SEC-2781: Remove deprecations

2014-12-03 13:34:15 -06:00
parent 5bb0ce9a8f
commit 6e204fff72
177 changed files with 536 additions and 5022 deletions
--- a/config/src/test/groovy/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.groovy
@@ -326,10 +326,6 @@ public class NamespaceHttpTests extends BaseSpringSpec {
        }
    }

-    // http@path-type is not available (instead request matcher instances are used)
-
-    // http@pattern is not available (instead see the tests http@request-matcher-ref ant or http@request-matcher-ref regex)
-
    def "http@realm"() {
        setup:
            loadConfig(RealmConfig)
--- a/config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.groovy
@@ -38,7 +38,6 @@ import org.springframework.security.web.SecurityFilterChain
 import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator
 import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator
 import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler
-import org.springframework.security.web.access.expression.WebSecurityExpressionHandler
 import org.springframework.security.web.util.matcher.AnyRequestMatcher
 import org.springframework.test.util.ReflectionTestUtils

@@ -200,21 +199,20 @@ class WebSecurityConfigurationTests extends BaseSpringSpec {

    def "Override webSecurityExpressionHandler"() {
        setup:
-            WebSecurityExpressionHandler expressionHandler = Mock()
+            SecurityExpressionHandler expressionHandler = Mock()
            ExpressionParser parser = Mock()
            WebSecurityExpressionHandlerConfig.EH = expressionHandler
        when:
            loadConfig(WebSecurityExpressionHandlerConfig)
        then:
-            context.getBean(WebSecurityExpressionHandler) == expressionHandler
+            context.getBean(SecurityExpressionHandler) == expressionHandler
            1 * expressionHandler.getExpressionParser() >> parser
    }

    @EnableWebSecurity
    @Configuration
    static class WebSecurityExpressionHandlerConfig extends WebSecurityConfigurerAdapter {
-        @SuppressWarnings("deprecation")
-        static WebSecurityExpressionHandler EH
+        static SecurityExpressionHandler EH

        @Override
        public void configure(WebSecurity web) throws Exception {
@@ -234,7 +232,7 @@ class WebSecurityConfigurationTests extends BaseSpringSpec {
        when:
            loadConfig(WebSecurityExpressionHandlerDefaultsConfig)
        then:
-            WebSecurityExpressionHandler wseh = context.getBean(WebSecurityExpressionHandler)
+            SecurityExpressionHandler wseh = context.getBean(SecurityExpressionHandler)
            wseh instanceof DefaultWebSecurityExpressionHandler
    }

--- a/config/src/test/groovy/org/springframework/security/config/http/AccessDeniedConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/AccessDeniedConfigTests.groovy
@@ -10,20 +10,11 @@ import org.springframework.security.web.access.ExceptionTranslationFilter
 * @author Luke Taylor
 */
 class AccessDeniedConfigTests extends AbstractHttpConfigTests {
-    private static final String ACCESS_DENIED_PAGE = 'access-denied-page';
-
-    def accessDeniedPageAttributeIsSupported() {
-        httpAccessDeniedPage ('/accessDenied') { }
-        createAppContext();
-
-        expect:
-        getFilter(ExceptionTranslationFilter.class).accessDeniedHandler.errorPage == '/accessDenied'
-
-    }
-
    def invalidAccessDeniedUrlIsDetected() {
        when:
-        httpAccessDeniedPage ('noLeadingSlash') { }
+        httpAutoConfig() {
+            'access-denied-handler'('error-page':'noLeadingSlash')
+        }
        createAppContext();
        then:
        thrown(BeanCreationException)
@@ -43,16 +34,6 @@ class AccessDeniedConfigTests extends AbstractHttpConfigTests {
        filter.accessDeniedHandler == adh
    }

