Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

JSON UserDetails deserializes null 

JSON UserDetails null use to be treated as "".

This changes null to be treated as a null

Issue gh-3736
This commit is contained in:
Rob Winch 2016-09-01 15:01:13 -05:00
parent 3fb77f3b59
commit df613ed4cc
3 changed files with 23 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
cas/src/test/java/org/springframework/security/cas/jackson2/CasAuthenticationTokenMixinTests.java
View File

@ -16,6 +16,11 @@
package org.springframework.security.cas.jackson2;
import java.io.IOException;
import java.util.Collection;
import java.util.Collections;
import java.util.Date;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.jasig.cas.client.authentication.AttributePrincipalImpl;
@ -26,17 +31,14 @@ import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.runners.MockitoJUnitRunner;
import org.skyscreamer.jsonassert.JSONAssert;
import org.springframework.security.cas.authentication.CasAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.jackson2.SecurityJacksonModules;
import java.io.IOException;
import java.util.Collection;
import java.util.Collections;
import java.util.Date;
import static org.assertj.core.api.Assertions.assertThat;
/**
@ -92,6 +94,12 @@ public class CasAuthenticationTokenMixinTests {
JSONAssert.assertEquals(String.format(expectedJson, "null"), actualJson, true);
}
@Test
public void deserializeCasAuthenticationTestAfterEraseCredentialInvoked() throws Exception {
CasAuthenticationToken token = buildObjectMapper().readValue(String.format(expectedJson, "null"), CasAuthenticationToken.class);
assertThat(((UserDetails)token.getPrincipal()).getPassword()).isNull();
}
@Test
public void deserializeCasAuthenticationTest() throws IOException, JSONException {
CasAuthenticationToken token = buildObjectMapper().readValue(String.format(expectedJson, "\"" + PASSWORD + "\""), CasAuthenticationToken.class);

10
core/src/main/java/org/springframework/security/jackson2/UserDeserializer.java
View File

@ -58,12 +58,18 @@ class UserDeserializer extends JsonDeserializer<User> {
JsonNode jsonNode = mapper.readTree(jp);
Set<GrantedAuthority> authorities = mapper.convertValue(jsonNode.get("authorities"), new TypeReference<Set<SimpleGrantedAuthority>>() {
});
return new User(
readJsonNode(jsonNode, "username").asText(), readJsonNode(jsonNode, "password").asText(""),
JsonNode password = readJsonNode(jsonNode, "password");
User result = new User(
readJsonNode(jsonNode, "username").asText(), password.asText(""),
readJsonNode(jsonNode, "enabled").asBoolean(), readJsonNode(jsonNode, "accountNonExpired").asBoolean(),
readJsonNode(jsonNode, "credentialsNonExpired").asBoolean(),
readJsonNode(jsonNode, "accountNonLocked").asBoolean(), authorities
);
if(password.asText(null) == null) {
result.eraseCredentials();
}
return result;
}
private JsonNode readJsonNode(JsonNode jsonNode, String field) {

4
core/src/test/java/org/springframework/security/jackson2/UserDeserializerTests.java
View File

@ -80,8 +80,8 @@ public class UserDeserializerTests extends AbstractMixinTests {
User user = mapper.readValue(userJsonWithoutPasswordString, User.class);
assertThat(user).isNotNull();
assertThat(user.getUsername()).isEqualTo("admin");
assertThat(user.getPassword()).isEqualTo("");
assertThat(user.getAuthorities()).hasSize(0);
assertThat(user.getPassword()).isNull();
assertThat(user.getAuthorities()).isEmpty();
assertThat(user.isEnabled()).isEqualTo(true);
}