SEC-531: Provide support for HTTP methods in FilterInvocationDefinitionSource. Path/Regex versions of FIDS are now deprecated and in favour of using their (no longer abstract) parent class with a UrlPathMatcher strategy.
This commit is contained in:
Luke Taylor
+21
-3
@@ -132,15 +132,32 @@ public class HttpSecurityBeanDefinitionParserTests {
|
||||
FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR);
|
||||
|
||||
FilterInvocationDefinitionSource fids = fis.getObjectDefinitionSource();
|
||||
ConfigAttributeDefinition attrs = fids.getAttributes(createFilterinvocation("/Secure"));
|
||||
ConfigAttributeDefinition attrs = fids.getAttributes(createFilterinvocation("/Secure", null));
|
||||
assertEquals(2, attrs.size());
|
||||
assertTrue(attrs.contains(new SecurityConfig("ROLE_A")));
|
||||
assertTrue(attrs.contains(new SecurityConfig("ROLE_B")));
|
||||
attrs = fids.getAttributes(createFilterinvocation("/secure"));
|
||||
attrs = fids.getAttributes(createFilterinvocation("/secure", null));
|
||||
assertEquals(1, attrs.size());
|
||||
assertTrue(attrs.contains(new SecurityConfig("ROLE_C")));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void httpMethodMatchIsSupported() throws Exception {
|
||||
setContext(
|
||||
" <http auto-config='true'>" +
|
||||
" <intercept-url pattern='/**' access='ROLE_C' />" +
|
||||
" <intercept-url pattern='/secure*' method='DELETE' access='ROLE_SUPERVISOR' />" +
|
||||
" <intercept-url pattern='/secure*' method='POST' access='ROLE_A,ROLE_B' />" +
|
||||
" </http>" + AUTH_PROVIDER_XML);
|
||||
|
||||
FilterSecurityInterceptor fis = (FilterSecurityInterceptor) appContext.getBean(BeanIds.FILTER_SECURITY_INTERCEPTOR);
|
||||
FilterInvocationDefinitionSource fids = fis.getObjectDefinitionSource();
|
||||
ConfigAttributeDefinition attrs = fids.getAttributes(createFilterinvocation("/secure", "POST"));
|
||||
assertEquals(2, attrs.size());
|
||||
assertTrue(attrs.contains(new SecurityConfig("ROLE_A")));
|
||||
assertTrue(attrs.contains(new SecurityConfig("ROLE_B")));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void minimalConfigurationParses() {
|
||||
setContext("<http><http-basic /></http>" + AUTH_PROVIDER_XML);
|
||||
@@ -213,8 +230,9 @@ public class HttpSecurityBeanDefinitionParserTests {
|
||||
return (FilterChainProxy) appContext.getBean(BeanIds.FILTER_CHAIN_PROXY);
|
||||
}
|
||||
|
||||
private FilterInvocation createFilterinvocation(String path) {
|
||||
private FilterInvocation createFilterinvocation(String path, String method) {
|
||||
MockHttpServletRequest request = new MockHttpServletRequest();
|
||||
request.setMethod(method);
|
||||
request.setRequestURI(null);
|
||||
|
||||
request.setServletPath(path);
|
||||
|
||||
+1
-1
@@ -29,7 +29,7 @@ import javax.servlet.ServletResponse;
|
||||
|
||||
|
||||
/**
|
||||
* Tests {@link AbstractFilterInvocationDefinitionSource}.
|
||||
* Tests {@link DefaultFilterInvocationDefinitionSource}.