-    def void accessDeniedPageAndAccessDeniedHandlerAreMutuallyExclusive() {
-        when:
-        httpAccessDeniedPage ('/accessDenied') {
-            'access-denied-handler'('error-page': '/go-away')
-        }
-        createAppContext();
-        then:
-        thrown(BeanDefinitionParsingException)
-    }
-
    def void accessDeniedHandlerPageAndRefAreMutuallyExclusive() {
        when:
        httpAutoConfig {
@@ -63,8 +44,4 @@ class AccessDeniedConfigTests extends AbstractHttpConfigTests {
        then:
        thrown(BeanDefinitionParsingException)
    }
-
-    def httpAccessDeniedPage(String page, Closure c) {
-        xml.http(['auto-config': 'true', 'access-denied-page': page], c)
-    }
 }
--- a/config/src/test/groovy/org/springframework/security/config/http/CsrfConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/CsrfConfigTests.groovy
@@ -156,7 +156,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
        when: "authenticate successfully"
            response = new MockHttpServletResponse()
            request = new MockHttpServletRequest(session: request.session)
-            request.requestURI = "/j_spring_security_check"
+            request.servletPath = "/j_spring_security_check"
            request.setParameter(token.parameterName,token.token)
            request.setParameter("j_username","user")
            request.setParameter("j_password","password")
@@ -190,7 +190,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
        when: "authenticate successfully"
            response = new MockHttpServletResponse()
            request = new MockHttpServletRequest(session: request.session)
-            request.requestURI = "/j_spring_security_check"
+            request.servletPath = "/j_spring_security_check"
            request.setParameter(token.parameterName,token.token)
            request.setParameter("j_username","user")
            request.setParameter("j_password","password")
@@ -281,7 +281,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
            request.method = "POST"
            request.setParameter("j_username","user")
            request.setParameter("j_password","password")
-            request.requestURI = "/j_spring_security_check"
+            request.servletPath = "/j_spring_security_check"
        when:
            springSecurityFilterChain.doFilter(request,response,chain)
        then:
--- a/config/src/test/groovy/org/springframework/security/config/http/FormLoginConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/FormLoginConfigTests.groovy
@@ -104,18 +104,4 @@ class FormLoginConfigTests extends AbstractHttpConfigTests {
        apf.usernameParameter == 'xname';
        apf.passwordParameter == 'xpass'
    }
-
-    def 'SEC-2455: http@login-processing-url'() {
-        when:
-            xml.http {
-                'form-login'('login-processing-url':'/authenticate')
-            }
-            createAppContext()
-
-            def apf = getFilter(UsernamePasswordAuthenticationFilter);
-
-        then:
-            apf.filterProcessesUrl == null // SEC-2455 setFilterProcessesUrl was not invoked
-            FieldUtils.getFieldValue(apf,'requiresAuthenticationRequestMatcher.filterProcessesUrl') == '/authenticate'
-    }
 }
--- a/config/src/test/groovy/org/springframework/security/config/http/HttpOpenIDConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/HttpOpenIDConfigTests.groovy
@@ -116,7 +116,7 @@ class OpenIDConfigTests extends AbstractHttpConfigTests {
        then: "Remember-me choice is added to page"
        response.getContentAsString().contains(AbstractRememberMeServices.DEFAULT_PARAMETER)
        when: "Login is submitted with remember-me selected"
-        request.setRequestURI("/j_spring_openid_security_check")
+        request.servletPath = "/j_spring_openid_security_check"
        request.setParameter(OpenIDAuthenticationFilter.DEFAULT_CLAIMED_IDENTITY_FIELD, "http://hey.openid.com/")
        request.setParameter(AbstractRememberMeServices.DEFAULT_PARAMETER, "on")
        response = new MockHttpServletResponse();
--- a/config/src/test/groovy/org/springframework/security/config/http/InterceptUrlConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/InterceptUrlConfigTests.groovy
@@ -13,8 +13,9 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-package org.springframework.security.config.http;
+package org.springframework.security.config.http

