Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Always use 'this.' when accessing fields

Browse Source 
Apply an Eclipse cleanup rules to ensure that fields are always accessed
using `this.`. This aligns with the style used by Spring Framework and
helps users quickly see the difference between a local and member
variable.

Issue gh-8945
This commit is contained in:
Phillip Webb
2020-07-26 11:51:05 -07:00
committed by Rob Winch
parent 6894ff5d12
commit 8866fa6fb0
793 changed files with 8689 additions and 8459 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java
View File

@@ -162,7 +162,7 @@ public abstract class AbstractAuthorizeTag {
}
public String getAccess() {
return access;
return this.access;
}
public void setAccess(String access) {
@@ -170,7 +170,7 @@ public abstract class AbstractAuthorizeTag {
}
public String getUrl() {
return url;
return this.url;
}
public void setUrl(String url) {
@@ -178,7 +178,7 @@ public abstract class AbstractAuthorizeTag {
}
public String getMethod() {
return method;
return this.method;
}
public void setMethod(String method) {

30
taglibs/src/main/java/org/springframework/security/taglibs/authz/AccessControlListTag.java
View File

@@ -67,13 +67,13 @@ public class AccessControlListTag extends TagSupport {
private String var;
public int doStartTag() throws JspException {
if ((null == hasPermission) || "".equals(hasPermission)) {
if ((null == this.hasPermission) || "".equals(this.hasPermission)) {
return skipBody();
}
initializeIfRequired();
if (domainObject == null) {
if (this.domainObject == null) {
if (logger.isDebugEnabled()) {
logger.debug("domainObject resolved to null, so including tag body");
}
@@ -92,9 +92,9 @@ public class AccessControlListTag extends TagSupport {
return skipBody();
}
List<Object> requiredPermissions = parseHasPermission(hasPermission);
List<Object> requiredPermissions = parseHasPermission(this.hasPermission);
for (Object requiredPermission : requiredPermissions) {
if (!permissionEvaluator.hasPermission(authentication, domainObject, requiredPermission)) {
if (!this.permissionEvaluator.hasPermission(authentication, this.domainObject, requiredPermission)) {
return skipBody();
}
}
@@ -118,15 +118,15 @@ public class AccessControlListTag extends TagSupport {
}
private int skipBody() {
if (var != null) {
pageContext.setAttribute(var, Boolean.FALSE, PageContext.PAGE_SCOPE);
if (this.var != null) {
this.pageContext.setAttribute(this.var, Boolean.FALSE, PageContext.PAGE_SCOPE);
}
return TagLibConfig.evalOrSkip(false);
}
private int evalBody() {
if (var != null) {
pageContext.setAttribute(var, Boolean.TRUE, PageContext.PAGE_SCOPE);
if (this.var != null) {
this.pageContext.setAttribute(this.var, Boolean.TRUE, PageContext.PAGE_SCOPE);
}
return TagLibConfig.evalOrSkip(true);
}
@@ -144,27 +144,27 @@ public class AccessControlListTag extends TagSupport {
}
public Object getDomainObject() {
return domainObject;
return this.domainObject;
}
public String getHasPermission() {
return hasPermission;
return this.hasPermission;
}
private void initializeIfRequired() throws JspException {
if (applicationContext != null) {
if (this.applicationContext != null) {
return;
}
this.applicationContext = getContext(pageContext);
this.applicationContext = getContext(this.pageContext);
permissionEvaluator = getBeanOfType(PermissionEvaluator.class);
this.permissionEvaluator = getBeanOfType(PermissionEvaluator.class);
}
private <T> T getBeanOfType(Class<T> type) throws JspException {
Map<String, T> map = applicationContext.getBeansOfType(type);
Map<String, T> map = this.applicationContext.getBeansOfType(type);
for (ApplicationContext context = applicationContext.getParent(); context != null; context = context
for (ApplicationContext context = this.applicationContext.getParent(); context != null; context = context
.getParent()) {
map.putAll(context.getBeansOfType(type));
}

26
taglibs/src/main/java/org/springframework/security/taglibs/authz/AuthenticationTag.java
View File