|
||||
*
|
||||
* @author Ben Alex
|
||||
* @version $Id$
|
||||
|
||||
+15
-14
@@ -20,6 +20,7 @@ import junit.framework.TestCase;
|
||||
import org.springframework.security.ConfigAttributeDefinition;
|
||||
import org.springframework.security.MockFilterChain;
|
||||
import org.springframework.security.SecurityConfig;
|
||||
import org.springframework.security.util.RegexUrlPathMatcher;
|
||||
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
@@ -51,7 +52,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE\r\n\\A/secure/.*\\Z=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertFalse(map.isConvertUrlToLowercaseBeforeComparison());
|
||||
}
|
||||
|
||||
@@ -72,7 +73,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
editor.setAsText(
|
||||
"CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON\r\n\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE\r\n\\A/secure/.*\\Z=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertTrue(map.isConvertUrlToLowercaseBeforeComparison());
|
||||
}
|
||||
|
||||
@@ -80,8 +81,8 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE\r\n\\A/secure/.*\\Z=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
FilterInvocationDefinitionMap map = (FilterInvocationDefinitionMap) editor.getValue();
|
||||
assertTrue(map instanceof RegExpBasedFilterInvocationDefinitionMap);
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertTrue(map.getUrlMatcher() instanceof RegexUrlPathMatcher);
|
||||
}
|
||||
|
||||
public void testDetectsDuplicateDirectivesOnSameLineSituation1() {
|
||||
@@ -124,7 +125,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertEquals(0, map.getMapSize());
|
||||
}
|
||||
|
||||
@@ -142,7 +143,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE\r\n\\A/secure/.*\\Z=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
Iterator iter = map.getConfigAttributeDefinitions();
|
||||
int counter = 0;
|
||||
|
||||
@@ -158,7 +159,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE,ANOTHER_ROLE");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
httpRequest.setServletPath("/totally/different/path/index.html");
|
||||
@@ -173,7 +174,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE\r\n\\A/secure/.*\\Z=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertEquals(2, map.getMapSize());
|
||||
}
|
||||
|
||||
@@ -181,7 +182,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText(null);
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertEquals(0, map.getMapSize());
|
||||
}
|
||||
|
||||
@@ -190,7 +191,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
editor.setAsText(
|
||||
"\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE,ANOTHER_ROLE\r\n\\A/secure/.*\\Z=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
// Test ensures we match the first entry, not the second
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
@@ -211,7 +212,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
editor.setAsText(
|
||||
"\\A/secure/.*\\Z=ROLE_SUPERVISOR,ROLE_TELLER\r\n\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE,ANOTHER_ROLE");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
httpRequest.setServletPath("/secure/super/very_secret.html");
|
||||
@@ -230,7 +231,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("\\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE,ANOTHER_ROLE");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
httpRequest.setServletPath("/secure/super/very_secret.html");
|
||||
@@ -249,7 +250,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("PATTERN_TYPE_APACHE_ANT\r\n/secure/super/**=ROLE_WE_DONT_HAVE,ANOTHER_ROLE");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
httpRequest.setServletPath("/secure/super/very_secret.html");
|
||||
@@ -269,7 +270,7 @@ public class FilterInvocationDefinitionSourceEditorTests extends TestCase {
|
||||
editor.setAsText(
|
||||
" \\A/secure/super.*\\Z=ROLE_WE_DONT_HAVE,ANOTHER_ROLE \r\n \r\n \r\n // comment line \r\n \\A/testing.*\\Z=ROLE_TEST \r\n");
|
||||
|
||||
RegExpBasedFilterInvocationDefinitionMap map = (RegExpBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertEquals(2, map.getMapSize());
|
||||
}
|
||||
}
|
||||
|
||||
+14
-13
@@ -20,6 +20,7 @@ import junit.framework.TestCase;
|
||||
import org.springframework.security.ConfigAttributeDefinition;
|
||||
import org.springframework.security.MockFilterChain;
|
||||
import org.springframework.security.SecurityConfig;
|
||||
import org.springframework.security.util.AntUrlPathMatcher;
|
||||
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
