diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java index 0f2b64e724..d49ade6696 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java @@ -67,140 +67,142 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers. @ExtendWith(SpringTestContextExtension.class) public class DefaultLoginPageConfigurerTests { - //@formatter:off - public static final String EXPECTED_HTML_HEAD = " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " Please sign in\n" - + " \n" - + " \n"; - //@formatter:on + public static final String EXPECTED_HTML_HEAD = """ + + + + + + + + Please sign in + + + """; public final SpringTestContext spring = new SpringTestContext(this); @@ -222,26 +224,32 @@ public class DefaultLoginPageConfigurerTests { this.mvc.perform(get("/login").sessionAttr(csrfAttributeName, csrfToken)) .andExpect((result) -> { CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName()); - assertThat(result.getResponse().getContentAsString()).isEqualTo("\n" - + "\n" - + EXPECTED_HTML_HEAD - + " \n" - + "
\n" - + "
\n" - + "

Please sign in

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + "\n" - + " \n" - + "
\n" - + "
\n" - + ""); + assertThat(result.getResponse().getContentAsString()).isEqualTo( + EXPECTED_HTML_HEAD + + """ + +
+
+

Please sign in

+ \s +

+ + +

+

+ + +

+ + + +
+ + + +
+ + """.formatted(token.getToken())); }); // @formatter:on } @@ -263,25 +271,32 @@ public class DefaultLoginPageConfigurerTests { .sessionAttr(csrfAttributeName, csrfToken)) .andExpect((result) -> { CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName()); - assertThat(result.getResponse().getContentAsString()).isEqualTo("\n" - + "\n" - + EXPECTED_HTML_HEAD - + " \n" - + "
\n" - + "
\n" - + "

Please sign in

\n" - + "
Bad credentials

\n" - + " \n" - + " \n" - + "

\n" + "

\n" - + " \n" - + " \n" - + "

\n" - + "\n" - + " \n" - + "
\n" - + "
\n" - + ""); + assertThat(result.getResponse().getContentAsString()).isEqualTo( + EXPECTED_HTML_HEAD + + """ + +
+
+

Please sign in

+ +

+ + +

+

+ + +

+ + + +
+ + + +
+ + """.formatted(token.getToken())); }); // @formatter:on } @@ -307,26 +322,32 @@ public class DefaultLoginPageConfigurerTests { this.mvc.perform(get("/login?logout").sessionAttr(csrfAttributeName, csrfToken)) .andExpect((result) -> { CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName()); - assertThat(result.getResponse().getContentAsString()).isEqualTo("\n" - + "\n" - + EXPECTED_HTML_HEAD - + " \n" - + "
\n" - + "
\n" - + "

Please sign in

\n" - + "
You have been signed out

\n" - + " \n" - + " \n" - + "

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + "\n" - + " \n" - + "
\n" - + "
\n" - + ""); + assertThat(result.getResponse().getContentAsString()).isEqualTo( + EXPECTED_HTML_HEAD + + """ + +
+
+

Please sign in

+ +

+ + +

+

+ + +

+ + + +
+ + + +
+ + """.formatted(token.getToken())); }); // @formatter:on } @@ -352,27 +373,32 @@ public class DefaultLoginPageConfigurerTests { this.mvc.perform(get("/login").sessionAttr(csrfAttributeName, csrfToken)) .andExpect((result) -> { CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName()); - assertThat(result.getResponse().getContentAsString()).isEqualTo("\n" - + "\n" - + EXPECTED_HTML_HEAD - + " \n" - + "
\n" - + "
\n" - + "

Please sign in

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + "

Remember me on this computer.

\n" - + "\n" - + " \n" - + "
\n" - + "
\n" - + ""); + assertThat(result.getResponse().getContentAsString()).isEqualTo( + EXPECTED_HTML_HEAD + + """ + +
+
+

Please sign in

+ \s +

+ + +

+

+ + +

+

Remember me on this computer.

