diff --git a/web/src/main/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.java index 2ab32598ce..312a17802b 100755 --- a/web/src/main/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.java +++ b/web/src/main/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.java @@ -68,6 +68,12 @@ public abstract class AbstractPreAuthenticatedProcessingFilter extends GenericFi */ @Override public void afterPropertiesSet() { + try { + super.afterPropertiesSet(); + } catch(ServletException e) { + // convert to RuntimeException for passivity on afterPropertiesSet signature + throw new RuntimeException(e); + } Assert.notNull(authenticationManager, "An AuthenticationManager must be set"); } diff --git a/web/src/test/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilterTests.java index cd4cdd907c..6dc9c8a5e4 100644 --- a/web/src/test/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilterTests.java +++ b/web/src/test/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilterTests.java @@ -5,6 +5,7 @@ import static org.mockito.Matchers.any; import static org.mockito.Mockito.*; import javax.servlet.FilterChain; +import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import org.junit.After; @@ -77,6 +78,16 @@ public class AbstractPreAuthenticatedProcessingFilterTests { } } + // SEC-2045 + @Test + public void testAfterPropertiesSetInvokesSuper() throws Exception { + ConcretePreAuthenticatedProcessingFilter filter = new ConcretePreAuthenticatedProcessingFilter(); + AuthenticationManager am = mock(AuthenticationManager.class); + filter.setAuthenticationManager(am); + filter.afterPropertiesSet(); + assertTrue(filter.initFilterBeanInvoked); + } + @Test public void testDoFilterAuthenticated() throws Exception { testDoFilter(true); @@ -140,12 +151,18 @@ public class AbstractPreAuthenticatedProcessingFilterTests { private static class ConcretePreAuthenticatedProcessingFilter extends AbstractPreAuthenticatedProcessingFilter { private String principal = "testPrincipal"; + private boolean initFilterBeanInvoked; protected Object getPreAuthenticatedPrincipal(HttpServletRequest httpRequest) { return principal; } protected Object getPreAuthenticatedCredentials(HttpServletRequest httpRequest) { return "testCredentials"; } + @Override + protected void initFilterBean() throws ServletException { + super.initFilterBean(); + initFilterBeanInvoked = true; + } } }