+import org.springframework.security.crypto.codec.Base64;

 import java.security.Principal

@@ -125,4 +126,39 @@ class InterceptUrlConfigTests extends AbstractHttpConfigTests {
        then: 'The response is unauthorized'
            response.status == HttpServletResponse.SC_UNAUTHORIZED
   }
+
+    def "intercept-url supports hasAnyRoles"() {
+        setup:
+            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET')
+            MockHttpServletResponse response = new MockHttpServletResponse()
+            MockFilterChain chain = new MockFilterChain()
+            xml.http('use-expressions':true) {
+                'http-basic'()
+                'intercept-url'(pattern: '/**', access: "hasAnyRole('ROLE_DEVELOPER','ROLE_USER')")
+                csrf(disabled:true)
+            }
+        when:
+            createAppContext()
+        then: 'no error'
+            noExceptionThrown()
+        when: 'ROLE_USER can access'
+            login(request, 'user', 'password')
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: 'The response is OK'
+            response.status == HttpServletResponse.SC_OK
+        when: 'ROLE_A cannot access'
+            request = new MockHttpServletRequest(method:'GET')
+            response = new MockHttpServletResponse()
+            chain = new MockFilterChain()
+            login(request, 'bob', 'bobspassword')
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: 'The response is Forbidden'
+            response.status == HttpServletResponse.SC_FORBIDDEN
+
+    }
+
+    def login(MockHttpServletRequest request, String username, String password) {
+        String toEncode = username + ':' + password
+        request.addHeader('Authorization','Basic ' + new String(Base64.encode(toEncode.getBytes('UTF-8'))))
+    }
 }
--- a/config/src/test/groovy/org/springframework/security/config/http/LogoutConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/LogoutConfigTests.groovy
@@ -1,26 +0,0 @@
-package org.springframework.security.config.http
-
-import org.springframework.security.util.FieldUtils
-import org.springframework.security.web.authentication.logout.LogoutFilter
-
-/**
- *
- * @author Rob Winch
- */
-class LogoutConfigTests extends AbstractHttpConfigTests {
-
-    def 'SEC-2455: logout@logout-url'() {
-        when:
-            httpAutoConfig {
-                'logout'('logout-url':'/logout')
-                csrf(disabled:true)
-            }
-            createAppContext()
-
-            def lf = getFilter(LogoutFilter);
-
-        then:
-            lf.filterProcessesUrl == null // SEC-2455 setFilterProcessesUrl was not invoked
-            FieldUtils.getFieldValue(lf,'logoutRequestMatcher.filterProcessesUrl') == '/logout'
-    }
-}
--- a/config/src/test/groovy/org/springframework/security/config/http/PlaceHolderAndELConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/PlaceHolderAndELConfigTests.groovy
@@ -135,7 +135,9 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {

    def accessDeniedPageWorksWithPlaceholders() {
        System.setProperty("accessDenied", "/go-away");
-        xml.http('auto-config': 'true', 'access-denied-page': '${accessDenied}')
+        xml.http('auto-config': 'true') {
+            'access-denied-handler'('error-page' : '${accessDenied}') {}
+        }
        createAppContext();

        expect:
--- a/config/src/test/groovy/org/springframework/security/config/http/SessionManagementConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/SessionManagementConfigTests.groovy
@@ -285,7 +285,7 @@ class SessionManagementConfigTests extends AbstractHttpConfigTests {