@@ -58,9 +58,9 @@ public class AuthenticationTag extends TagSupport {
// resets local state
private void init() {
var = null;
scopeSpecified = false;
scope = PageContext.PAGE_SCOPE;
this.var = null;
this.scopeSpecified = false;
this.scope = PageContext.PAGE_SCOPE;
}
public void setVar(String var) {
@@ -83,7 +83,7 @@ public class AuthenticationTag extends TagSupport {
public int doEndTag() throws JspException {
Object result = null;
// determine the value by...
if (property != null) {
if (this.property != null) {
if ((SecurityContextHolder.getContext() == null)
|| !(SecurityContextHolder.getContext() instanceof SecurityContext)
|| (SecurityContextHolder.getContext().getAuthentication() == null)) {
@@ -98,33 +98,33 @@ public class AuthenticationTag extends TagSupport {
try {
BeanWrapperImpl wrapper = new BeanWrapperImpl(auth);
result = wrapper.getPropertyValue(property);
result = wrapper.getPropertyValue(this.property);
}
catch (BeansException e) {
throw new JspException(e);
}
}
if (var != null) {
if (this.var != null) {
/*
* Store the result, letting an IllegalArgumentException propagate back if the
* scope is invalid (e.g., if an attempt is made to store something in the
* session without any HttpSession existing).
*/
if (result != null) {
pageContext.setAttribute(var, result, scope);
this.pageContext.setAttribute(this.var, result, this.scope);
}
else {
if (scopeSpecified) {
pageContext.removeAttribute(var, scope);
if (this.scopeSpecified) {
this.pageContext.removeAttribute(this.var, this.scope);
}
else {
pageContext.removeAttribute(var);
this.pageContext.removeAttribute(this.var);
}
}
}
else {
if (htmlEscape) {
if (this.htmlEscape) {
writeMessage(TextEscapeUtils.escapeEntities(String.valueOf(result)));
}
else {
@@ -136,7 +136,7 @@ public class AuthenticationTag extends TagSupport {
protected void writeMessage(String msg) throws JspException {
try {
pageContext.getOut().write(String.valueOf(msg));
this.pageContext.getOut().write(String.valueOf(msg));
}
catch (IOException ioe) {
throw new JspException(ioe);
@@ -155,7 +155,7 @@ public class AuthenticationTag extends TagSupport {
* overridden.
*/
protected boolean isHtmlEscape() {
return htmlEscape;
return this.htmlEscape;
}
}

56
taglibs/src/main/java/org/springframework/security/taglibs/authz/JspAuthorizeTag.java
View File

@@ -65,17 +65,17 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
*/
public int doStartTag() throws JspException {
try {
authorized = super.authorize();
this.authorized = super.authorize();
if (!authorized && TagLibConfig.isUiSecurityDisabled()) {
pageContext.getOut().write(TagLibConfig.getSecuredUiPrefix());
if (!this.authorized && TagLibConfig.isUiSecurityDisabled()) {
this.pageContext.getOut().write(TagLibConfig.getSecuredUiPrefix());
}
if (var != null) {
pageContext.setAttribute(var, authorized, PageContext.PAGE_SCOPE);
if (this.var != null) {
this.pageContext.setAttribute(this.var, this.authorized, PageContext.PAGE_SCOPE);
}
return TagLibConfig.evalOrSkip(authorized);
return TagLibConfig.evalOrSkip(this.authorized);
}
catch (IOException e) {
@@ -95,8 +95,8 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
*/
public int doEndTag() throws JspException {
try {
if (!authorized && TagLibConfig.isUiSecurityDisabled()) {
pageContext.getOut().write(TagLibConfig.getSecuredUiSuffix());
if (!this.authorized && TagLibConfig.isUiSecurityDisabled()) {
this.pageContext.getOut().write(TagLibConfig.getSecuredUiSuffix());
}
}
catch (IOException e) {
@@ -107,7 +107,7 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
}
public String getId() {
return id;
return this.id;
}
public void setId(String id) {
@@ -115,7 +115,7 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
}
public Tag getParent() {
return parent;
return this.parent;
}
public void setParent(Tag parent) {
@@ -123,7 +123,7 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
}
public String getVar() {
return var;
return this.var;
}
public void setVar(String var) {
@@ -131,8 +131,8 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
}
public void release() {
parent = null;
id = null;
this.parent = null;
this.id = null;
}
public void setPageContext(PageContext pageContext) {
@@ -141,17 +141,17 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
@Override
protected ServletRequest getRequest() {
return pageContext.getRequest();
return this.pageContext.getRequest();
}
@Override
protected ServletResponse getResponse() {
return pageContext.getResponse();
return this.pageContext.getResponse();
}
@Override
protected ServletContext getServletContext() {
return pageContext.getServletContext();
return this.pageContext.getServletContext();
}
private final class PageContextVariableLookupEvaluationContext implements EvaluationContext {
@@ -163,50 +163,50 @@ public class JspAuthorizeTag extends AbstractAuthorizeTag implements Tag {
}
public TypedValue getRootObject() {
return delegate.getRootObject();
return this.delegate.getRootObject();
}
public List<ConstructorResolver> getConstructorResolvers() {
return delegate.getConstructorResolvers();
return this.delegate.getConstructorResolvers();
}
public List<MethodResolver> getMethodResolvers() {
return delegate.getMethodResolvers();
return this.delegate.getMethodResolvers();
}
public List<PropertyAccessor> getPropertyAccessors() {
return delegate.getPropertyAccessors();
return this.delegate.getPropertyAccessors();
}
public TypeLocator getTypeLocator() {
return delegate.getTypeLocator();
return this.delegate.getTypeLocator();
}
public TypeConverter getTypeConverter() {
return delegate.getTypeConverter();
return this.delegate.getTypeConverter();
}
public TypeComparator getTypeComparator() {
return delegate.getTypeComparator();
return this.delegate.getTypeComparator();
}
public OperatorOverloader getOperatorOverloader() {
return delegate.getOperatorOverloader();
return this.delegate.getOperatorOverloader();
}
public BeanResolver getBeanResolver() {
return delegate.getBeanResolver();
return this.delegate.getBeanResolver();
}
public void setVariable(String name, Object value) {
delegate.setVariable(name, value);
this.delegate.setVariable(name, value);
}
public Object lookupVariable(String name) {
Object result = delegate.lookupVariable(name);
Object result = this.delegate.lookupVariable(name);
if (result == null) {
result = pageContext.findAttribute(name);
result = JspAuthorizeTag.this.pageContext.findAttribute(name);
}
return result;
}

