From 863b36962b8aa3ed99c1690e01b9a18e1e3f97e8 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Wed, 28 Dec 2011 12:50:06 -0600 Subject: [PATCH] SEC-1878: Added test to ensure that DefaultFilterChainValidator can handle web expressions --- .../DefaultFilterChainValidatorTests.java | 101 ++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 config/src/test/java/org/springframework/security/config/http/DefaultFilterChainValidatorTests.java diff --git a/config/src/test/java/org/springframework/security/config/http/DefaultFilterChainValidatorTests.java b/config/src/test/java/org/springframework/security/config/http/DefaultFilterChainValidatorTests.java new file mode 100644 index 0000000000..91aa5dd904 --- /dev/null +++ b/config/src/test/java/org/springframework/security/config/http/DefaultFilterChainValidatorTests.java @@ -0,0 +1,101 @@ +/* + * Copyright 2011 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the + * specific language governing permissions and limitations under the License. + */ +package org.springframework.security.config.http; + +import static org.mockito.Matchers.any; +import static org.mockito.Matchers.anyObject; +import static org.mockito.Matchers.contains; +import static org.mockito.Mockito.doThrow; +import static org.mockito.Mockito.verify; + +import java.util.Arrays; +import java.util.Collection; +import java.util.Collections; +import java.util.HashMap; +import java.util.LinkedHashMap; +import java.util.Map; + +import org.apache.commons.logging.Log; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.internal.util.reflection.Whitebox; +import org.mockito.runners.MockitoJUnitRunner; +import org.springframework.security.access.AccessDecisionManager; +import org.springframework.security.access.ConfigAttribute; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.authority.AuthorityUtils; +import org.springframework.security.core.userdetails.memory.UserAttribute; +import org.springframework.security.web.FilterChainProxy; +import org.springframework.security.web.access.ExceptionTranslationFilter; +import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource; +import org.springframework.security.web.access.intercept.FilterSecurityInterceptor; +import org.springframework.security.web.access.intercept.RequestKey; +import org.springframework.security.web.authentication.AnonymousAuthenticationFilter; +import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; +import org.springframework.security.web.util.AntUrlPathMatcher; + +/** + * + * @author Rob Winch + */ +@RunWith(MockitoJUnitRunner.class) +public class DefaultFilterChainValidatorTests { + private DefaultFilterChainValidator validator; + private FilterChainProxy fcp; + @Mock + private Log logger; + @Mock + private AccessDecisionManager accessDecisionManager; + + @SuppressWarnings({"unchecked","rawtypes"}) + @Before + public void setUp() throws Exception { + AntUrlPathMatcher matcher = new AntUrlPathMatcher(); + LinkedHashMap> requestMap = new LinkedHashMap>(); + requestMap.put(new RequestKey("/login"), Collections.emptyList()); + DefaultFilterInvocationSecurityMetadataSource metadataSource = new DefaultFilterInvocationSecurityMetadataSource(matcher,requestMap); + AnonymousAuthenticationFilter aaf = new AnonymousAuthenticationFilter(); + aaf.setKey("anonymous"); + UserAttribute userAttribute = new UserAttribute(); + userAttribute.setAuthorities(AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")); + userAttribute.setPassword("password"); + aaf.setUserAttribute(userAttribute); + FilterSecurityInterceptor fsi = new FilterSecurityInterceptor(); + fsi.setAccessDecisionManager(accessDecisionManager); + fsi.setSecurityMetadataSource(metadataSource); + LoginUrlAuthenticationEntryPoint authenticationEntryPoint = new LoginUrlAuthenticationEntryPoint(); + authenticationEntryPoint.setLoginFormUrl("/login"); + ExceptionTranslationFilter etf = new ExceptionTranslationFilter(); + etf.setAuthenticationEntryPoint(authenticationEntryPoint); + Map filterChainMap = new HashMap(); + filterChainMap.put("/**",Arrays.asList(aaf,etf,fsi)); + fcp = new FilterChainProxy(); + fcp.setFilterChainMap(filterChainMap); + fcp.setMatcher(matcher); + validator = new DefaultFilterChainValidator(); + Whitebox.setInternalState(validator, "logger", logger); + } + + // Ensure SEC-1878 does not occur later + @SuppressWarnings("unchecked") + @Test + public void validateCheckLoginPageIsntProtectedThrowsIllegalArgumentException() { + IllegalArgumentException toBeThrown = new IllegalArgumentException("failed to eval expression"); + doThrow(toBeThrown).when(accessDecisionManager).decide(any(Authentication.class), anyObject(), any(Collection.class)); + validator.validate(fcp); + verify(logger).warn(contains(toBeThrown.toString())); + } + +}