Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-24 21:12:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider.

Browse Source
This commit is contained in:
Luke Taylor 2011-05-20 18:26:43 +01:00
parent ba719dc0e1
commit a24570ae06
2 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
core/src/main/java/org/springframework/security/authentication/jaas/JaasAuthenticationProvider.java
View File

@ -182,7 +182,6 @@ public class JaasAuthenticationProvider implements AuthenticationProvider, Appli
// Create a set to hold the authorities, and add any that have already been applied. // Create a set to hold the authorities, and add any that have already been applied.
authorities = new HashSet<GrantedAuthority>(); authorities = new HashSet<GrantedAuthority>();
authorities.addAll(request.getAuthorities());
// Get the subject principals and pass them to each of the AuthorityGranters // Get the subject principals and pass them to each of the AuthorityGranters
Set<Principal> principals = loginContext.getSubject().getPrincipals(); Set<Principal> principals = loginContext.getSubject().getPrincipals();

5
core/src/test/java/org/springframework/security/authentication/jaas/JaasAuthenticationProviderTests.java
View File

@ -179,7 +179,7 @@ public class JaasAuthenticationProviderTests {
@Test @Test
public void testFull() throws Exception { public void testFull() throws Exception {
List<GrantedAuthority> defaultAuths = AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO"); List<GrantedAuthority> defaultAuths = AuthorityUtils.createAuthorityList("ROLE_ONE");
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password", UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password",
defaultAuths); defaultAuths);
@ -196,8 +196,7 @@ public class JaasAuthenticationProviderTests {
assertTrue("GrantedAuthorities should contain ROLE_TEST1", list.contains(new GrantedAuthorityImpl("ROLE_TEST1"))); assertTrue("GrantedAuthorities should contain ROLE_TEST1", list.contains(new GrantedAuthorityImpl("ROLE_TEST1")));
assertTrue("GrantedAuthorities should contain ROLE_TEST2", list.contains(new GrantedAuthorityImpl("ROLE_TEST2"))); assertTrue("GrantedAuthorities should contain ROLE_TEST2", list.contains(new GrantedAuthorityImpl("ROLE_TEST2")));
assertTrue("GrantedAuthorities should contain ROLE_1", list.contains(defaultAuths.get(0))); assertFalse("GrantedAuthorities should not contain ROLE_ONE", list.contains(defaultAuths.get(0)));
assertTrue("GrantedAuthorities should contain ROLE_2", list.contains(defaultAuths.get(1)));
boolean foundit = false; boolean foundit = false;