Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Copy Token Introspection Attributes Map 

Dereference Map passed into constructor for
OAuth2IntrospectionAuthenticationToken.

Fixes: gh-6843
This commit is contained in:
Josh Cummings 2019-05-07 13:17:06 -06:00
parent ead28a3cee
commit 7200fa2dce
No known key found for this signature in database
GPG Key ID: 49EF60DD7FF83443
2 changed files with 32 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/OAuth2IntrospectionAuthenticationToken.java
View File

@ -66,13 +66,17 @@ public class OAuth2IntrospectionAuthenticationToken
public OAuth2IntrospectionAuthenticationToken(OAuth2AccessToken token,
Map<String, Object> attributes, Collection<? extends GrantedAuthority> authorities, String name) {
super(token, attributes, token, authorities);
Assert.notEmpty(attributes, "attributes cannot be empty");
this.attributes = Collections.unmodifiableMap(new LinkedHashMap<>(attributes));
super(token, attributes(attributes), token, authorities);
this.attributes = attributes(attributes);
this.name = name == null ? (String) attributes.get(SUBJECT) : name;
setAuthenticated(true);
}
private static Map<String, Object> attributes(Map<String, Object> attributes) {
Assert.notEmpty(attributes, "attributes cannot be empty");
return Collections.unmodifiableMap(new LinkedHashMap<>(attributes));
}
/**
* {@inheritDoc}
*/

27
oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/OAuth2IntrospectionAuthenticationTokenTests.java
View File

@ -16,12 +16,14 @@
package org.springframework.security.oauth2.server.resource.authentication;
import java.net.URL;
import java.time.Instant;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import net.minidev.json.JSONObject;
import org.junit.Before;
import org.junit.Test;
@ -79,7 +81,7 @@ public class OAuth2IntrospectionAuthenticationTokenTests {
@Test
public void constructorWhenTokenIsNullThenThrowsException() {
assertThatCode(() -> new OAuth2IntrospectionAuthenticationToken(null, null, null))
assertThatCode(() -> new OAuth2IntrospectionAuthenticationToken(null, this.attributes, null))
.isInstanceOf(IllegalArgumentException.class)
.hasMessageContaining("token cannot be null");
}
@ -88,7 +90,7 @@ public class OAuth2IntrospectionAuthenticationTokenTests {
public void constructorWhenAttributesAreNullOrEmptyThenThrowsException() {
assertThatCode(() -> new OAuth2IntrospectionAuthenticationToken(this.token, null, null))
.isInstanceOf(IllegalArgumentException.class)
.hasMessageContaining("principal cannot be null");
.hasMessageContaining("attributes cannot be empty");
assertThatCode(() -> new OAuth2IntrospectionAuthenticationToken(this.token, Collections.emptyMap(), null))
.isInstanceOf(IllegalArgumentException.class)
@ -117,4 +119,25 @@ public class OAuth2IntrospectionAuthenticationTokenTests {
new OAuth2IntrospectionAuthenticationToken(this.token, this.attributes, authorities);
assertThat(authenticated.getAuthorities()).isEqualTo(authorities);
}
// gh-6843
@Test
public void constructorWhenDefaultParametersThenSetsPrincipalToAttributesCopy() {
JSONObject attributes = new JSONObject();
attributes.put("active", true);
OAuth2IntrospectionAuthenticationToken token =
new OAuth2IntrospectionAuthenticationToken(this.token, attributes, Collections.emptyList());
assertThat(token.getPrincipal()).isNotSameAs(attributes);
assertThat(token.getTokenAttributes()).isNotSameAs(attributes);
}
// gh-6843
@Test
public void toStringWhenAttributesContainsURLThenDoesNotFail() throws Exception {
JSONObject attributes = new JSONObject(Collections.singletonMap("iss", new URL("https://idp.example.com")));
OAuth2IntrospectionAuthenticationToken token =
new OAuth2IntrospectionAuthenticationToken(this.token, attributes, Collections.emptyList());
assertThatCode(token::toString)
.doesNotThrowAnyException();
}
}