32
taglibs/src/test/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTagTests.java
View File

@@ -60,10 +60,10 @@ public class AbstractAuthorizeTagTests {
@Before
public void setup() {
tag = new AuthzTag();
request = new MockHttpServletRequest();
response = new MockHttpServletResponse();
servletContext = new MockServletContext();
this.tag = new AuthzTag();
this.request = new MockHttpServletRequest();
this.response = new MockHttpServletResponse();
this.servletContext = new MockServletContext();
}
@After
@@ -75,10 +75,10 @@ public class AbstractAuthorizeTagTests {
public void privilegeEvaluatorFromRequest() throws IOException {
String uri = "/something";
WebInvocationPrivilegeEvaluator expected = mock(WebInvocationPrivilegeEvaluator.class);
tag.setUrl(uri);
request.setAttribute(WebAttributes.WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE, expected);
this.tag.setUrl(uri);
this.request.setAttribute(WebAttributes.WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE, expected);
tag.authorizeUsingUrlCheck();
this.tag.authorizeUsingUrlCheck();
verify(expected).isAllowed(eq(""), eq(uri), eq("GET"), any());
}
@@ -87,13 +87,13 @@ public class AbstractAuthorizeTagTests {
public void privilegeEvaluatorFromChildContext() throws IOException {
String uri = "/something";
WebInvocationPrivilegeEvaluator expected = mock(WebInvocationPrivilegeEvaluator.class);
tag.setUrl(uri);
this.tag.setUrl(uri);
WebApplicationContext wac = mock(WebApplicationContext.class);
when(wac.getBeansOfType(WebInvocationPrivilegeEvaluator.class))
.thenReturn(Collections.singletonMap("wipe", expected));
servletContext.setAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher", wac);
this.servletContext.setAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher", wac);
tag.authorizeUsingUrlCheck();
this.tag.authorizeUsingUrlCheck();
verify(expected).isAllowed(eq(""), eq(uri), eq("GET"), any());
}
@@ -103,30 +103,30 @@ public class AbstractAuthorizeTagTests {
public void expressionFromChildContext() throws IOException {
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "pass", "USER"));
DefaultWebSecurityExpressionHandler expected = new DefaultWebSecurityExpressionHandler();
tag.setAccess("permitAll");
this.tag.setAccess("permitAll");
WebApplicationContext wac = mock(WebApplicationContext.class);
when(wac.getBeansOfType(SecurityExpressionHandler.class))
.thenReturn(Collections.<String, SecurityExpressionHandler>singletonMap("wipe", expected));
servletContext.setAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher", wac);
this.servletContext.setAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher", wac);
assertThat(tag.authorize()).isTrue();
assertThat(this.tag.authorize()).isTrue();
}
private class AuthzTag extends AbstractAuthorizeTag {
@Override
protected ServletRequest getRequest() {
return request;
return AbstractAuthorizeTagTests.this.request;
}
@Override
protected ServletResponse getResponse() {
return response;
return AbstractAuthorizeTagTests.this.response;
}
@Override
protected ServletContext getServletContext() {
return servletContext;
return AbstractAuthorizeTagTests.this.servletContext;
}
}

