SEC-2243: Remove additional Debug Filter

web/src/main/java/org/springframework/security/web/debug/DebugFilter.java

@@ -0,0 +1,139 @@
+package org.springframework.security.web.debug;
+
+import org.springframework.security.web.FilterChainProxy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.util.UrlUtils;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+import java.util.*;
+
+/**
+ * Spring Security debugging filter.
+ * <p>
+ * Logs information (such as session creation) to help the user understand how requests are being handled
+ * by Spring Security and provide them with other relevant information (such as when sessions are being created).
+ *
+ *
+ * @author Luke Taylor
+ * @author Rob Winch
+ * @since 3.1
+ */
+public final class DebugFilter implements Filter {
+    private static final String ALREADY_FILTERED_ATTR_NAME = DebugFilter.class.getName().concat(".FILTERED");
+
+    private final FilterChainProxy fcp;
+    private final Logger logger = new Logger();
+
+    public DebugFilter(FilterChainProxy fcp) {
+        this.fcp = fcp;
+    }
+
+    public final void doFilter(ServletRequest srvltRequest, ServletResponse srvltResponse, FilterChain filterChain)
+            throws ServletException, IOException {
+
+        if (!(srvltRequest instanceof HttpServletRequest) || !(srvltResponse instanceof HttpServletResponse)) {
+            throw new ServletException("DebugFilter just supports HTTP requests");
+        }
+        HttpServletRequest request = (HttpServletRequest) srvltRequest;
+        HttpServletResponse response = (HttpServletResponse) srvltResponse;
+
+        List<Filter> filters = getFilters(request);
+        logger.info("Request received for '" + UrlUtils.buildRequestUrl(request) + "':\n\n" +
+                request + "\n\n" +
+                "servletPath:" + request.getServletPath() + "\n" +
+                "pathInfo:" + request.getPathInfo() + "\n\n" +
+                formatFilters(filters));
+
+        if (request.getAttribute(ALREADY_FILTERED_ATTR_NAME) == null) {
+            invokeWithWrappedRequest(request, response, filterChain);
+        } else {
+            fcp.doFilter(request, response, filterChain);
+        }
+    }
+
+    private void invokeWithWrappedRequest(HttpServletRequest request,
+            HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
+        request.setAttribute(ALREADY_FILTERED_ATTR_NAME, Boolean.TRUE);
+        request = new DebugRequestWrapper(request);
+        try {
+            fcp.doFilter(request, response, filterChain);
+        }
+        finally {
+            request.removeAttribute(ALREADY_FILTERED_ATTR_NAME);
+        }
+    }
+
+    String formatFilters(List<Filter> filters) {
+        StringBuilder sb = new StringBuilder();
+        sb.append("Security filter chain: ");
+        if (filters == null) {
+            sb.append("no match");
+        } else if (filters.isEmpty()) {
+            sb.append("[] empty (bypassed by security='none') ");
+        } else {
+            sb.append("[\n");
+            for (Filter f : filters) {
+                sb.append("  ").append(f.getClass().getSimpleName()).append("\n");
+            }
+            sb.append("]");
+        }
+
+        return sb.toString();
+    }
+
+    private List<Filter> getFilters(HttpServletRequest request)  {
+        for (SecurityFilterChain chain : fcp.getFilterChains()) {
+            if (chain.matches(request)) {
+                return chain.getFilters();
+            }
+        }
+
+        return null;
+    }
+
+    public void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    public void destroy() {
+    }
+}
+
+class DebugRequestWrapper extends HttpServletRequestWrapper {
+    private static final Logger logger = new Logger();
+
+    public DebugRequestWrapper(HttpServletRequest request) {
+        super(request);
+    }
+
+    @Override
+    public HttpSession getSession() {
+        boolean sessionExists = super.getSession(false) != null;
+        HttpSession session = super.getSession();
+
+        if (!sessionExists) {
+            logger.info("New HTTP session created: " + session.getId(), true);
+        }
+
+        return session;
+    }
+
+    @Override
+    public HttpSession getSession(boolean create) {
+        if (!create) {
+            return super.getSession(create);
+        }
+        return getSession();
+    }
+}
+
+