+ + +
+ + + +
+ + """.formatted(token.getToken())); }); // @formatter:on } diff --git a/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java b/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java index 1d16c26571..661d20c235 100644 --- a/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java +++ b/config/src/test/java/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.java @@ -45,140 +45,142 @@ public class FormLoginBeanDefinitionParserTests { private static final String CONFIG_LOCATION_PREFIX = "classpath:org/springframework/security/config/http/FormLoginBeanDefinitionParserTests"; - //@formatter:off - public static final String EXPECTED_HTML_HEAD = " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " Please sign in\n" - + " \n" - + " \n"; - //@formatter:on + public static final String EXPECTED_HTML_HEAD = """ + + + + + + + + Please sign in + + + """; public final SpringTestContext spring = new SpringTestContext(this); @@ -188,27 +190,30 @@ public class FormLoginBeanDefinitionParserTests { @Test public void getLoginWhenAutoConfigThenShowsDefaultLoginPage() throws Exception { this.spring.configLocations(this.xml("Simple")).autowire(); - // @formatter:off - String expectedContent = "\n" - + "\n" - + EXPECTED_HTML_HEAD - + " \n" - + "
\n" - + "
\n" - + "

Please sign in

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + " \n" - + "
\n" - + "
\n" - + ""; - // @formatter:on + String expectedContent = EXPECTED_HTML_HEAD + """ + +
+
+

Please sign in

+ \s +

+ + +

+

+ + +

+ + + +
+ + + +
+ + """; this.mvc.perform(get("/login")).andExpect(content().string(expectedContent)); } @@ -221,31 +226,32 @@ public class FormLoginBeanDefinitionParserTests { @Test public void getLoginWhenConfiguredWithCustomAttributesThenLoginPageReflects() throws Exception { this.spring.configLocations(this.xml("WithCustomAttributes")).autowire(); - // @formatter:off - String expectedContent = "\n" - + "\n" - + EXPECTED_HTML_HEAD - + " \n" - + "
\n" - + "
\n" - + "

Please sign in

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + "

\n" - + " \n" - + " \n" - + "

\n" - + " \n" - + "
\n" - + "
\n" - + ""; - this.mvc.perform(get("/login")) - .andExpect(content().string(expectedContent)); - this.mvc.perform(get("/logout")) - .andExpect(status().is3xxRedirection()); - // @formatter:on + String expectedContent = EXPECTED_HTML_HEAD + """ + +
+
+

Please sign in

+ \s +

+ + +

+

+ + +

+ + + +
+ + + +
+ + """; + this.mvc.perform(get("/login")).andExpect(content().string(expectedContent)); + this.mvc.perform(get("/logout")).andExpect(status().is3xxRedirection()); } @Test diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java index 042fc41d26..7373443dce 100644 --- a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java +++ b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java @@ -21,6 +21,7 @@ import java.nio.charset.StandardCharsets; import java.util.Collections; import java.util.Map; import java.util.function.Function; +import java.util.stream.Collectors; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; @@ -38,7 +39,6 @@ import org.springframework.security.web.util.CssUtils; import org.springframework.util.Assert; import org.springframework.util.StringUtils; import org.springframework.web.filter.GenericFilterBean; -import org.springframework.web.util.HtmlUtils; /** * For internal use with namespace configuration in the case where a user doesn't @@ -205,87 +205,106 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean { private String generateLoginPageHtml(HttpServletRequest request, boolean loginError, boolean logoutSuccess) { String errorMsg = loginError ? getLoginErrorMessage(request) : "Invalid credentials"; String contextPath = request.getContextPath(); - StringBuilder sb = new StringBuilder(); - sb.append("\n"); - sb.append("\n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" Please sign in\n"); - sb.append(CssUtils.getCssStyleBlock().indent(4)); - sb.append(" \n"); - sb.append(" \n"); - sb.append("
\n"); - if (this.formLoginEnabled) { - sb.append("
\n"); - sb.append("

Please sign in

\n"); - sb.append(createError(loginError, errorMsg) + createLogoutSuccess(logoutSuccess) + "

\n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append("

\n"); - sb.append("

\n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append("