130
taglibs/src/test/java/org/springframework/security/taglibs/authz/AccessControlListTagTests.java
View File

@@ -60,20 +60,20 @@ public class AccessControlListTagTests {
@Before
@SuppressWarnings("rawtypes")
public void setup() {
SecurityContextHolder.getContext().setAuthentication(bob);
tag = new AccessControlListTag();
SecurityContextHolder.getContext().setAuthentication(this.bob);
this.tag = new AccessControlListTag();
WebApplicationContext ctx = mock(WebApplicationContext.class);
pe = mock(PermissionEvaluator.class);
this.pe = mock(PermissionEvaluator.class);
Map beanMap = new HashMap();
beanMap.put("pe", pe);
beanMap.put("pe", this.pe);
when(ctx.getBeansOfType(PermissionEvaluator.class)).thenReturn(beanMap);
MockServletContext servletCtx = new MockServletContext();
servletCtx.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, ctx);
pageContext = new MockPageContext(servletCtx, new MockHttpServletRequest(), new MockHttpServletResponse());
tag.setPageContext(pageContext);
this.pageContext = new MockPageContext(servletCtx, new MockHttpServletRequest(), new MockHttpServletResponse());
this.tag.setPageContext(this.pageContext);
}
@After
@@ -84,109 +84,109 @@ public class AccessControlListTagTests {
@Test
public void bodyIsEvaluatedIfAclGrantsAccess() throws Exception {
Object domainObject = new Object();
when(pe.hasPermission(bob, domainObject, "READ")).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, "READ")).thenReturn(true);
tag.setDomainObject(domainObject);
tag.setHasPermission("READ");
tag.setVar("allowed");
assertThat(tag.getDomainObject()).isSameAs(domainObject);
assertThat(tag.getHasPermission()).isEqualTo("READ");
this.tag.setDomainObject(domainObject);
this.tag.setHasPermission("READ");
this.tag.setVar("allowed");
assertThat(this.tag.getDomainObject()).isSameAs(domainObject);
assertThat(this.tag.getHasPermission()).isEqualTo("READ");
assertThat(tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) pageContext.getAttribute("allowed")).isTrue();
assertThat(this.tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) this.pageContext.getAttribute("allowed")).isTrue();
}
@Test
public void childContext() throws Exception {
ServletContext servletContext = pageContext.getServletContext();
ServletContext servletContext = this.pageContext.getServletContext();
WebApplicationContext wac = (WebApplicationContext) servletContext
.getAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE);
servletContext.removeAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE);
servletContext.setAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher", wac);
Object domainObject = new Object();
when(pe.hasPermission(bob, domainObject, "READ")).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, "READ")).thenReturn(true);
tag.setDomainObject(domainObject);
tag.setHasPermission("READ");
tag.setVar("allowed");
assertThat(tag.getDomainObject()).isSameAs(domainObject);
assertThat(tag.getHasPermission()).isEqualTo("READ");
this.tag.setDomainObject(domainObject);
this.tag.setHasPermission("READ");
this.tag.setVar("allowed");
assertThat(this.tag.getDomainObject()).isSameAs(domainObject);
assertThat(this.tag.getHasPermission()).isEqualTo("READ");
assertThat(tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) pageContext.getAttribute("allowed")).isTrue();
assertThat(this.tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) this.pageContext.getAttribute("allowed")).isTrue();
}
// SEC-2022
@Test
public void multiHasPermissionsAreSplit() throws Exception {
Object domainObject = new Object();
when(pe.hasPermission(bob, domainObject, "READ")).thenReturn(true);
when(pe.hasPermission(bob, domainObject, "WRITE")).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, "READ")).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, "WRITE")).thenReturn(true);
tag.setDomainObject(domainObject);
tag.setHasPermission("READ,WRITE");
