Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2.7.x' into main

Browse Source
This commit is contained in:
Madhura Bhave
2021-12-17 17:51:48 -08:00
parent c975fbc286 764531c326
commit 48a6470ddb
9 changed files with 379 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/servlet/filter/ErrorPageSecurityFilter.java
View File

@@ -30,6 +30,7 @@ import jakarta.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
import org.springframework.context.ApplicationContext;
import org.springframework.security.authentication.AnonymousAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
@@ -62,17 +63,28 @@ public class ErrorPageSecurityFilter implements Filter {
private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws IOException, ServletException {
if (DispatcherType.ERROR.equals(request.getDispatcherType()) && !isAllowed(request)) {
sendError(request, response);
Integer errorCode = (Integer) request.getAttribute(RequestDispatcher.ERROR_STATUS_CODE);
if (DispatcherType.ERROR.equals(request.getDispatcherType()) && !isAllowed(request, errorCode)) {
response.sendError((errorCode != null) ? errorCode : 401);
return;
}
chain.doFilter(request, response);
}
private boolean isAllowed(HttpServletRequest request) {
String uri = request.getRequestURI();
private boolean isAllowed(HttpServletRequest request, Integer errorCode) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
return getPrivilegeEvaluator().isAllowed(uri, authentication);
if (isUnauthenticated(authentication) && isNotAuthenticationError(errorCode)) {
return true;
}
return getPrivilegeEvaluator().isAllowed(request.getRequestURI(), authentication);
}
private boolean isUnauthenticated(Authentication authentication) {
return (authentication == null || authentication instanceof AnonymousAuthenticationToken);
}
private boolean isNotAuthenticationError(Integer errorCode) {
return (errorCode == null || (errorCode != 401 && errorCode != 403));
}
private WebInvocationPrivilegeEvaluator getPrivilegeEvaluator() {
@@ -93,11 +105,6 @@ public class ErrorPageSecurityFilter implements Filter {
}
}
private void sendError(HttpServletRequest request, HttpServletResponse response) throws IOException {
Integer errorCode = (Integer) request.getAttribute(RequestDispatcher.ERROR_STATUS_CODE);
response.sendError((errorCode != null) ? errorCode : 401);
}
/**
* {@link WebInvocationPrivilegeEvaluator} that always allows access.
*/

12
spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/filter/ErrorPageSecurityFilterTests.java
View File

@@ -20,6 +20,7 @@ import jakarta.servlet.DispatcherType;
import jakarta.servlet.FilterChain;
import jakarta.servlet.RequestDispatcher;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
@@ -27,6 +28,9 @@ import org.springframework.beans.factory.NoSuchBeanDefinitionException;
import org.springframework.context.ApplicationContext;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
import static org.assertj.core.api.Assertions.assertThat;
@@ -64,6 +68,11 @@ class ErrorPageSecurityFilterTests {
this.securityFilter = new ErrorPageSecurityFilter(this.context);
}
@AfterEach
void tearDown() {
SecurityContextHolder.clearContext();
}
@Test
void whenAccessIsAllowedShouldContinueDownFilterChain() throws Exception {
given(this.privilegeEvaluator.isAllowed(anyString(), any())).willReturn(true);
@@ -83,6 +92,9 @@ class ErrorPageSecurityFilterTests {
@Test
void whenAccessIsDeniedAndNoErrorCodeAttributeOnRequest() throws Exception {
given(this.privilegeEvaluator.isAllowed(anyString(), any())).willReturn(false);
SecurityContext securityContext = mock(SecurityContext.class);
SecurityContextHolder.setContext(securityContext);
given(securityContext.getAuthentication()).willReturn(mock(Authentication.class));
this.securityFilter.doFilter(this.request, this.response, this.filterChain);
verifyNoInteractions(this.filterChain);
assertThat(this.response.getStatus()).isEqualTo(401);