Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1750: Make sure RunAs replacement is constrained to the SecurityContext of the current thread.

Browse Source
This commit is contained in:
Luke Taylor
2011-07-04 11:03:54 +01:00
parent b48fc53fa2
commit 5fce0a58bd
4 changed files with 34 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
core/src/test/java/org/springframework/security/access/intercept/InterceptorStatusTokenTests.java
View File

@@ -15,8 +15,7 @@
package org.springframework.security.access.intercept;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.*;
import java.util.List;
@@ -24,8 +23,8 @@ import org.aopalliance.intercept.MethodInvocation;
import org.junit.Test;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.util.SimpleMethodInvocation;
@@ -40,12 +39,12 @@ public class InterceptorStatusTokenTests {
public void testOperation() {
List<ConfigAttribute> attr = SecurityConfig.createList("FOO");
MethodInvocation mi = new SimpleMethodInvocation();
InterceptorStatusToken token = new InterceptorStatusToken(new UsernamePasswordAuthenticationToken("rod",
"koala"), true, attr, mi);
SecurityContext ctx = SecurityContextHolder.createEmptyContext();
InterceptorStatusToken token = new InterceptorStatusToken(ctx, true, attr, mi);
assertTrue(token.isContextHolderRefreshRequired());
assertEquals(attr, token.getAttributes());
assertEquals(mi, token.getSecureObject());
assertEquals("rod", token.getAuthentication().getPrincipal());
assertSame(ctx, token.getSecurityContext());
}
}

15
core/src/test/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptorTests.java
View File

@@ -19,12 +19,8 @@ import static org.junit.Assert.*;
import static org.mockito.Matchers.any;
import static org.mockito.Mockito.*;
import java.util.*;
import org.aopalliance.intercept.MethodInvocation;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
import org.junit.*;
import org.springframework.aop.framework.ProxyFactory;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.security.ITargetObject;
@@ -45,8 +41,11 @@ import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import java.util.*;
/**
* Tests {@link MethodSecurityInterceptor}.
*
@@ -251,7 +250,8 @@ public class MethodSecurityInterceptorTests {
@Test
public void runAsReplacementIsCorrectlySet() throws Exception {
SecurityContextHolder.getContext().setAuthentication(token);
SecurityContext ctx = SecurityContextHolder.getContext();
ctx.setAuthentication(token);
token.setAuthenticated(true);
final RunAsManager runAs = mock(RunAsManager.class);
final RunAsUserToken runAsToken =
@@ -263,7 +263,8 @@ public class MethodSecurityInterceptorTests {
String result = advisedTarget.makeUpperCase("hello");
assertEquals("HELLO org.springframework.security.access.intercept.RunAsUserToken true", result);
// Check we've changed back
assertEquals(token, SecurityContextHolder.getContext().getAuthentication());
assertSame(ctx, SecurityContextHolder.getContext());
assertSame(token, SecurityContextHolder.getContext().getAuthentication());
}
@Test(expected=AuthenticationCredentialsNotFoundException.class)