From 88ea87642ae99aee35672faaf3b91448f7b738ab Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Tue, 22 Apr 2008 12:32:33 +0000 Subject: [PATCH] SEC-791: RequestKey.equals throws NPE if method is null http://jira.springframework.org/browse/SEC-791. Fixed handling of equals when one http method is null. --- .../security/intercept/web/RequestKey.java | 7 +-- .../intercept/web/RequestKeyTests.java | 51 +++++++++++++++++++ 2 files changed, 55 insertions(+), 3 deletions(-) create mode 100644 core/src/test/java/org/springframework/security/intercept/web/RequestKeyTests.java diff --git a/core/src/main/java/org/springframework/security/intercept/web/RequestKey.java b/core/src/main/java/org/springframework/security/intercept/web/RequestKey.java index 84e02e2186..44b4528ba2 100644 --- a/core/src/main/java/org/springframework/security/intercept/web/RequestKey.java +++ b/core/src/main/java/org/springframework/security/intercept/web/RequestKey.java @@ -3,6 +3,7 @@ package org.springframework.security.intercept.web; /** * @author Luke Taylor * @version $Id$ + * @since 2.0 */ public class RequestKey { private String url; @@ -47,10 +48,10 @@ public class RequestKey { return false; } - if (method == null && key.method != null) { - return false; + if (method == null) { + return key.method == null; } - + return method.equals(key.method); } } diff --git a/core/src/test/java/org/springframework/security/intercept/web/RequestKeyTests.java b/core/src/test/java/org/springframework/security/intercept/web/RequestKeyTests.java new file mode 100644 index 0000000000..a1877aacff --- /dev/null +++ b/core/src/test/java/org/springframework/security/intercept/web/RequestKeyTests.java @@ -0,0 +1,51 @@ +package org.springframework.security.intercept.web; + +import static org.junit.Assert.*; + +import org.junit.Test; + +/** + * + * @author Luke Taylor + * @version $Id$ + * + */ +public class RequestKeyTests { + + @Test + public void equalsWorksWithNullHttpMethod() { + RequestKey key1 = new RequestKey("/someurl"); + RequestKey key2 = new RequestKey("/someurl"); + + assertEquals(key1, key2); + key1 = new RequestKey("/someurl","GET"); + assertFalse(key1.equals(key2)); + assertFalse(key2.equals(key1)); + } + + @Test + public void keysWithSameUrlAndHttpMethodAreEqual() { + RequestKey key1 = new RequestKey("/someurl", "GET"); + RequestKey key2 = new RequestKey("/someurl", "GET"); + + assertEquals(key1, key2); + } + + @Test + public void keysWithSameUrlAndDifferentHttpMethodAreNotEqual() { + RequestKey key1 = new RequestKey("/someurl", "GET"); + RequestKey key2 = new RequestKey("/someurl", "POST"); + + assertFalse(key1.equals(key2)); + assertFalse(key2.equals(key1)); + } + + @Test + public void keysWithDifferentUrlsAreNotEquals() { + RequestKey key1 = new RequestKey("/someurl", "GET"); + RequestKey key2 = new RequestKey("/anotherurl", "GET"); + + assertFalse(key1.equals(key2)); + assertFalse(key2.equals(key1)); + } +}