Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-03 16:56:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Manual URL Cleanup

Browse Source
This commit is contained in:
Rob Winch
2019-03-28 11:08:57 -05:00
committed by Joe Grandja
parent 28afc38c8f
commit b46f5f69ac
23 changed files with 506 additions and 516 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/main/java/org/springframework/security/web/authentication/www/BasicAuthenticationFilter.java
+1 -1
View File
@@ -45,7 +45,7 @@ import org.springframework.web.filter.OncePerRequestFilter;
*
* <p>
* For a detailed background on what this filter is designed to process, refer to
* <a href="http://www.faqs.org/rfcs/rfc1945.html">RFC 1945, Section 11.1</a>. Any realm
* <a href="https://tools.ietf.org/html/rfc1945">RFC 1945, Section 11.1</a>. Any realm
* name presented in the HTTP request is ignored.
*
* <p>
web/src/test/java/org/springframework/security/web/DefaultRedirectStrategyTests.java
+1 -1
View File
@@ -52,7 +52,7 @@ public class DefaultRedirectStrategyTests {
MockHttpServletResponse response = new MockHttpServletResponse();
rds.sendRedirect(request, response,
"https://http://context.blah.com/context/remainder");
"https://context.blah.com/context/remainder");
assertThat(response.getRedirectedUrl()).isEqualTo("remainder");
}
web/src/test/java/org/springframework/security/web/FilterInvocationTests.java
+6 -6
View File
@@ -45,7 +45,7 @@ public class FilterInvocationTests {
MockHttpServletRequest request = new MockHttpServletRequest(null, null);
request.setServletPath("/HelloWorld");
request.setPathInfo("/some/more/segments.html");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setScheme("http");
request.setServerPort(80);
request.setContextPath("/mycontext");
@@ -61,7 +61,7 @@ public class FilterInvocationTests {
assertThat(fi.getChain()).isEqualTo(chain);
assertThat(fi.getRequestUrl()).isEqualTo("/HelloWorld/some/more/segments.html");
assertThat(fi.toString()).isEqualTo("FilterInvocation: URL: /HelloWorld/some/more/segments.html");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://www.example.com/mycontext/HelloWorld/some/more/segments.html");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://localhost/mycontext/HelloWorld/some/more/segments.html");
}
@Test(expected = IllegalArgumentException.class)
@@ -91,7 +91,7 @@ public class FilterInvocationTests {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("foo=bar");
request.setServletPath("/HelloWorld");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setScheme("http");
request.setServerPort(80);
request.setContextPath("/mycontext");
@@ -102,14 +102,14 @@ public class FilterInvocationTests {
mock(FilterChain.class));
assertThat(fi.getRequestUrl()).isEqualTo("/HelloWorld?foo=bar");
assertThat(fi.toString()).isEqualTo("FilterInvocation: URL: /HelloWorld?foo=bar");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://www.example.com/mycontext/HelloWorld?foo=bar");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://localhost/mycontext/HelloWorld?foo=bar");
}
@Test
public void testStringMethodsWithoutAnyQueryString() {
MockHttpServletRequest request = new MockHttpServletRequest(null, null);
request.setServletPath("/HelloWorld");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setScheme("http");
request.setServerPort(80);
request.setContextPath("/mycontext");
@@ -120,7 +120,7 @@ public class FilterInvocationTests {
mock(FilterChain.class));
assertThat(fi.getRequestUrl()).isEqualTo("/HelloWorld");
assertThat(fi.toString()).isEqualTo("FilterInvocation: URL: /HelloWorld");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://www.example.com/mycontext/HelloWorld");
assertThat(fi.getFullRequestUrl()).isEqualTo("http://localhost/mycontext/HelloWorld");
}
@Test(expected = UnsupportedOperationException.class)
web/src/test/java/org/springframework/security/web/access/ExceptionTranslationFilterTests.java
+8 -8
View File
@@ -81,7 +81,7 @@ public class ExceptionTranslationFilterTests {
request.setServletPath("/secure/page.html");
request.setServerPort(80);
request.setScheme("http");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
@@ -104,7 +104,7 @@ public class ExceptionTranslationFilterTests {
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, fc);
assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/login.jsp");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://www.example.com/mycontext/secure/page.html");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://localhost/mycontext/secure/page.html");
}
@Test
@@ -114,7 +114,7 @@ public class ExceptionTranslationFilterTests {
