honeymoose
/
hapi-fhir
mirror of https://github.com/hapifhir/hapi-fhir.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Convert a few nulls to aggressive denies

This commit is contained in:
Tadgh 2024-05-08 20:03:46 -07:00
parent 7a461df2db
commit 9021e7e765
2 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/RuleBulkExportImpl.java
View File

@ -80,10 +80,10 @@ public class RuleBulkExportImpl extends BaseRule {
// Do we only authorize some types? If so, make sure requested types are a subset // Do we only authorize some types? If so, make sure requested types are a subset
if (isNotEmpty(myResourceTypes)) { if (isNotEmpty(myResourceTypes)) {
if (isEmpty(inboundBulkExportRequestOptions.getResourceTypes())) { if (isEmpty(inboundBulkExportRequestOptions.getResourceTypes())) {
return null; return new AuthorizationInterceptor.Verdict(PolicyEnum.DENY, this);
} }
if (!myResourceTypes.containsAll(inboundBulkExportRequestOptions.getResourceTypes())) { if (!myResourceTypes.containsAll(inboundBulkExportRequestOptions.getResourceTypes())) {
return null; return new AuthorizationInterceptor.Verdict(PolicyEnum.DENY, this);
} }
} }
@ -136,8 +136,9 @@ public class RuleBulkExportImpl extends BaseRule {
Set<String> permittedPatientIds = sanitizeIds(myPatientIds); Set<String> permittedPatientIds = sanitizeIds(myPatientIds);
if (permittedPatientIds.containsAll(requestedPatientIds)) { if (permittedPatientIds.containsAll(requestedPatientIds)) {
return allowVerdict; return allowVerdict;
} else {
return new AuthorizationInterceptor.Verdict(PolicyEnum.DENY, this);
} }
return null;
} }
} }
return null; return null;

17
hapi-fhir-server/src/test/java/ca/uhn/fhir/rest/server/interceptor/auth/RuleBulkExportImplTest.java
View File

@ -49,7 +49,7 @@ public class RuleBulkExportImplTest {
when(myRequestDetails.getAttribute(any())).thenReturn(options); when(myRequestDetails.getAttribute(any())).thenReturn(options);
AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut); AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut);
assertAbstain(verdict); assertDeny(verdict);
} }
@ -68,7 +68,7 @@ public class RuleBulkExportImplTest {
when(myRequestDetails.getAttribute(any())).thenReturn(options); when(myRequestDetails.getAttribute(any())).thenReturn(options);
AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut); AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut);
assertAbstain(verdict); assertDeny(verdict);
} }
@Test @Test
@ -106,7 +106,7 @@ public class RuleBulkExportImplTest {
AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut); AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut);
assertAbstain(verdict); assertDeny(verdict);
} }
@Nested @Nested
class StyleChecks { class StyleChecks {
@ -316,7 +316,7 @@ public class RuleBulkExportImplTest {
AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut); AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut);
//Then: abstain //Then: abstain
assertAbstain(verdict); assertDeny(verdict);
} }
@Test @Test
@ -426,7 +426,7 @@ public class RuleBulkExportImplTest {
final AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut); final AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut);
//Then: We do not have permissions on the requested patient so we abstain //Then: We do not have permissions on the requested patient so we abstain
assertAbstain(verdict); assertDeny(verdict);
} }
@Test @Test
@ -484,7 +484,7 @@ public class RuleBulkExportImplTest {
final AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut); final AuthorizationInterceptor.Verdict verdict = myRule.applyRule(myOperation, myRequestDetails, null, null, null, myRuleApplier, myFlags, myPointcut);
//Then: There are unpermitted patients in the request so this is not permitted. //Then: There are unpermitted patients in the request so this is not permitted.
assertAbstain(verdict); assertDeny(verdict);
} // } //
@Test @Test
@ -567,4 +567,9 @@ public class RuleBulkExportImplTest {
Assertions.assertNotNull(verdict, "Expect ALLOW, got abstain"); Assertions.assertNotNull(verdict, "Expect ALLOW, got abstain");
Assertions.assertEquals(PolicyEnum.ALLOW, verdict.getDecision(), "Expect ALLOW"); Assertions.assertEquals(PolicyEnum.ALLOW, verdict.getDecision(), "Expect ALLOW");
} }
private static void assertDeny(AuthorizationInterceptor.Verdict verdict) {
Assertions.assertNotNull(verdict, "Expect DENY, got abstain");
Assertions.assertEquals(PolicyEnum.DENY, verdict.getDecision(), "Expect DENY");
}
} }