security/test/web/support/WebTestUtils.java

@@ -97,6 +97,22 @@ public abstract class WebTestUtils {
 				"tokenRepository");
 	}
 
+	/**
+	 * Sets the {@link CsrfTokenRepository} for the specified
+	 * {@link HttpServletRequest}.
+	 *
+	 * @param request the {@link HttpServletRequest} to obtain the
+	 * {@link CsrfTokenRepository}
+	 * @param repository the {@link CsrfTokenRepository} to set
+	 */
+	public static void setCsrfTokenRepository(HttpServletRequest request,
+			CsrfTokenRepository repository) {
+		CsrfFilter filter = findFilter(request, CsrfFilter.class);
+		if (filter != null) {
+			ReflectionTestUtils.setField(filter, "tokenRepository", repository);
+		}
+	}
+
 	@SuppressWarnings("unchecked")
 	private static <T extends Filter> T findFilter(HttpServletRequest request,
 			Class<T> filterClass) {