Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-3020: SecurityContextHolderAwareRequestWrapper conditional rolePrefix

Browse Source 
Previously SecurityContextHolderAwareRequestWrapper always prefixed with
rolePrefix. This meant the defaults would never return true for a role
that started with the prefix (i.e. ROLE_).

We no longer apply the rolePrefix if the value passed in already starts
with rolePrefix.
This commit is contained in:
Rob Winch
2015-07-16 14:33:33 -05:00
parent 2d448658cd
commit 76a2fb9488
2 changed files with 30 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
web/src/test/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapperTests.java
View File

@@ -114,4 +114,33 @@ public class SecurityContextHolderAwareRequestWrapperTests extends TestCase {
assertFalse(wrapper.isUserInRole("ROLE_FOOBAR")); // principal is null, so reject
assertNull(wrapper.getUserPrincipal());
}
public void testRolePrefix() {
Authentication auth = new TestingAuthenticationToken("user", "koala", "ROLE_HELLO",
"ROLE_FOOBAR");
SecurityContextHolder.getContext().setAuthentication(auth);
MockHttpServletRequest request = new MockHttpServletRequest();
SecurityContextHolderAwareRequestWrapper wrapper = new SecurityContextHolderAwareRequestWrapper(
request, "ROLE_");
assertTrue(wrapper.isUserInRole("HELLO"));
assertTrue(wrapper.isUserInRole("FOOBAR"));
}
// SEC-3020
public void testRolePrefixNotAppliedIfRoleStartsWith() {
Authentication auth = new TestingAuthenticationToken("user", "koala", "ROLE_HELLO",
"ROLE_FOOBAR");
SecurityContextHolder.getContext().setAuthentication(auth);
MockHttpServletRequest request = new MockHttpServletRequest();
SecurityContextHolderAwareRequestWrapper wrapper = new SecurityContextHolderAwareRequestWrapper(
request, "ROLE_");
assertTrue(wrapper.isUserInRole("ROLE_HELLO"));
assertTrue(wrapper.isUserInRole("ROLE_FOOBAR"));
}
}