@@ -52,8 +53,8 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
"PATTERN_TYPE_APACHE_ANT\r\n/secure/super/*=ROLE_WE_DONT_HAVE\r\n/secure/*=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
FilterInvocationDefinitionMap map = (FilterInvocationDefinitionMap) editor.getValue();
|
||||
assertTrue(map instanceof PathBasedFilterInvocationDefinitionMap);
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertTrue(map.getUrlMatcher() instanceof AntUrlPathMatcher);
|
||||
}
|
||||
|
||||
public void testConvertUrlToLowercaseDefaultSettingUnchangedByEditor() {
|
||||
@@ -61,8 +62,8 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
"PATTERN_TYPE_APACHE_ANT\r\n/secure/super/*=ROLE_WE_DONT_HAVE\r\n/secure/*=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
assertFalse(map.isConvertUrlToLowercaseBeforeComparison());
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertFalse(map.getUrlMatcher().requiresLowerCaseUrl());
|
||||
}
|
||||
|
||||
public void testConvertUrlToLowercaseSettingApplied() {
|
||||
@@ -70,8 +71,8 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
"CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON\r\nPATTERN_TYPE_APACHE_ANT\r\n/secure/super/*=ROLE_WE_DONT_HAVE\r\n/secure/*=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
assertTrue(map.isConvertUrlToLowercaseBeforeComparison());
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertTrue(map.getUrlMatcher().requiresLowerCaseUrl());
|
||||
}
|
||||
|
||||
public void testInvalidNameValueFailsToParse() {
|
||||
@@ -89,7 +90,7 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
"PATTERN_TYPE_APACHE_ANT\r\n/secure/super/*=ROLE_WE_DONT_HAVE\r\n/secure/*=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
Iterator iter = map.getConfigAttributeDefinitions();
|
||||
int counter = 0;
|
||||
|
||||
@@ -105,7 +106,7 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("PATTERN_TYPE_APACHE_ANT\r\n/secure/super/*=ROLE_WE_DONT_HAVE");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
httpRequest.setServletPath("/totally/different/path/index.html");
|
||||
@@ -121,7 +122,7 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
"PATTERN_TYPE_APACHE_ANT\r\n/secure/super/*=ROLE_WE_DONT_HAVE\r\n/secure/*=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertEquals(2, map.getMapSize());
|
||||
}
|
||||
|
||||
@@ -130,7 +131,7 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
"PATTERN_TYPE_APACHE_ANT\r\n/secure/super/**=ROLE_WE_DONT_HAVE,ANOTHER_ROLE\r\n/secure/**=ROLE_SUPERVISOR,ROLE_TELLER");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
// Test ensures we match the first entry, not the second
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
@@ -151,7 +152,7 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
"PATTERN_TYPE_APACHE_ANT\r\n/secure/**=ROLE_SUPERVISOR,ROLE_TELLER\r\n/secure/super/**=ROLE_WE_DONT_HAVE");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
httpRequest.setServletPath("/secure/super/very_secret.html");
|
||||
@@ -170,7 +171,7 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
FilterInvocationDefinitionSourceEditor editor = new FilterInvocationDefinitionSourceEditor();
|
||||
editor.setAsText("PATTERN_TYPE_APACHE_ANT\r\n/secure/super/*=ROLE_WE_DONT_HAVE,ANOTHER_ROLE");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
|
||||
MockHttpServletRequest httpRequest = new MockHttpServletRequest(null, null);
|
||||
httpRequest.setServletPath("/secure/super/very_secret.html");
|
||||
@@ -190,7 +191,7 @@ public class FilterInvocationDefinitionSourceEditorWithPathsTests extends TestCa
|
||||
editor.setAsText(
|
||||
" PATTERN_TYPE_APACHE_ANT\r\n /secure/super/*=ROLE_WE_DONT_HAVE\r\n /secure/*=ROLE_SUPERVISOR,ROLE_TELLER \r\n \r\n \r\n // comment line \r\n \r\n");
|
||||
|
||||
PathBasedFilterInvocationDefinitionMap map = (PathBasedFilterInvocationDefinitionMap) editor.getValue();
|
||||
DefaultFilterInvocationDefinitionSource map = (DefaultFilterInvocationDefinitionSource) editor.getValue();
|
||||
assertEquals(2, map.getMapSize());
|
||||
}
|
||||
}
|
||||
|
||||
+2
-2
@@ -30,7 +30,7 @@ import java.util.Vector;
|
||||
* @author Ben Alex
|
||||
* @version $Id$
|
||||
*/
|
||||
public class MockFilterInvocationDefinitionSource extends AbstractFilterInvocationDefinitionSource {
|
||||
public class MockFilterInvocationDefinitionSource extends DefaultFilterInvocationDefinitionSource {
|
||||
//~ Instance fields ================================================================================================
|
||||
|
||||
private List list;
|
||||
