Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-28 14:52:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-782: Incorrect UrlMatcher initialization in FilterChainProxy results in wrong lowercase/uppercase matching

Browse Source 
http://jira.springframework.org/browse/SEC-782. I've updated FilterChainProxy to make sure the same UrlMatcher is used throughout when converting a legacy configuration.
This commit is contained in:
Luke Taylor 2008-04-21 16:51:06 +00:00
parent 5bb558bd6a
commit 1a4130528a
3 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/src/main/java/org/springframework/security/util/FilterChainProxy.java
View File

@ -116,8 +116,8 @@ public class FilterChainProxy implements Filter, InitializingBean, ApplicationCo
if (fids != null) { if (fids != null) {
Assert.isNull(uncompiledFilterChainMap, "Set the filterChainMap or FilterInvocationDefinitionSource but not both"); Assert.isNull(uncompiledFilterChainMap, "Set the filterChainMap or FilterInvocationDefinitionSource but not both");
FIDSToFilterChainMapConverter converter = new FIDSToFilterChainMapConverter(fids, applicationContext); FIDSToFilterChainMapConverter converter = new FIDSToFilterChainMapConverter(fids, applicationContext);
setFilterChainMap(converter.getFilterChainMap());
setMatcher(converter.getMatcher()); setMatcher(converter.getMatcher());
setFilterChainMap(converter.getFilterChainMap());
fids = null; fids = null;
} }

9
core/src/test/java/org/springframework/security/util/FilterChainProxyTests.java
View File

@ -137,6 +137,12 @@ public class FilterChainProxyTests {
doNormalOperation(filterChainProxy); doNormalOperation(filterChainProxy);
} }
@Test
public void proxyPathWithoutLowerCaseConversionShouldntMatchDifferentCasePath() throws Exception {
FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("filterChainNonLowerCase", FilterChainProxy.class);
assertNull(filterChainProxy.getFilters("/some/other/path/blah"));
}
@Test @Test
public void normalOperationWithNewConfig() throws Exception { public void normalOperationWithNewConfig() throws Exception {
FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxy", FilterChainProxy.class); FilterChainProxy filterChainProxy = (FilterChainProxy) appCtx.getBean("newFilterChainProxy", FilterChainProxy.class);
@ -163,7 +169,8 @@ public class FilterChainProxyTests {
assertEquals(1, filters.size()); assertEquals(1, filters.size());
assertTrue(filters.get(0) instanceof MockFilter); assertTrue(filters.get(0) instanceof MockFilter);
filters = filterChainProxy.getFilters("/sOme/other/path/blah"); filters = filterChainProxy.getFilters("/some/other/path/blah");
assertNotNull(filters);
assertEquals(3, filters.size()); assertEquals(3, filters.size());
assertTrue(filters.get(0) instanceof HttpSessionContextIntegrationFilter); assertTrue(filters.get(0) instanceof HttpSessionContextIntegrationFilter);
assertTrue(filters.get(1) instanceof MockFilter); assertTrue(filters.get(1) instanceof MockFilter);

11
core/src/test/resources/org/springframework/security/util/filtertest-valid.xml
View File

@ -53,6 +53,17 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc
</property> </property>
</bean> </bean>
<bean id="filterChainNonLowerCase" class="org.springframework.security.util.FilterChainProxy">
<property name="filterInvocationDefinitionSource">
<value>
PATTERN_TYPE_APACHE_ANT
/foo/**=mockFilter
/SOME/other/path/**=sif,mockFilter,mockFilter2
/do/not/filter=#NONE#
</value>
</property>
</bean>
<bean id="newFilterChainProxy" class="org.springframework.security.util.FilterChainProxy"> <bean id="newFilterChainProxy" class="org.springframework.security.util.FilterChainProxy">
<sec:filter-chain-map path-type="ant"> <sec:filter-chain-map path-type="ant">
<sec:filter-chain pattern="/foo/**" filters="mockFilter"/> <sec:filter-chain pattern="/foo/**" filters="mockFilter"/>