\n"); - sb.append(createRememberMe(this.rememberMeParameter) + renderHiddenInputs(request)); - sb.append(" \n"); - sb.append("
\n"); + + return HtmlTemplates.fromTemplate(LOGIN_PAGE_TEMPLATE) + .withRawHtml("cssStyle", CssUtils.getCssStyleBlock().indent(4)) + .withRawHtml("formLogin", renderFormLogin(request, loginError, logoutSuccess, contextPath, errorMsg)) + .withRawHtml("oneTimeTokenLogin", + renderOneTimeTokenLogin(request, loginError, logoutSuccess, contextPath, errorMsg)) + .withRawHtml("oauth2Login", renderOAuth2Login(loginError, logoutSuccess, errorMsg, contextPath)) + .withRawHtml("saml2Login", renderSaml2Login(loginError, logoutSuccess, errorMsg, contextPath)) + .render(); + } + + private String renderFormLogin(HttpServletRequest request, boolean loginError, boolean logoutSuccess, + String contextPath, String errorMsg) { + if (!this.formLoginEnabled) { + return ""; } - if (this.oneTimeTokenEnabled) { - sb.append("
\n"); - sb.append("

Request a One-Time Token

\n"); - sb.append(createError(loginError, errorMsg) + createLogoutSuccess(logoutSuccess) + "

\n"); - sb.append(" \n"); - sb.append( - " \n"); - sb.append("

\n"); - sb.append(renderHiddenInputs(request)); - sb.append(" \n"); - sb.append("
\n"); + + String hiddenInputs = this.resolveHiddenInputs.apply(request) + .entrySet() + .stream() + .map((inputKeyValue) -> renderHiddenInput(inputKeyValue.getKey(), inputKeyValue.getValue())) + .collect(Collectors.joining("\n")); + + return HtmlTemplates.fromTemplate(LOGIN_FORM_TEMPLATE) + .withValue("loginUrl", contextPath + this.authenticationUrl) + .withRawHtml("errorMessage", renderError(loginError, errorMsg)) + .withRawHtml("logoutMessage", renderSuccess(logoutSuccess)) + .withValue("usernameParameter", this.usernameParameter) + .withValue("passwordParameter", this.passwordParameter) + .withRawHtml("rememberMeInput", renderRememberMe(this.rememberMeParameter)) + .withRawHtml("hiddenInputs", hiddenInputs) + .render(); + } + + private String renderOneTimeTokenLogin(HttpServletRequest request, boolean loginError, boolean logoutSuccess, + String contextPath, String errorMsg) { + if (!this.oneTimeTokenEnabled) { + return ""; } - if (this.oauth2LoginEnabled) { - sb.append("

Login with OAuth 2.0

"); - sb.append(createError(loginError, errorMsg)); - sb.append(createLogoutSuccess(logoutSuccess)); - sb.append("\n"); - for (Map.Entry clientAuthenticationUrlToClientName : this.oauth2AuthenticationUrlToClientName - .entrySet()) { - sb.append(" \n"); - } - sb.append("
"); - String url = clientAuthenticationUrlToClientName.getKey(); - sb.append(""); - String clientName = HtmlUtils.htmlEscape(clientAuthenticationUrlToClientName.getValue()); - sb.append(clientName); - sb.append(""); - sb.append("
\n"); + + String hiddenInputs = this.resolveHiddenInputs.apply(request) + .entrySet() + .stream() + .map((inputKeyValue) -> renderHiddenInput(inputKeyValue.getKey(), inputKeyValue.getValue())) + .collect(Collectors.joining("\n")); + + return HtmlTemplates.fromTemplate(ONE_TIME_TEMPLATE) + .withValue("generateOneTimeTokenUrl", contextPath + this.generateOneTimeTokenUrl) + .withRawHtml("errorMessage", renderError(loginError, errorMsg)) + .withRawHtml("logoutMessage", renderSuccess(logoutSuccess)) + .withRawHtml("hiddenInputs", hiddenInputs) + .render(); + } + + private String renderOAuth2Login(boolean loginError, boolean logoutSuccess, String errorMsg, String contextPath) { + if (!this.oauth2LoginEnabled) { + return ""; } - if (this.saml2LoginEnabled) { - sb.append("