@@ -77,7 +77,7 @@ public class MockFilterInvocationDefinitionSource extends AbstractFilterInvocati
|
||||
}
|
||||
}
|
||||
|
||||
public ConfigAttributeDefinition lookupAttributes(String url) {
|
||||
public ConfigAttributeDefinition lookupAttributes(String url, String method) {
|
||||
throw new UnsupportedOperationException("mock method not implemented");
|
||||
}
|
||||
}
|
||||
|
||||
+80
-28
@@ -15,8 +15,6 @@
|
||||
|
||||
package org.springframework.security.intercept.web;
|
||||
|
||||
import junit.framework.TestCase;
|
||||
|
||||
import org.springframework.security.ConfigAttributeDefinition;
|
||||
import org.springframework.security.MockFilterChain;
|
||||
import org.springframework.security.SecurityConfig;
|
||||
@@ -24,6 +22,9 @@ import org.springframework.security.SecurityConfig;
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
|
||||
import org.junit.Test;
|
||||
import static org.junit.Assert.*;
|
||||
import static org.junit.Assert.assertEquals;
|
||||
|
||||
/**
|
||||
* Tests parts of {@link PathBasedFilterInvocationDefinitionMap} not tested by {@link
|
||||
@@ -32,30 +33,25 @@ import org.springframework.mock.web.MockHttpServletResponse;
|
||||
* @author Ben Alex
|
||||
* @version $Id$
|
||||
*/
|
||||
public class PathBasedFilterDefinitionMapTests extends TestCase {
|
||||
//~ Constructors ===================================================================================================
|
||||
|
||||
public PathBasedFilterDefinitionMapTests() {
|
||||
}
|
||||
|
||||
public PathBasedFilterDefinitionMapTests(String arg0) {
|
||||
super(arg0);
|
||||
}
|
||||
public class PathBasedFilterInvocationDefinitionMapTests {
|
||||
|
||||
//~ Methods ========================================================================================================
|
||||
|
||||
public void testConvertUrlToLowercaseIsTrueByDefault() {
|
||||
@Test
|
||||
public void convertUrlToLowercaseIsTrueByDefault() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
assertTrue(map.isConvertUrlToLowercaseBeforeComparison());
|
||||
}
|
||||
|
||||
public void testConvertUrlToLowercaseSetterRespected() {
|
||||
@Test
|
||||
public void convertUrlToLowercaseSetterRespected() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
map.setConvertUrlToLowercaseBeforeComparison(false);
|
||||
assertFalse(map.isConvertUrlToLowercaseBeforeComparison());
|
||||
}
|
||||
|
||||
public void testLookupNotRequiringExactMatchSuccessIfNotMatching() {
|
||||
@Test
|
||||
public void lookupNotRequiringExactMatchSuccessIfNotMatching() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
map.setConvertUrlToLowercaseBeforeComparison(true);
|
||||
|
||||
@@ -63,90 +59,146 @@ public class PathBasedFilterDefinitionMapTests extends TestCase {
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/secure/super/**", def);
|
||||
|
||||
FilterInvocation fi = createFilterinvocation("/SeCuRE/super/somefile.html");
|
||||
FilterInvocation fi = createFilterInvocation("/SeCuRE/super/somefile.html", null);
|
||||
|
||||
ConfigAttributeDefinition response = map.lookupAttributes(fi.getRequestUrl());
|
||||
assertEquals(def, response);
|
||||
}
|
||||
|
||||
/**
|
||||
* SEC-501. Not that as of 2.0, lower case comparisons are the default for this class.
|
||||
* SEC-501. Note that as of 2.0, lower case comparisons are the default for this class.
|
||||
*/
|
||||
public void testLookupNotRequiringExactMatchSucceedsIfSecureUrlPathContainsUpperCase() {
|
||||
@Test
|
||||
public void lookupNotRequiringExactMatchSucceedsIfSecureUrlPathContainsUpperCase() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/SeCuRE/super/**", def);
|
||||
|
||||
FilterInvocation fi = createFilterinvocation("/secure/super/somefile.html");
|
||||
FilterInvocation fi = createFilterInvocation("/secure/super/somefile.html", null);
|
||||
|
||||
ConfigAttributeDefinition response = map.lookupAttributes(fi.getRequestUrl());
|
||||
assertEquals(def, response);
|
||||
}
|
||||
|
||||
|
||||
public void testLookupRequiringExactMatchFailsIfNotMatching() {
|
||||
@Test
|
||||
public void lookupRequiringExactMatchFailsIfNotMatching() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
map.setConvertUrlToLowercaseBeforeComparison(false);
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/secure/super/**", def);
|
||||
|
||||
FilterInvocation fi = createFilterinvocation("/SeCuRE/super/somefile.html");
|
||||
FilterInvocation fi = createFilterInvocation("/SeCuRE/super/somefile.html", null);
|
||||
|
||||