            MockHttpServletRequest request = new MockHttpServletRequest();
            request.getSession();
-            request.setRequestURI("/j_spring_security_check");
+            request.servletPath = "/j_spring_security_check"
            request.setMethod("POST");
            request.setParameter("j_username", "user");
            request.setParameter("j_password", "password");
--- a/config/src/test/java/org/springframework/security/config/authentication/AuthenticationProviderBeanDefinitionParserTests.java
+++ b/config/src/test/java/org/springframework/security/config/authentication/AuthenticationProviderBeanDefinitionParserTests.java
@@ -8,7 +8,6 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.authentication.dao.ReflectionSaltSource;
 import org.springframework.security.authentication.encoding.ShaPasswordEncoder;
 import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.authentication.AuthenticationProviderBeanDefinitionParser;
 import org.springframework.security.config.util.InMemoryXmlApplicationContext;
 import org.springframework.security.util.FieldUtils;
 import org.springframework.beans.factory.parsing.BeanDefinitionParsingException;
@@ -153,8 +152,12 @@ public class AuthenticationProviderBeanDefinitionParserTests {
                "         <b:property name='userPropertyToUse' value='username'/>" +
                "    </b:bean>" +
                "    <b:bean id='customUserService' " +
-                "           class='org.springframework.security.core.userdetails.memory.InMemoryDaoImpl'>" +
-                "        <b:property name='userMap' value='bob=f117f0862384e9497ff4f470e3522606,ROLE_A'/>" +
+                "           class='org.springframework.security.provisioning.InMemoryUserDetailsManager'>" +
+                "        <b:constructor-arg>" +
+                "            <b:props>" +
+                "                <b:prop key='bob'>f117f0862384e9497ff4f470e3522606,ROLE_A</b:prop>" +
+                "            </b:props>" +
+                "        </b:constructor-arg>" +
                "    </b:bean>");
        getProvider().authenticate(bob);
    }
--- a/config/src/test/java/org/springframework/security/config/http/SessionManagementConfigServlet31Tests.java
+++ b/config/src/test/java/org/springframework/security/config/http/SessionManagementConfigServlet31Tests.java
@@ -98,7 +98,7 @@ public class SessionManagementConfigServlet31Tests {
        Method method = mock(Method.class);
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.getSession();
-        request.setRequestURI("/j_spring_security_check");
+        request.setServletPath("/j_spring_security_check");
        request.setMethod("POST");
        request.setParameter("j_username", "user");
        request.setParameter("j_password", "password");
@@ -124,7 +124,7 @@ public class SessionManagementConfigServlet31Tests {
        Method method = mock(Method.class);
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.getSession();
-        request.setRequestURI("/j_spring_security_check");
+        request.setServletPath("/j_spring_security_check");
        request.setMethod("POST");
        request.setParameter("j_username", "user");
        request.setParameter("j_password", "password");
--- a/config/src/test/java/org/springframework/security/intercept/method/aopalliance/MethodSecurityInterceptorWithAopConfigTests.java
+++ b/config/src/test/java/org/springframework/security/intercept/method/aopalliance/MethodSecurityInterceptorWithAopConfigTests.java
@@ -30,9 +30,9 @@ public class MethodSecurityInterceptorWithAopConfigTests {

    static final String ACCESS_MANAGER_XML =
        "<b:bean id='accessDecisionManager' class='org.springframework.security.access.vote.AffirmativeBased'>" +
-        "   <b:property name='decisionVoters'>" +
+        "   <b:constructor-arg>" +
        "       <b:list><b:bean class='org.springframework.security.access.vote.RoleVoter'/></b:list>" +
-        "   </b:property>" +
+        "   </b:constructor-arg>" +
        "</b:bean>";

    static final String TARGET_BEAN_AND_INTERCEPTOR =
--- a/config/src/test/resources/org/springframework/security/util/filtertest-valid.xml
+++ b/config/src/test/resources/org/springframework/security/util/filtertest-valid.xml
@@ -104,7 +104,7 @@
    <bean id="fcv" class="org.springframework.security.config.http.DefaultFilterChainValidator" />

    <bean id="newFilterChainProxyRegex" class="org.springframework.security.web.FilterChainProxy">
-        <sec:filter-chain-map path-type="regex">
+        <sec:filter-chain-map request-matcher="regex">
            <sec:filter-chain pattern="\A/foo/.*\Z" filters="mockFilter"/>
            <sec:filter-chain pattern="\A/s[oO]me/other/path/.*\Z" filters="sif,mockFilter,mockFilter2"/>
            <sec:filter-chain pattern="\A/do/not/filter\Z" filters="none"/>