request.setServletPath("/secure/page.html");
request.setServerPort(80);
request.setScheme("http");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
@@ -134,7 +134,7 @@ public class ExceptionTranslationFilterTests {
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, fc);
assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/login.jsp");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://www.example.com/mycontext/secure/page.html");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://localhost/mycontext/secure/page.html");
}
@@ -175,7 +175,7 @@ public class ExceptionTranslationFilterTests {
request.setServletPath("/secure/page.html");
request.setServerPort(80);
request.setScheme("http");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
@@ -190,7 +190,7 @@ public class ExceptionTranslationFilterTests {
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, fc);
assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/login.jsp");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://www.example.com/mycontext/secure/page.html");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://localhost/mycontext/secure/page.html");
}
@Test
@@ -201,7 +201,7 @@ public class ExceptionTranslationFilterTests {
request.setServletPath("/secure/page.html");
request.setServerPort(8080);
request.setScheme("http");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setContextPath("/mycontext");
request.setRequestURI("/mycontext/secure/page.html");
@@ -219,7 +219,7 @@ public class ExceptionTranslationFilterTests {
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, fc);
assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/login.jsp");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://www.example.com:8080/mycontext/secure/page.html");
assertThat(getSavedRequestUrl(request)).isEqualTo("http://localhost:8080/mycontext/secure/page.html");
}
@Test(expected = IllegalArgumentException.class)
web/src/test/java/org/springframework/security/web/access/channel/RetryWithHttpEntryPointTests.java
+6 -6
View File
@@ -85,7 +85,7 @@ public class RetryWithHttpEntryPointTests {
"/bigWebApp/hello/pathInfo.html");
request.setQueryString("open=true");
request.setScheme("https");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setServerPort(443);
MockHttpServletResponse response = new MockHttpServletResponse();
@@ -96,7 +96,7 @@ public class RetryWithHttpEntryPointTests {
ep.commence(request, response);
assertThat(response.getRedirectedUrl()).isEqualTo(
"http://www.example.com/bigWebApp/hello/pathInfo.html?open=true");
"http://localhost/bigWebApp/hello/pathInfo.html?open=true");
}
@Test
@@ -104,7 +104,7 @@ public class RetryWithHttpEntryPointTests {
MockHttpServletRequest request = new MockHttpServletRequest("GET",
"/bigWebApp/hello");
request.setScheme("https");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setServerPort(443);
MockHttpServletResponse response = new MockHttpServletResponse();
@@ -115,7 +115,7 @@ public class RetryWithHttpEntryPointTests {
ep.commence(request, response);
assertThat(response.getRedirectedUrl())
.isEqualTo("http://www.example.com/bigWebApp/hello");
.isEqualTo("http://localhost/bigWebApp/hello");
}
@Test
@@ -142,7 +142,7 @@ public class RetryWithHttpEntryPointTests {
"/bigWebApp/hello/pathInfo.html");
request.setQueryString("open=true");
request.setScheme("https");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setServerPort(9999);
MockHttpServletResponse response = new MockHttpServletResponse();
@@ -158,6 +158,6 @@ public class RetryWithHttpEntryPointTests {
ep.commence(request, response);
assertThat(response.getRedirectedUrl()).isEqualTo(
"http://www.example.com:8888/bigWebApp/hello/pathInfo.html?open=true");
"http://localhost:8888/bigWebApp/hello/pathInfo.html?open=true");
}
}
web/src/test/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilterTests.java
+2 -2
View File
@@ -385,7 +385,7 @@ public class AbstractAuthenticationProcessingFilterTests {
MockHttpServletResponse response = new MockHttpServletResponse();
MockAuthenticationFilter filter = new MockAuthenticationFilter(false);
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setDefaultTargetUrl("https://monkeymachine.co.uk/");
filter.setAuthenticationSuccessHandler(successHandler);
filter.doFilter(request, response, chain);
@@ -409,7 +409,7 @@ public class AbstractAuthenticationProcessingFilterTests {
ReflectionTestUtils.setField(filter, "logger", logger);
filter.exceptionToThrow = new InternalAuthenticationServiceException(
"Mock requested to do so");
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setDefaultTargetUrl("https://monkeymachine.co.uk/");
