Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-05-31 17:22:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '5.8.x' into 6.0.x

Browse Source 
Closes gh-14116
This commit is contained in:
Josh Cummings 2023-11-07 17:22:36 -07:00
commit 4990373cf9
No known key found for this signature in database
GPG Key ID: A306A51F43B8E5A5
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2018 the original author or authors. * Copyright 2002-2023 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -35,6 +35,7 @@ import org.springframework.security.web.WebAttributes;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices; import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
import org.springframework.util.Assert; import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.GenericFilterBean; import org.springframework.web.filter.GenericFilterBean;
import org.springframework.web.util.HtmlUtils; import org.springframework.web.util.HtmlUtils;
@ -195,7 +196,8 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean {
if (session != null) { if (session != null) {
AuthenticationException ex = (AuthenticationException) session AuthenticationException ex = (AuthenticationException) session
.getAttribute(WebAttributes.AUTHENTICATION_EXCEPTION); .getAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
errorMsg = (ex != null) ? ex.getMessage() : "Invalid credentials"; errorMsg = (ex != null && StringUtils.hasLength(ex.getMessage())) ? ex.getMessage()
: "Invalid credentials";
} }
} }
String contextPath = request.getContextPath(); String contextPath = request.getContextPath();

14
web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java
View File

@ -171,4 +171,18 @@ public class DefaultLoginPageGeneratingFilterTests {
.contains("<a href=\"/saml/sso/google\">Google &lt; &gt; &quot; &#39; &amp;</a>"); .contains("<a href=\"/saml/sso/google\">Google &lt; &gt; &quot; &#39; &amp;</a>");
} }
// gh-13768
@Test
public void generatesWhenExceptionWithEmptyMessageThenInvalidCredentials() throws Exception {
DefaultLoginPageGeneratingFilter filter = new DefaultLoginPageGeneratingFilter(
new UsernamePasswordAuthenticationFilter());
filter.setLoginPageUrl(DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL);
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/login");
request.setQueryString("error");
request.getSession().setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, new BadCredentialsException(null));
MockHttpServletResponse response = new MockHttpServletResponse();
filter.doFilter(request, response, this.chain);
assertThat(response.getContentAsString()).contains("Invalid credentials");
}
} }