ConfigAttributeDefinition response = map.lookupAttributes(fi.getRequestUrl());
|
||||
assertEquals(null, response);
|
||||
}
|
||||
|
||||
public void testLookupRequiringExactMatchIsSuccessful() {
|
||||
@Test
|
||||
public void lookupRequiringExactMatchIsSuccessful() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
map.setConvertUrlToLowercaseBeforeComparison(false);
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/SeCurE/super/**", def);
|
||||
|
||||
FilterInvocation fi = createFilterinvocation("/SeCurE/super/somefile.html");
|
||||
FilterInvocation fi = createFilterInvocation("/SeCurE/super/somefile.html", null);
|
||||
|
||||
ConfigAttributeDefinition response = map.lookupAttributes(fi.getRequestUrl());
|
||||
assertEquals(def, response);
|
||||
}
|
||||
|
||||
public void testLookupRequiringExactMatchWithAdditionalSlashesIsSuccessful() {
|
||||
@Test
|
||||
public void lookupRequiringExactMatchWithAdditionalSlashesIsSuccessful() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/someAdminPage.html**", def);
|
||||
|
||||
FilterInvocation fi = createFilterinvocation("/someAdminPage.html?a=/test");
|
||||
FilterInvocation fi = createFilterInvocation("/someAdminPage.html?a=/test", null);
|
||||
|
||||
ConfigAttributeDefinition response = map.lookupAttributes(fi.getRequestUrl());
|
||||
assertEquals(def, response); // see SEC-161 (it should truncate after ? sign)
|
||||
}
|
||||
|
||||
@Test(expected = IllegalArgumentException.class)
|
||||
public void unknownHttpMethodIsRejected() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/someAdminPage.html**", "UNKNOWN", def);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void httpMethodLookupSucceeds() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/somepage**", "GET", def);
|
||||
|
||||
FilterInvocation fi = createFilterInvocation("/somepage", "GET");
|
||||
ConfigAttributeDefinition attrs = map.getAttributes(fi);
|
||||
assertEquals(def, attrs);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void requestWithDifferentHttpMethodDoesntMatch() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/somepage**", "GET", def);
|
||||
|
||||
FilterInvocation fi = createFilterInvocation("/somepage", null);
|
||||
ConfigAttributeDefinition attrs = map.getAttributes(fi);
|
||||
assertNull(attrs);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void httpMethodSpecificUrlTakesPrecedence() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
|
||||
// Even though this is added before the method-specific def, the latter should match
|
||||
ConfigAttributeDefinition allMethodDef = new ConfigAttributeDefinition();
|
||||
allMethodDef.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/**", null, allMethodDef);
|
||||
|
||||
ConfigAttributeDefinition postOnlyDef = new ConfigAttributeDefinition();
|
||||
postOnlyDef.addConfigAttribute(new SecurityConfig("ROLE_TWO"));
|
||||
map.addSecureUrl("/somepage**", "POST", postOnlyDef);
|
||||
|
||||
FilterInvocation fi = createFilterInvocation("/somepage", "POST");
|
||||
ConfigAttributeDefinition attrs = map.getAttributes(fi);
|
||||
assertEquals(postOnlyDef, attrs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check fixes for SEC-321
|
||||
*/
|
||||
public void testExtraQuestionMarkStillMatches() {
|
||||
@Test
|
||||
public void extraQuestionMarkStillMatches() {
|
||||
PathBasedFilterInvocationDefinitionMap map = new PathBasedFilterInvocationDefinitionMap();
|
||||
ConfigAttributeDefinition def = new ConfigAttributeDefinition();
|
||||
def.addConfigAttribute(new SecurityConfig("ROLE_ONE"));
|
||||
map.addSecureUrl("/someAdminPage.html*", def);
|
||||
|
||||
FilterInvocation fi = createFilterinvocation("/someAdminPage.html?x=2/aa?y=3");
|
||||
FilterInvocation fi = createFilterInvocation("/someAdminPage.html?x=2/aa?y=3", null);
|
||||
|
||||
ConfigAttributeDefinition response = map.lookupAttributes(fi.getRequestUrl());
|
||||
assertEquals(def, response);
|
||||
|
||||
fi = createFilterinvocation("/someAdminPage.html??");
|
||||
fi = createFilterInvocation("/someAdminPage.html??", null);
|
||||
|
||||
response = map.lookupAttributes(fi.getRequestUrl());
|
||||
assertEquals(def, response);
|
||||
}
|
||||
|
||||
private FilterInvocation createFilterinvocation(String path) {
|
||||
private FilterInvocation createFilterInvocation(String path, String method) {
|
||||
MockHttpServletRequest request = new MockHttpServletRequest();
|
||||
request.setRequestURI(null);
|
||||
request.setMethod(method);
|
||||
|
||||
request.setServletPath(path);
|
||||
|
||||
Reference in New Issue
Block a user