Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow security.ignored=none to switch off ignores

Browse Source
This commit is contained in:
Dave Syer
2013-09-06 09:40:04 +01:00
parent 938c267a1d
commit 5f8f062545
4 changed files with 39 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/SecurityAutoConfiguration.java
View File

@@ -128,6 +128,9 @@ public class SecurityAutoConfiguration {
private static class ApplicationWebSecurityConfigurerAdapter extends
WebSecurityConfigurerAdapter {
private static List<String> DEFAULT_IGNORED = Arrays.asList("/css/**", "/js/**",
"/images/**", "/**/favicon.ico");
@Autowired
private SecurityProperties security;
@@ -187,10 +190,17 @@ public class SecurityAutoConfiguration {
@Override
public void configure(WebSecurity builder) throws Exception {
IgnoredRequestConfigurer ignoring = builder.ignoring();
ignoring.antMatchers(this.security.getIgnoredPaths());
if (this.errorController != null) {
ignoring.antMatchers(this.errorController.getErrorPath());
List<String> ignored = new ArrayList<String>(this.security.getIgnored());
if (ignored.isEmpty()) {
ignored.addAll(DEFAULT_IGNORED);
}
else if (ignored.contains("none")) {
ignored.remove("none");
}
if (this.errorController != null) {
ignored.add(this.errorController.getErrorPath());
}
ignoring.antMatchers(ignored.toArray(new String[0]));
}
@Override

14
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/properties/SecurityProperties.java
View File

@@ -43,12 +43,7 @@ public class SecurityProperties {
private SessionCreationPolicy sessions = SessionCreationPolicy.STATELESS;
private List<String> emptyIgnored = new ArrayList<String>();
private List<String> ignored = this.emptyIgnored;
private static String[] DEFAULT_IGNORED = new String[] { "/css/**", "/js/**",
"/images/**", "/**/favicon.ico" };
private List<String> ignored = new ArrayList<String>();
private Management management = new Management();
@@ -106,13 +101,6 @@ public class SecurityProperties {
return this.ignored;
}
public String[] getIgnoredPaths() {
if (this.ignored == this.emptyIgnored) {
return DEFAULT_IGNORED;
}
return this.ignored.toArray(new String[this.ignored.size()]);
}
public static class Headers {
public static enum HSTS {

2
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/SecurityAutoConfigurationTests.java
View File

@@ -64,7 +64,7 @@ public class SecurityAutoConfigurationTests {
EndpointAutoConfiguration.class,
ManagementServerPropertiesAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class);
TestUtils.addEnviroment(this.context, "security.ignored:");
TestUtils.addEnviroment(this.context, "security.ignored:none");
this.context.refresh();
// Just the application and\ management endpoints now
assertEquals(2, this.context.getBean(FilterChainProxy.class).getFilterChains()

25
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/properties/SecurityPropertiesTests.java
View File

@@ -46,6 +46,28 @@ public class SecurityPropertiesTests {
assertEquals(1, security.getIgnored().size());
}
@Test
public void testBindingIgnoredEmpty() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.setConversionService(new DefaultConversionService());
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(0, security.getIgnored().size());
}
@Test
public void testBindingIgnoredDisable() {
SecurityProperties security = new SecurityProperties();
RelaxedDataBinder binder = new RelaxedDataBinder(security, "security");
binder.setConversionService(new DefaultConversionService());
binder.bind(new MutablePropertyValues(Collections.singletonMap(
"security.ignored", "none")));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(1, security.getIgnored().size());
}
@Test
public void testBindingIgnoredMultiValued() {
SecurityProperties security = new SecurityProperties();
@@ -64,10 +86,11 @@ public class SecurityPropertiesTests {
binder.setConversionService(new DefaultConversionService());
Map<String, String> map = new HashMap<String, String>();
map.put("security.ignored[0]", "/css/**");
map.put("security.ignored[1]", "images/**");
map.put("security.ignored[1]", "/foo/**");
binder.bind(new MutablePropertyValues(map));
assertFalse(binder.getBindingResult().hasErrors());
assertEquals(2, security.getIgnored().size());
assertTrue(security.getIgnored().contains("/foo/**"));
}
@Test