Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1744: Do not trust authorities contained in the authentication request in JaasAuthenticationProvider.

Browse Source
This commit is contained in:
Luke Taylor
2011-07-04 11:22:24 +01:00
parent c618f4ab52
commit 59a07175a6
2 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/src/test/java/org/springframework/security/authentication/jaas/JaasAuthenticationProviderTests.java
View File

@@ -180,9 +180,8 @@ public class JaasAuthenticationProviderTests {
@Test
public void testFull() throws Exception {
List<GrantedAuthority> defaultAuths = AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO");
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("user", "password",
defaultAuths);
AuthorityUtils.createAuthorityList("ROLE_ONE"));
assertTrue(jaasProvider.supports(UsernamePasswordAuthenticationToken.class));
@@ -196,8 +195,7 @@ public class JaasAuthenticationProviderTests {
Collection<? extends GrantedAuthority> list = auth.getAuthorities();
Set<String> set = AuthorityUtils.authorityListToSet(list);
assertTrue("GrantedAuthorities should contain ROLE_1", set.contains("ROLE_ONE"));
assertTrue("GrantedAuthorities should contain ROLE_2", set.contains("ROLE_TWO"));
assertFalse("GrantedAuthorities should not contain ROLE_1", set.contains("ROLE_ONE"));
assertTrue("GrantedAuthorities should contain ROLE_TEST1", set.contains("ROLE_TEST1"));
assertTrue("GrantedAuthorities should contain ROLE_TEST2", set.contains("ROLE_TEST2"));