Login with SAML 2.0

"); - sb.append(createError(loginError, errorMsg)); - sb.append(createLogoutSuccess(logoutSuccess)); - sb.append("\n"); - for (Map.Entry relyingPartyUrlToName : this.saml2AuthenticationUrlToProviderName - .entrySet()) { - sb.append(" \n"); - } - sb.append("
"); - String url = relyingPartyUrlToName.getKey(); - sb.append(""); - String partyName = HtmlUtils.htmlEscape(relyingPartyUrlToName.getValue()); - sb.append(partyName); - sb.append(""); - sb.append("
\n"); + + String oauth2Rows = this.oauth2AuthenticationUrlToClientName.entrySet() + .stream() + .map((urlToName) -> renderOAuth2Row(contextPath, urlToName.getKey(), urlToName.getValue())) + .collect(Collectors.joining("\n")); + + return HtmlTemplates.fromTemplate(OAUTH2_LOGIN_TEMPLATE) + .withRawHtml("errorMessage", renderError(loginError, errorMsg)) + .withRawHtml("logoutMessage", renderSuccess(logoutSuccess)) + .withRawHtml("oauth2Rows", oauth2Rows) + .render(); + } + + private static String renderOAuth2Row(String contextPath, String url, String clientName) { + return HtmlTemplates.fromTemplate(OAUTH2_ROW_TEMPLATE) + .withValue("url", contextPath + url) + .withValue("clientName", clientName) + .render(); + } + + private String renderSaml2Login(boolean loginError, boolean logoutSuccess, String errorMsg, String contextPath) { + if (!this.saml2LoginEnabled) { + return ""; } - sb.append("
\n"); - sb.append(""); - return sb.toString(); + + String samlRows = this.saml2AuthenticationUrlToProviderName.entrySet() + .stream() + .map((urlToName) -> renderSaml2Row(contextPath, urlToName.getKey(), urlToName.getValue())) + .collect(Collectors.joining("\n")); + + return HtmlTemplates.fromTemplate(SAML_LOGIN_TEMPLATE) + .withRawHtml("errorMessage", renderError(loginError, errorMsg)) + .withRawHtml("logoutMessage", renderSuccess(logoutSuccess)) + .withRawHtml("samlRows", samlRows) + .render(); + } + + private static String renderSaml2Row(String contextPath, String url, String clientName) { + return HtmlTemplates.fromTemplate(SAML_ROW_TEMPLATE) + .withValue("url", contextPath + url) + .withValue("clientName", clientName) + .render(); } private String getLoginErrorMessage(HttpServletRequest request) { @@ -303,23 +322,21 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean { return exception.getMessage(); } - private String renderHiddenInputs(HttpServletRequest request) { - StringBuilder sb = new StringBuilder(); - for (Map.Entry input : this.resolveHiddenInputs.apply(request).entrySet()) { - sb.append("\n"); - } - return sb.toString(); + private String renderHiddenInput(String name, String value) { + return HtmlTemplates.fromTemplate(HIDDEN_HTML_INPUT_TEMPLATE) + .withValue("name", name) + .withValue("value", value) + .render(); } - private String createRememberMe(String paramName) { + private String renderRememberMe(String paramName) { if (paramName == null) { return ""; } - return "

Remember me on this computer.

\n"; + return HtmlTemplates + .fromTemplate("

Remember me on this computer.

") + .withValue("paramName", paramName) + .render(); } private boolean isLogoutSuccess(HttpServletRequest request) { @@ -334,14 +351,14 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean { return matches(request, this.failureUrl); } - private String createError(boolean isError, String message) { + private String renderError(boolean isError, String message) { if (!isError) { return ""; } - return "
" + HtmlUtils.htmlEscape(message) + "
"; + return HtmlTemplates.fromTemplate(ALERT_TEMPLATE).withValue("message", message).render(); } - private String createLogoutSuccess(boolean isLogoutSuccess) { + private String renderSuccess(boolean isLogoutSuccess) { if (!isLogoutSuccess) { return ""; } @@ -367,4 +384,81 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean { return uri.equals(request.getContextPath() + url); } + private static final String LOGIN_PAGE_TEMPLATE = """ + + + + + + + + Please sign in + {{cssStyle}} + + +
+ {{formLogin}} + {{oneTimeTokenLogin}} + {{oauth2Login}} + {{saml2Login}} +
+ + """; + + private static final String LOGIN_FORM_TEMPLATE = """ +
+

Please sign in

+ {{errorMessage}}{{logoutMessage}} +

+ + +

+

+ + +

+ {{rememberMeInput}} + {{hiddenInputs}} + +
"""; + + private static final String HIDDEN_HTML_INPUT_TEMPLATE = """ + + """; + + private static final String ALERT_TEMPLATE = """ + """; + + private static final String OAUTH2_LOGIN_TEMPLATE = """ +