filter.setAuthenticationSuccessHandler(successHandler);
filter.doFilter(request, response, chain);
web/src/test/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPointTests.java
+7 -7
View File
@@ -166,14 +166,14 @@ public class LoginUrlAuthenticationEntryPointTests {
request.setRequestURI("/some_path");
request.setContextPath("/bigWebApp");
request.setScheme("http");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setContextPath("/bigWebApp");
request.setServerPort(80);
MockHttpServletResponse response = new MockHttpServletResponse();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("http://www.example.com/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("http://localhost/bigWebApp/hello");
}
@Test
@@ -188,7 +188,7 @@ public class LoginUrlAuthenticationEntryPointTests {
request.setRequestURI("/some_path");
request.setContextPath("/bigWebApp");
request.setScheme("http");
request.setServerName("www.example.com");
request.setServerName("localhost");
request.setContextPath("/bigWebApp");
request.setServerPort(8888); // NB: Port we can't resolve
@@ -198,7 +198,7 @@ public class LoginUrlAuthenticationEntryPointTests {
// Response doesn't switch to HTTPS, as we didn't know HTTP port 8888 to HTTP port
// mapping
assertThat(response.getRedirectedUrl()).isEqualTo("http://www.example.com:8888/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("http://localhost:8888/bigWebApp/hello");
}
@Test
@@ -249,7 +249,7 @@ public class LoginUrlAuthenticationEntryPointTests {
// SEC-1498
@Test
public void absoluteLoginFormUrlIsSupported() throws Exception {
final String loginFormUrl = "http://somesite.com/login";
final String loginFormUrl = "https://somesite.com/login";
LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint(
loginFormUrl);
ep.afterPropertiesSet();
@@ -260,9 +260,9 @@ public class LoginUrlAuthenticationEntryPointTests {
@Test(expected = IllegalArgumentException.class)
public void absoluteLoginFormUrlCantBeUsedWithForwarding() throws Exception {
final String loginFormUrl = "http://somesite.com/login";
final String loginFormUrl = "https://somesite.com/login";
LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint(
"http://somesite.com/login");
"https://somesite.com/login");
ep.setUseForward(true);
ep.afterPropertiesSet();
}
web/src/test/java/org/springframework/security/web/authentication/logout/SimpleUrlLogoutSuccessHandlerTests.java
+2 -2
View File
@@ -45,11 +45,11 @@ public class SimpleUrlLogoutSuccessHandlerTests {
@Test
public void absoluteUrlIsSupported() throws Exception {
SimpleUrlLogoutSuccessHandler lsh = new SimpleUrlLogoutSuccessHandler();
lsh.setDefaultTargetUrl("http://someurl.com/");
lsh.setDefaultTargetUrl("https://someurl.com/");
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
lsh.onLogoutSuccess(request, response, mock(Authentication.class));
assertThat(response.getRedirectedUrl()).isEqualTo("http://someurl.com/");
assertThat(response.getRedirectedUrl()).isEqualTo("https://someurl.com/");
}
}
web/src/test/java/org/springframework/security/web/header/writers/frameoptions/RegExpAllowFromStrategyTests.java
+7 -7
View File
@@ -41,19 +41,19 @@ public class RegExpAllowFromStrategyTests {
@Test
public void subdomainMatchingRegularExpression() {
RegExpAllowFromStrategy strategy = new RegExpAllowFromStrategy(
"^http://([a-z0-9]*?\\.)test\\.com");
"^http://([a-z0-9]*?\\.)example\\.com");
strategy.setAllowFromParameterName("from");
MockHttpServletRequest request = new MockHttpServletRequest();
request.setParameter("from", "http://www.test.com");
request.setParameter("from", "http://www.example.com");
String result1 = strategy.getAllowFromValue(request);
assertThat(result1).isEqualTo("http://www.test.com");
assertThat(result1).isEqualTo("http://www.example.com");
request.setParameter("from", "http://abc.test.com");
request.setParameter("from", "http://foo.example.com");
String result2 = strategy.getAllowFromValue(request);
assertThat(result2).isEqualTo("http://abc.test.com");
assertThat(result2).isEqualTo("http://foo.example.com");
request.setParameter("from", "http://test.foobar.com");
request.setParameter("from", "http://www.example2.com");
String result3 = strategy.getAllowFromValue(request);
assertThat(result3).isEqualTo("DENY");
}
@@ -61,7 +61,7 @@ public class RegExpAllowFromStrategyTests {
@Test
public void noParameterShouldDeny() {
RegExpAllowFromStrategy strategy = new RegExpAllowFromStrategy(
"^http://([a-z0-9]*?\\.)test\\.com");
"^https://([a-z0-9]*?\\.)test\\.com");
MockHttpServletRequest request = new MockHttpServletRequest();
String result1 = strategy.getAllowFromValue(request);
assertThat(result1).isEqualTo("DENY");