Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1639: FirewalledRequest is now called on the specific FirewalledRequest instance rather that looping through ServletRequestWrappers.

Browse Source 
VirtualFilterChain now accepts the FirewalledRequest in the constructor. The reset method is called directly on the instance passed in instead of looping through the ServletRequestWrappers.
This commit is contained in:
Rob Winch
2010-12-16 21:57:26 -06:00
parent 46f83c8a08
commit 7c04fdbc90
2 changed files with 34 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
web/src/test/java/org/springframework/security/web/FilterChainProxyTests.java
View File

@@ -22,6 +22,7 @@ import java.util.*;
/**
* @author Luke Taylor
* @author Rob Winch
*/
@SuppressWarnings({"unchecked"})
public class FilterChainProxyTests {
@@ -126,4 +127,30 @@ public class FilterChainProxyTests {
fcp.doFilter(request, response, chain);
verify(fwr).reset();
}
}
// SEC-1639
@Test
public void bothWrappersAreResetWithNestedFcps() throws Exception {
HttpFirewall fw = mock(HttpFirewall.class);
FilterChainProxy firstFcp = new FilterChainProxy();
LinkedHashMap fcm = new LinkedHashMap();
fcm.put(matcher, Arrays.asList(fcp));
firstFcp.setFilterChainMap(fcm);
firstFcp.setFirewall(fw);
fcp.setFirewall(fw);
FirewalledRequest firstFwr = mock(FirewalledRequest.class, "firstFwr");
when(firstFwr.getRequestURI()).thenReturn("/");
when(firstFwr.getContextPath()).thenReturn("");
FirewalledRequest fwr = mock(FirewalledRequest.class, "fwr");
when(fwr.getRequestURI()).thenReturn("/");
when(fwr.getContextPath()).thenReturn("");
when(fw.getFirewalledRequest(request)).thenReturn(firstFwr);
when(fw.getFirewalledRequest(firstFwr)).thenReturn(fwr);
when(fwr.getRequest()).thenReturn(firstFwr);
when(firstFwr.getRequest()).thenReturn(request);
when(matcher.matches(any(HttpServletRequest.class))).thenReturn(true);
firstFcp.doFilter(request, response, chain);
verify(firstFwr).reset();
verify(fwr).reset();
}
}