Login with OAuth 2.0

+ {{errorMessage}}{{logoutMessage}} + + {{oauth2Rows}} +
"""; + + private static final String OAUTH2_ROW_TEMPLATE = """ + {{clientName}}"""; + + private static final String SAML_LOGIN_TEMPLATE = """ +

Login with SAML 2.0

+ {{errorMessage}}{{logoutMessage}} + + {{samlRows}} +
"""; + + private static final String SAML_ROW_TEMPLATE = OAUTH2_ROW_TEMPLATE; + + private static final String ONE_TIME_TEMPLATE = """ +
+

Request a One-Time Token

+ {{errorMessage}}{{logoutMessage}} +

+ + +

+ {{hiddenInputs}} + +
+ """; + } diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java index 9c38b8cb5e..d5dbf85f2d 100644 --- a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java +++ b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java @@ -61,30 +61,13 @@ public class DefaultLogoutPageGeneratingFilter extends OncePerRequestFilter { } private void renderLogout(HttpServletRequest request, HttpServletResponse response) throws IOException { - StringBuilder sb = new StringBuilder(); - sb.append("\n"); - sb.append("\n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" \n"); - sb.append(" Confirm Log Out?\n"); - sb.append(CssUtils.getCssStyleBlock().indent(4)); - sb.append(" \n"); - sb.append(" \n"); - sb.append("
\n"); - sb.append("
\n"); - sb.append("

Are you sure you want to log out?

\n"); - sb.append(renderHiddenInputs(request)); - sb.append(" \n"); - sb.append("
\n"); - sb.append("
\n"); - sb.append(" \n"); - sb.append(""); + String renderedPage = HtmlTemplates.fromTemplate(LOGOUT_PAGE_TEMPLATE) + .withRawHtml("cssStyle", CssUtils.getCssStyleBlock().indent(4)) + .withValue("contextPath", request.getContextPath()) + .withRawHtml("hiddenInputs", renderHiddenInputs(request).indent(8)) + .render(); response.setContentType("text/html;charset=UTF-8"); - response.getWriter().write(sb.toString()); + response.getWriter().write(renderedPage); } /** @@ -101,13 +84,39 @@ public class DefaultLogoutPageGeneratingFilter extends OncePerRequestFilter { private String renderHiddenInputs(HttpServletRequest request) { StringBuilder sb = new StringBuilder(); for (Map.Entry input : this.resolveHiddenInputs.apply(request).entrySet()) { - sb.append("\n"); + String inputElement = HtmlTemplates.fromTemplate(HIDDEN_HTML_INPUT_TEMPLATE) + .withValue("name", input.getKey()) + .withValue("value", input.getValue()) + .render(); + sb.append(inputElement); } return sb.toString(); } + private static final String LOGOUT_PAGE_TEMPLATE = """ + + + + + + + + Confirm Log Out? + {{cssStyle}} + + +
+
+

Are you sure you want to log out?