web/src/main/java/org/springframework/security/web/debug/Logger.java

@@ -0,0 +1,41 @@
+package org.springframework.security.web.debug;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * Controls output for the Spring Security debug feature.
+ *
+ * @author Luke Taylor
+ * @since 3.1
+ */
+final class Logger {
+    private static final Log logger = LogFactory.getLog("Spring Security Debugger");
+
+    public void info(String message) {
+        info(message, false);
+    }
+
+    public void info(String message, boolean dumpStack) {
+        StringBuilder output = new StringBuilder(256);
+        output.append("\n\n************************************************************\n\n");
+        output.append(message).append("\n");
+
+        if (dumpStack) {
+            StringWriter os = new StringWriter();
+            new Exception().printStackTrace(new PrintWriter(os));
+            StringBuffer buffer = os.getBuffer();
+            // Remove the exception in case it scares people.
+            int start = buffer.indexOf("java.lang.Exception");
+            buffer.replace(start, start + 19, "");
+            output.append("\nCall stack: \n").append(os.toString());
+        }
+
+        output.append("\n\n************************************************************\n\n");
+
+        logger.info(output.toString());
+    }
+}

web/src/test/java/org/springframework/security/web/debug/DebugFilterTest.java

@@ -0,0 +1,95 @@
+package org.springframework.security.web.debug;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Matchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import javax.servlet.FilterChain;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+import javax.servlet.http.HttpServletResponse;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.Mock;
+import org.powermock.core.classloader.annotations.PrepareOnlyThisForTest;
+import org.powermock.modules.junit4.PowerMockRunner;
+import org.powermock.reflect.internal.WhiteboxImpl;
+import org.springframework.security.web.FilterChainProxy;
+import org.springframework.security.web.debug.DebugFilter;
+import org.springframework.security.web.debug.DebugRequestWrapper;
+import org.springframework.security.web.debug.Logger;
+
+/**
+ *
+ * @author Rob Winch
+ *
+ */
+@RunWith(PowerMockRunner.class)
+@PrepareOnlyThisForTest(Logger.class)
+public class DebugFilterTest {
+    @Captor
+    private ArgumentCaptor<HttpServletRequest> requestCaptor;
+    @Mock
+    private HttpServletRequest request;
+    @Mock
+    private HttpServletResponse response;
+    @Mock
+    private FilterChain filterChain;
+    @Mock
+    private FilterChainProxy fcp;
+    @Mock
+    private Logger logger;
+
+    private String requestAttr;
+
+    private DebugFilter filter;
+
+    @Before
+    public void setUp() {
+        when(request.getServletPath()).thenReturn("/login");
+        filter = new DebugFilter(fcp);
+        WhiteboxImpl.setInternalState(filter, Logger.class, logger);
+        requestAttr = WhiteboxImpl.getInternalState(filter, "ALREADY_FILTERED_ATTR_NAME", filter.getClass());
+    }
+
+    @Test
+    public void doFilterProcessesRequests() throws Exception {
+        filter.doFilter(request, response, filterChain);
+
+        verify(logger).info(anyString());
+        verify(request).setAttribute(requestAttr, Boolean.TRUE);
+        verify(fcp).doFilter(requestCaptor.capture(), eq(response), eq(filterChain));
+        assertEquals(DebugRequestWrapper.class,requestCaptor.getValue().getClass());
+        verify(request).removeAttribute(requestAttr);
+    }
+
+    // SEC-1901
+    @Test
+    public void doFilterProcessesForwardedRequests() throws Exception {
+        when(request.getAttribute(requestAttr)).thenReturn(Boolean.TRUE);
+        HttpServletRequest request = new DebugRequestWrapper(this.request);
+
+        filter.doFilter(request, response, filterChain);
+
+        verify(logger).info(anyString());
+        verify(fcp).doFilter(request, response, filterChain);
+        verify(this.request,never()).removeAttribute(requestAttr);
+    }
+
+    @Test
+    public void doFilterDoesNotWrapWithDebugRequestWrapperAgain() throws Exception {
+        when(request.getAttribute(requestAttr)).thenReturn(Boolean.TRUE);
+        HttpServletRequest fireWalledRequest = new HttpServletRequestWrapper(new DebugRequestWrapper(this.request));
+
+        filter.doFilter(fireWalledRequest, response, filterChain);
+
+        verify(fcp).doFilter(fireWalledRequest, response, filterChain);
+    }
+}