Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Deny unauthorized access to the error page

Browse Source 
Fixes gh-26356

Co-authored-by Andy Wilkinson <wilkinsona@vmware.com>
This commit is contained in:
Madhura Bhave
2021-05-17 16:50:20 -07:00
parent 8bd3d53085
commit dd1d1482dc
13 changed files with 377 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator-custom-security/src/test/java/smoketest/actuator/customsecurity/AbstractSampleActuatorCustomSecurityTests.java
View File

@@ -46,9 +46,6 @@ abstract class AbstractSampleActuatorCustomSecurityTests {
@SuppressWarnings("rawtypes")
ResponseEntity<Map> entity = restTemplate().getForEntity(getPath() + "/", Map.class);
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
@SuppressWarnings("unchecked")
Map<String, Object> body = entity.getBody();
assertThat(body.get("error")).isEqualTo("Unauthorized");
assertThat(entity.getHeaders()).doesNotContainKey("Set-Cookie");
}

4
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator-custom-security/src/test/java/smoketest/actuator/customsecurity/SampleActuatorCustomSecurityApplicationTests.java
View File

@@ -66,9 +66,7 @@ class SampleActuatorCustomSecurityApplicationTests extends AbstractSampleActuato
@SuppressWarnings("rawtypes")
ResponseEntity<Map> entity = restTemplate().getForEntity(getPath() + "/foo", Map.class);
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.INTERNAL_SERVER_ERROR);
@SuppressWarnings("unchecked")
Map<String, Object> body = entity.getBody();
assertThat((String) body.get("message")).contains("Expected exception in controller");
assertThat(entity.getBody()).isNull();
}
@Test

1
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/ManagementPathSampleActuatorApplicationTests.java
View File

@@ -53,7 +53,6 @@ class ManagementPathSampleActuatorApplicationTests {
void testHomeIsSecure() {
ResponseEntity<Map<String, Object>> entity = asMapEntity(this.restTemplate.getForEntity("/", Map.class));
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
assertThat(entity.getBody().get("error")).isEqualTo("Unauthorized");
assertThat(entity.getHeaders()).doesNotContainKey("Set-Cookie");
}

1
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/SampleActuatorApplicationTests.java
View File

@@ -57,7 +57,6 @@ class SampleActuatorApplicationTests {
void testHomeIsSecure() {
ResponseEntity<Map<String, Object>> entity = asMapEntity(this.restTemplate.getForEntity("/", Map.class));
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
assertThat(entity.getBody().get("error")).isEqualTo("Unauthorized");
assertThat(entity.getHeaders()).doesNotContainKey("Set-Cookie");
}

2
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/ServletPathSampleActuatorApplicationTests.java
View File

@@ -61,8 +61,6 @@ class ServletPathSampleActuatorApplicationTests {
void testHomeIsSecure() {
ResponseEntity<Map<String, Object>> entity = asMapEntity(this.restTemplate.getForEntity("/spring/", Map.class));
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
Map<String, Object> body = entity.getBody();
assertThat(body.get("error")).isEqualTo("Unauthorized");
assertThat(entity.getHeaders()).doesNotContainKey("Set-Cookie");
}

2
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/main/java/smoketest/web/secure/SampleWebSecureApplication.java
View File

@@ -66,8 +66,10 @@ public class SampleWebSecureApplication implements WebMvcConfigurer {
SecurityFilterChain configure(HttpSecurity http) throws Exception {
http.authorizeRequests((requests) -> {
requests.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll();
requests.antMatchers("/public/**").permitAll();
requests.anyRequest().fullyAuthenticated();
});
http.httpBasic();
http.formLogin((form) -> {
form.loginPage("/login");
form.failureUrl("/login?error").permitAll();

100
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/ErrorPageTests.java Normal file
View File

@@ -0,0 +1,100 @@
/*
* Copyright 2012-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package smoketest.web.secure;
import com.fasterxml.jackson.databind.JsonNode;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
import org.springframework.boot.test.web.client.TestRestTemplate;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import static org.assertj.core.api.Assertions.assertThat;
/**
* Tests to ensure that the error page is accessible only to authorized users.
*
* @author Madhura Bhave
*/
@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT,
classes = { ErrorPageTests.TestConfiguration.class, SampleWebSecureApplication.class },
properties = { "server.error.include-message=always", "spring.security.user.name=username",
"spring.security.user.password=password" })
class ErrorPageTests {
@Autowired
private TestRestTemplate testRestTemplate;
@Test
void testBadCredentials() {
final ResponseEntity<JsonNode> response = this.testRestTemplate.withBasicAuth("username", "wrongpassword")
.exchange("/test", HttpMethod.GET, null, JsonNode.class);
assertThat(response.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
JsonNode jsonResponse = response.getBody();
assertThat(jsonResponse).isNull();
}
@Test
void testNoCredentials() {
final ResponseEntity<JsonNode> response = this.testRestTemplate.exchange("/test", HttpMethod.GET, null,
JsonNode.class);
assertThat(response.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
JsonNode jsonResponse = response.getBody();
assertThat(jsonResponse).isNull();
}
@Test
void testPublicNotFoundPage() {
final ResponseEntity<JsonNode> response = this.testRestTemplate.exchange("/public/notfound", HttpMethod.GET,
null, JsonNode.class);
assertThat(response.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
JsonNode jsonResponse = response.getBody();
assertThat(jsonResponse).isNull();
}
@Test
void testCorrectCredentials() {
final ResponseEntity<String> response = this.testRestTemplate.withBasicAuth("username", "password")
.exchange("/test", HttpMethod.GET, null, String.class);
assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
response.getBody();
assertThat(response.getBody()).isEqualTo("test");
}
@Configuration(proxyBeanMethods = false)
static class TestConfiguration {
@RestController
static class TestController {
@GetMapping("/test")
String test() {
return "test";
}
}
}
}