+ {{hiddenInputs}} + +
+
+ + """; + + private static final String HIDDEN_HTML_INPUT_TEMPLATE = """ + + """; + } diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/HtmlTemplates.java b/web/src/main/java/org/springframework/security/web/authentication/ui/HtmlTemplates.java new file mode 100644 index 0000000000..6d897ebf0f --- /dev/null +++ b/web/src/main/java/org/springframework/security/web/authentication/ui/HtmlTemplates.java @@ -0,0 +1,107 @@ +/* + * Copyright 2002-2024 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.web.authentication.ui; + +import java.util.HashMap; +import java.util.Map; +import java.util.regex.Pattern; +import java.util.stream.Collectors; + +import org.springframework.util.StringUtils; +import org.springframework.web.util.HtmlUtils; + +/** + * Render HTML templates using string substitution. Intended for internal use. Variables + * can be templated using double curly-braces: {@code {{name}}}. + * + * @author Daniel Garnier-Moiroux + * @since 6.4 + */ +final class HtmlTemplates { + + private HtmlTemplates() { + } + + static Builder fromTemplate(String template) { + return new Builder(template); + } + + static final class Builder { + + private final String template; + + private final Map values = new HashMap<>(); + + private Builder(String template) { + this.template = template; + } + + /** + * HTML-escape, and inject value {@code value} in every {@code {{key}}} + * placeholder. + * @param key the placeholder name + * @param value the value to inject + * @return this instance for further templating + */ + Builder withValue(String key, String value) { + this.values.put(key, HtmlUtils.htmlEscape(value)); + return this; + } + + /** + * Inject value {@code value} in every {@code {{key}}} placeholder without + * HTML-escaping. Useful for injecting "sub-templates". + * @param key the placeholder name + * @param value the value to inject + * @return this instance for further templating + */ + Builder withRawHtml(String key, String value) { + if (!value.isEmpty() && value.charAt(value.length() - 1) == '\n') { + value = value.substring(0, value.length() - 1); + } + this.values.put(key, value); + return this; + } + + /** + * Render the template. All placeholders MUST have a corresponding value. If a + * placeholder does not have a corresponding value, throws + * {@link IllegalStateException}. + * @return the rendered template + */ + String render() { + String template = this.template; + for (String key : this.values.keySet()) { + String pattern = Pattern.quote("{{" + key + "}}"); + template = template.replaceAll(pattern, this.values.get(key)); + } + + String unusedPlaceholders = Pattern.compile("\\{\\{([a-zA-Z0-9]+)}}") + .matcher(template) + .results() + .map((result) -> result.group(1)) + .collect(Collectors.joining(", ")); + if (StringUtils.hasLength(unusedPlaceholders)) { + throw new IllegalStateException("Unused placeholders in template: [%s]".formatted(unusedPlaceholders)); + } + + return template; + } + + } + +} diff --git a/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java index 9527709878..e9c21163f9 100644 --- a/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java +++ b/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java @@ -16,10 +16,12 @@ package org.springframework.security.web.authentication; +import java.io.IOException; import java.util.Collections; import java.util.Locale; import jakarta.servlet.FilterChain; +import jakarta.servlet.ServletException; import org.junit.jupiter.api.Test; import org.springframework.context.support.MessageSourceAccessor; @@ -195,15 +197,204 @@ public class DefaultLoginPageGeneratingFilterTests { filter.doFilter(new MockHttpServletRequest("GET", "/login"), response, this.chain); assertThat(response.getContentAsString()).contains("Request a One-Time Token"); assertThat(response.getContentAsString()).contains(""" - """); } + @Test + void generatesThenRenders() throws ServletException, IOException { + DefaultLoginPageGeneratingFilter filter = new DefaultLoginPageGeneratingFilter( + new UsernamePasswordAuthenticationFilter()); + filter.setLoginPageUrl(DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL); + filter.setSaml2LoginEnabled(true); + String clientName = "Google < > \" \' &"; + filter.setSaml2AuthenticationUrlToProviderName(Collections.singletonMap("/saml/sso/google", clientName)); + filter.setOauth2LoginEnabled(true); + clientName = "Google < > \" \' &"; + filter.setOauth2AuthenticationUrlToClientName( + Collections.singletonMap("/oauth2/authorization/google", clientName)); + + MockHttpServletRequest request = new MockHttpServletRequest("GET", "/login"); + request.setQueryString("error"); + MockHttpServletResponse response = new MockHttpServletResponse(); + request.getSession() + .setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, new BadCredentialsException("Bad credentials")); + filter.doFilter(request, response, this.chain); + assertThat(response.getContentAsString()).isEqualTo(""" + + + + + + + + Please sign in + + + +
+ + +

Login with OAuth 2.0

+ + + +
Google < > " ' &
+

Login with SAML 2.0

+ + + +
Google < > " ' &
+
+ + """); + } + } diff --git a/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java index 796ef2f073..85f76e6314 100644 --- a/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java +++ b/web/src/test/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilterTests.java @@ -59,4 +59,156 @@ public class DefaultLogoutPageGeneratingFilterTests { .andExpect(content().string(containsString("action=\"/context/logout\""))); } + @Test + void doFilterWhenRequestContextAndHiddenInputsSetThenRendered() throws Exception { + this.filter.setResolveHiddenInputs((r) -> Collections.singletonMap("_csrf", "csrf-token-1")); + MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new Object()).addFilters(this.filter).build(); + + mockMvc.perform(get("/context/logout").contextPath("/context")).andExpect(content().string(""" + + + + + + + + Confirm Log Out? + + + +
+
+

Are you sure you want to log out?

