Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bypass Spring security authentication for remote devtools endpoint

Browse Source 
Closes gh-17878
This commit is contained in:
Madhura Bhave
2019-08-14 19:12:15 -07:00
parent 4b4dc28a86
commit 186530478c
2 changed files with 76 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
spring-boot-project/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfigurationTests.java
View File

@@ -19,6 +19,8 @@ package org.springframework.boot.devtools.autoconfigure;
import java.util.concurrent.atomic.AtomicReference;
import java.util.function.Supplier;
import javax.servlet.Filter;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
@@ -26,6 +28,7 @@ import org.junit.jupiter.api.extension.ExtendWith;
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.boot.devtools.remote.server.DispatcherFilter;
import org.springframework.boot.devtools.restart.MockRestarter;
import org.springframework.boot.devtools.restart.server.HttpRestartServer;
@@ -41,16 +44,22 @@ import org.springframework.mock.web.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockServletContext;
import org.springframework.security.config.BeanIds;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.mockito.Mockito.mock;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
/**
* Tests for {@link RemoteDevToolsAutoConfiguration}.
*
* @author Rob Winch
* @author Phillip Webb
* @author Madhura Bhave
*/
@ExtendWith(MockRestarter.class)
class RemoteDevToolsAutoConfigurationTests {
@@ -138,6 +147,42 @@ class RemoteDevToolsAutoConfigurationTests {
assertRestartInvoked(true);
}
@Test
void securityConfigurationShouldAllowAccess() throws Exception {
this.context = getContext(() -> loadContext("spring.devtools.remote.secret:supersecret"));
DispatcherFilter filter = this.context.getBean(DispatcherFilter.class);
Filter securityFilterChain = this.context.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN, Filter.class);
MockMvc mockMvc = MockMvcBuilders.webAppContextSetup(this.context).addFilter(securityFilterChain)
.addFilter(filter).build();
mockMvc.perform(MockMvcRequestBuilders.get(DEFAULT_CONTEXT_PATH + "/restart").header(DEFAULT_SECRET_HEADER_NAME,
"supersecret")).andExpect(status().isOk());
assertRestartInvoked(true);
}
@Test
void securityConfigurationShouldAllowAccessToCustomPath() throws Exception {
this.context = getContext(() -> loadContext("spring.devtools.remote.secret:supersecret",
"server.servlet.context-path:/test", "spring.devtools.remote.context-path:/custom"));
DispatcherFilter filter = this.context.getBean(DispatcherFilter.class);
Filter securityFilterChain = this.context.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN, Filter.class);
MockMvc mockMvc = MockMvcBuilders.webAppContextSetup(this.context).addFilter(securityFilterChain)
.addFilter(filter).build();
mockMvc.perform(
MockMvcRequestBuilders.get("/test/custom/restart").header(DEFAULT_SECRET_HEADER_NAME, "supersecret"))
.andExpect(status().isOk());
assertRestartInvoked(true);
}
@Test
void securityConfigurationDoesNotAffectOtherPaths() throws Exception {
this.context = getContext(() -> loadContext("spring.devtools.remote.secret:supersecret"));
DispatcherFilter filter = this.context.getBean(DispatcherFilter.class);
Filter securityFilterChain = this.context.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN, Filter.class);
MockMvc mockMvc = MockMvcBuilders.webAppContextSetup(this.context).addFilter(securityFilterChain)
.addFilter(filter).build();
mockMvc.perform(MockMvcRequestBuilders.get("/my-path")).andExpect(status().isUnauthorized());
}
@Test
void disableRestart() throws Exception {
this.context = getContext(() -> loadContext("spring.devtools.remote.secret:supersecret",
@@ -195,7 +240,7 @@ class RemoteDevToolsAutoConfigurationTests {
}
@Configuration(proxyBeanMethods = false)
@Import(RemoteDevToolsAutoConfiguration.class)
@Import({ SecurityAutoConfiguration.class, RemoteDevToolsAutoConfiguration.class })
static class Config {
@Bean