Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-04 09:42:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1608: Make sure FirewalledRequest.reset() is called when filter="none"

Browse Source
This commit is contained in:
Luke Taylor 2010-11-02 12:19:22 +00:00
parent fc75b69ab8
commit 71b2af31ee
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/FilterChainProxy.java
View File

@ -158,6 +158,8 @@ public class FilterChainProxy extends GenericFilterBean {
logger.debug(url + (filters == null ? " has no matching filters" : " has an empty filter list")); logger.debug(url + (filters == null ? " has no matching filters" : " has an empty filter list"));
} }
fwRequest.reset();
chain.doFilter(fwRequest, fwResponse); chain.doFilter(fwRequest, fwResponse);
return; return;

14
web/src/test/java/org/springframework/security/web/FilterChainProxyTests.java
View File

@ -10,6 +10,7 @@ import org.mockito.stubbing.Answer;
import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse; import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.web.firewall.FirewalledRequest; import org.springframework.security.web.firewall.FirewalledRequest;
import org.springframework.security.web.firewall.HttpFirewall;
import javax.servlet.Filter; import javax.servlet.Filter;
import javax.servlet.FilterChain; import javax.servlet.FilterChain;
@ -100,4 +101,17 @@ public class FilterChainProxyTests {
verify(chain).doFilter(any(FirewalledRequest.class), any(HttpServletResponse.class)); verify(chain).doFilter(any(FirewalledRequest.class), any(HttpServletResponse.class));
} }
@Test
public void wrapperIsResetWhenNoMatchingFilters() throws Exception {
request.setServletPath("/nomatch");
HttpFirewall fw = mock(HttpFirewall.class);
FirewalledRequest fwr = mock (FirewalledRequest.class);
when(fwr.getRequestURI()).thenReturn("/");
when(fwr.getContextPath()).thenReturn("");
fcp.setFirewall(fw);
when(fw.getFirewalledRequest(request)).thenReturn(fwr);
fcp.doFilter(request, response, chain);
verify(fwr).reset();
}
} }