+ + +
+
+ + """)); + } + } diff --git a/web/src/test/java/org/springframework/security/web/authentication/ui/HtmlTemplatesTests.java b/web/src/test/java/org/springframework/security/web/authentication/ui/HtmlTemplatesTests.java new file mode 100644 index 0000000000..22d472af09 --- /dev/null +++ b/web/src/test/java/org/springframework/security/web/authentication/ui/HtmlTemplatesTests.java @@ -0,0 +1,147 @@ +/* + * Copyright 2002-2024 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.web.authentication.ui; + +import org.junit.jupiter.api.Test; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatExceptionOfType; + +/** + * @author Daniel Garnier-Moiroux + * @since 6.4 + */ +class HtmlTemplatesTests { + + @Test + void processTemplateWhenNoVariablesThenRendersTemplate() { + String template = """ +
    +
  • Lorem ipsum dolor sit amet
    • +
  • consectetur adipiscing elit
    • +
  • sed do eiusmod tempor incididunt ut labore
    • +
  • et dolore magna aliqua
    • +
+ """; + + assertThat(HtmlTemplates.fromTemplate(template).render()).isEqualTo(template); + } + + @Test + void renderWhenVariablesThenRendersTemplate() { + String template = """ +
    +
  • {{one}}
    • +
  • {{two}}
    • +
+ """; + + String renderedTemplate = HtmlTemplates.fromTemplate(template) + .withValue("one", "Lorem ipsum dolor sit amet") + .withValue("two", "consectetur adipiscing elit") + .render(); + + assertThat(renderedTemplate).isEqualTo(""" +
    +
  • Lorem ipsum dolor sit amet
    • +
  • consectetur adipiscing elit
    • +
+ """); + } + + @Test + void renderWhenVariablesThenEscapedAndRender() { + String template = "

{{content}}

"; + + String renderedTemplate = HtmlTemplates.fromTemplate(template) + .withValue("content", "The tag is very common in HTML.") + .render(); + + assertThat(renderedTemplate).isEqualTo("

The <a> tag is very common in HTML.

"); + } + + @Test + void renderWhenRawHtmlVariablesThenRendersTemplate() { + String template = """ +

+ The {{title}} is a placeholder text used in print. +

+ """; + + String renderedTemplate = HtmlTemplates.fromTemplate(template) + .withRawHtml("title", "Lorem Ipsum") + .render(); + + assertThat(renderedTemplate).isEqualTo(""" +

+ The Lorem Ipsum is a placeholder text used in print. +

+ """); + } + + @Test + void renderWhenRawHtmlVariablesThenTrimsTrailingNewline() { + String template = """ +
    + {{content}} +
+ """; + + String renderedTemplate = HtmlTemplates.fromTemplate(template) + .withRawHtml("content", "
  • Lorem ipsum dolor sit amet
    • ".indent(2)) + .render(); + + assertThat(renderedTemplate).isEqualTo(""" +
      +
    • Lorem ipsum dolor sit amet
      • +
    + """); + } + + @Test + void renderWhenEmptyVariablesThenRender() { + String template = """ +
  • One: {{one}}
    • + {{two}} + """; + + String renderedTemplate = HtmlTemplates.fromTemplate(template) + .withValue("one", "") + .withRawHtml("two", "") + .render(); + + assertThat(renderedTemplate).isEqualTo(""" +
  • One:
    • + + """); + } + + @Test + void renderWhenMissingVariablesThenThrows() { + String template = """ +
  • One: {{one}}
    • +
  • Two: {{two}}
    • + {{three}} + """; + + HtmlTemplates.Builder templateBuilder = HtmlTemplates.fromTemplate(template) + .withValue("one", "Lorem ipsum dolor sit amet"); + assertThatExceptionOfType(IllegalStateException.class).isThrownBy(templateBuilder::render) + .withMessage("Unused placeholders in template: [two, three]"); + } + +} diff --git a/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java b/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java index bb2feb3e98..a3b5b29ab2 100644 --- a/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java +++ b/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java @@ -43,4 +43,12 @@ public class LogoutPageGeneratingWebFilterTests { assertThat(exchange.getResponse().getBodyAsString().block()).contains("action=\"/logout\""); } + @Test + void filterThenRendersPage() { + LogoutPageGeneratingWebFilter filter = new LogoutPageGeneratingWebFilter(); + MockServerWebExchange exchange = MockServerWebExchange + .from(MockServerHttpRequest.get("/test/logout").contextPath("/test")); + filter.filter(exchange, (e) -> Mono.empty()).block(); + } + }