Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish

Browse Source
This commit is contained in:
Phillip Webb
2017-03-01 23:28:59 -08:00
parent 031c9bf191
commit f1012c104a
8 changed files with 30 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointSecurityInterceptor.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2016 the original author or authors.
* Copyright 2012-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -128,7 +128,8 @@ public class MvcEndpointSecurityInterceptor extends HandlerInterceptorAdapter {
private class AuthoritiesValidator {
private boolean hasAuthority(String role) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
Authentication authentication = SecurityContextHolder.getContext()
.getAuthentication();
if (authentication != null) {
for (GrantedAuthority authority : authentication.getAuthorities()) {
if (authority.getAuthority().equals(role)) {

14
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointSecurityInterceptorTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2016 the original author or authors.
* Copyright 2012-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -130,11 +130,13 @@ public class MvcEndpointSecurityInterceptorTests {
}
@Test
public void sensitiveEndpointIfRoleNotCorrectShouldCheckAuthorities() throws Exception {
public void sensitiveEndpointIfRoleNotCorrectShouldCheckAuthorities()
throws Exception {
Principal principal = mock(Principal.class);
this.request.setUserPrincipal(principal);
Authentication authentication = mock(Authentication.class);
Set<SimpleGrantedAuthority> authorities = Collections.singleton(new SimpleGrantedAuthority("SUPER_HERO"));
Set<SimpleGrantedAuthority> authorities = Collections
.singleton(new SimpleGrantedAuthority("SUPER_HERO"));
doReturn(authorities).when(authentication).getAuthorities();
SecurityContextHolder.getContext().setAuthentication(authentication);
assertThat(this.securityInterceptor.preHandle(this.request, this.response,
@@ -142,11 +144,13 @@ public class MvcEndpointSecurityInterceptorTests {
}
@Test
public void sensitiveEndpointIfRoleAndAuthoritiesNotCorrectShouldNotAllowAccess() throws Exception {
public void sensitiveEndpointIfRoleAndAuthoritiesNotCorrectShouldNotAllowAccess()
throws Exception {
Principal principal = mock(Principal.class);
this.request.setUserPrincipal(principal);
Authentication authentication = mock(Authentication.class);
Set<SimpleGrantedAuthority> authorities = Collections.singleton(new SimpleGrantedAuthority("HERO"));
Set<SimpleGrantedAuthority> authorities = Collections
.singleton(new SimpleGrantedAuthority("HERO"));
doReturn(authorities).when(authentication).getAuthorities();
SecurityContextHolder.getContext().setAuthentication(authentication);
assertThat(this.securityInterceptor.preHandle(this.request, this.response,

9
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/NoSpringSecurityMvcEndpointSecurityInterceptorTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2016 the original author or authors.
* Copyright 2012-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -39,6 +39,8 @@ import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
/**
* Tests for {@link MvcEndpointSecurityInterceptor} when Spring Security is not available.
*
* @author Madhura Bhave
*/
@RunWith(ModifiedClassPathRunner.class)
@@ -77,7 +79,8 @@ public class NoSpringSecurityMvcEndpointSecurityInterceptorTests {
}
@Test
public void sensitiveEndpointIfRoleNotPresentShouldNotValidateAuthorities() throws Exception {
public void sensitiveEndpointIfRoleNotPresentShouldNotValidateAuthorities()
throws Exception {
Principal principal = mock(Principal.class);
this.request.setUserPrincipal(principal);
this.servletContext.declareRoles("HERO");
@@ -105,5 +108,5 @@ public class NoSpringSecurityMvcEndpointSecurityInterceptorTests {
}
}
}
}