Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix UsernamePasswordAuthenticationTokenMixin to handle null credentials/details

Browse Source 
Fixes gh-4773
This commit is contained in:
Greg Turnquist
2017-10-31 09:57:45 -05:00
committed by Rob Winch
parent 6cbf71bd72
commit 3b4df40f47
2 changed files with 34 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
core/src/main/java/org/springframework/security/jackson2/UsernamePasswordAuthenticationTokenDeserializer.java
View File

@@ -16,6 +16,9 @@
package org.springframework.security.jackson2;
import java.io.IOException;
import java.util.List;
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.core.type.TypeReference;
@@ -24,12 +27,10 @@ import com.fasterxml.jackson.databind.JsonDeserializer;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.node.MissingNode;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import java.io.IOException;
import java.util.List;
/**
* Custom deserializer for {@link UsernamePasswordAuthenticationToken}. At the time of deserialization
* it will invoke suitable constructor depending on the value of <b>authenticated</b> property.
@@ -39,6 +40,7 @@ import java.util.List;
* you can also registered it with your own mixin class.
*
* @author Jitendra Singh
* @author Greg Turnquist
* @see UsernamePasswordAuthenticationTokenMixin
* @since 4.2
*/
@@ -65,7 +67,13 @@ class UsernamePasswordAuthenticationTokenDeserializer extends JsonDeserializer<U
} else {
principal = principalNode.asText();
}
Object credentials = readJsonNode(jsonNode, "credentials").asText();
JsonNode credentialsNode = readJsonNode(jsonNode, "credentials");
Object credentials;
if (credentialsNode.isNull()) {
credentials = null;
} else {
credentials = credentialsNode.asText();
}
List<GrantedAuthority> authorities = mapper.readValue(
readJsonNode(jsonNode, "authorities").traverse(mapper), new TypeReference<List<GrantedAuthority>>() {
});
@@ -74,7 +82,12 @@ class UsernamePasswordAuthenticationTokenDeserializer extends JsonDeserializer<U
} else {
token = new UsernamePasswordAuthenticationToken(principal, credentials);
}
token.setDetails(readJsonNode(jsonNode, "details"));
JsonNode detailsNode = readJsonNode(jsonNode, "details");
if (detailsNode.isNull()) {
token.setDetails(null);
} else {
token.setDetails(detailsNode);
}
return token;
}