From 948f79e2e2790ba4223c35efa47f038749bc7bce Mon Sep 17 00:00:00 2001 From: Ben Alex Date: Wed, 26 Apr 2006 02:23:19 +0000 Subject: [PATCH] SEC-219: Support complex tokenization scenarios. --- ...ilterInvocationDefinitionSourceEditor.java | 25 +++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/core/src/main/java/org/acegisecurity/intercept/web/FilterInvocationDefinitionSourceEditor.java b/core/src/main/java/org/acegisecurity/intercept/web/FilterInvocationDefinitionSourceEditor.java index bfebf099f3..401606711e 100644 --- a/core/src/main/java/org/acegisecurity/intercept/web/FilterInvocationDefinitionSourceEditor.java +++ b/core/src/main/java/org/acegisecurity/intercept/web/FilterInvocationDefinitionSourceEditor.java @@ -1,4 +1,4 @@ -/* Copyright 2004 Acegi Technology Pty Limited +/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -18,11 +18,10 @@ package org.acegisecurity.intercept.web; import org.acegisecurity.ConfigAttributeDefinition; import org.acegisecurity.ConfigAttributeEditor; +import org.apache.commons.lang.StringUtils; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; -import org.springframework.util.StringUtils; - import java.beans.PropertyEditorSupport; import java.io.BufferedReader; @@ -116,15 +115,21 @@ public class FilterInvocationDefinitionSourceEditor continue; } - // Tokenize the line into its name/value tokens - String[] nameValue = StringUtils.delimitedListToStringArray(line, "="); - String name = nameValue[0]; - String value = nameValue[1]; - - if(!StringUtils.hasLength(name) || !StringUtils.hasLength(value)) { - throw new IllegalArgumentException("Failed to parse a valid name/value pair from " + line); + if (line.lastIndexOf("==") != -1) { + throw new IllegalArgumentException( + "Only single equals should be used in line " + line); } + // Tokenize the line into its name/value tokens + // As per SEC-219, use the LAST equals as the delimiter between LHS and RHS + String name = StringUtils.substringBeforeLast(line, "="); + String value = StringUtils.substringAfterLast(line, "="); + + if (StringUtils.isBlank(name) || StringUtils.isBlank(value)) { + throw new IllegalArgumentException( + "Failed to parse a valid name/value pair from " + line); + } + // Convert value to series of security configuration attributes ConfigAttributeEditor configAttribEd = new ConfigAttributeEditor(); configAttribEd.setAsText(value);