tag.setVar("allowed");
assertThat(tag.getDomainObject()).isSameAs(domainObject);
assertThat(tag.getHasPermission()).isEqualTo("READ,WRITE");
this.tag.setDomainObject(domainObject);
this.tag.setHasPermission("READ,WRITE");
this.tag.setVar("allowed");
assertThat(this.tag.getDomainObject()).isSameAs(domainObject);
assertThat(this.tag.getHasPermission()).isEqualTo("READ,WRITE");
assertThat(tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) pageContext.getAttribute("allowed")).isTrue();
verify(pe).hasPermission(bob, domainObject, "READ");
verify(pe).hasPermission(bob, domainObject, "WRITE");
verifyNoMoreInteractions(pe);
assertThat(this.tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) this.pageContext.getAttribute("allowed")).isTrue();
verify(this.pe).hasPermission(this.bob, domainObject, "READ");
verify(this.pe).hasPermission(this.bob, domainObject, "WRITE");
verifyNoMoreInteractions(this.pe);
}
// SEC-2023
@Test
public void hasPermissionsBitMaskSupported() throws Exception {
Object domainObject = new Object();
when(pe.hasPermission(bob, domainObject, 1)).thenReturn(true);
when(pe.hasPermission(bob, domainObject, 2)).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, 1)).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, 2)).thenReturn(true);
tag.setDomainObject(domainObject);
tag.setHasPermission("1,2");
tag.setVar("allowed");
assertThat(tag.getDomainObject()).isSameAs(domainObject);
assertThat(tag.getHasPermission()).isEqualTo("1,2");
this.tag.setDomainObject(domainObject);
this.tag.setHasPermission("1,2");
this.tag.setVar("allowed");
assertThat(this.tag.getDomainObject()).isSameAs(domainObject);
assertThat(this.tag.getHasPermission()).isEqualTo("1,2");
assertThat(tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) pageContext.getAttribute("allowed")).isTrue();
verify(pe).hasPermission(bob, domainObject, 1);
verify(pe).hasPermission(bob, domainObject, 2);
verifyNoMoreInteractions(pe);
assertThat(this.tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) this.pageContext.getAttribute("allowed")).isTrue();
verify(this.pe).hasPermission(this.bob, domainObject, 1);
verify(this.pe).hasPermission(this.bob, domainObject, 2);
verifyNoMoreInteractions(this.pe);
}
@Test
public void hasPermissionsMixedBitMaskSupported() throws Exception {
Object domainObject = new Object();
when(pe.hasPermission(bob, domainObject, 1)).thenReturn(true);
when(pe.hasPermission(bob, domainObject, "WRITE")).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, 1)).thenReturn(true);
when(this.pe.hasPermission(this.bob, domainObject, "WRITE")).thenReturn(true);
tag.setDomainObject(domainObject);
tag.setHasPermission("1,WRITE");
tag.setVar("allowed");
assertThat(tag.getDomainObject()).isSameAs(domainObject);
assertThat(tag.getHasPermission()).isEqualTo("1,WRITE");
this.tag.setDomainObject(domainObject);
this.tag.setHasPermission("1,WRITE");
this.tag.setVar("allowed");
assertThat(this.tag.getDomainObject()).isSameAs(domainObject);
assertThat(this.tag.getHasPermission()).isEqualTo("1,WRITE");
assertThat(tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) pageContext.getAttribute("allowed")).isTrue();
verify(pe).hasPermission(bob, domainObject, 1);
verify(pe).hasPermission(bob, domainObject, "WRITE");
verifyNoMoreInteractions(pe);
assertThat(this.tag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat((Boolean) this.pageContext.getAttribute("allowed")).isTrue();
verify(this.pe).hasPermission(this.bob, domainObject, 1);
verify(this.pe).hasPermission(this.bob, domainObject, "WRITE");
verifyNoMoreInteractions(this.pe);
}
@Test
public void bodyIsSkippedIfAclDeniesAccess() throws Exception {
Object domainObject = new Object();
when(pe.hasPermission(bob, domainObject, "READ")).thenReturn(false);
when(this.pe.hasPermission(this.bob, domainObject, "READ")).thenReturn(false);
tag.setDomainObject(domainObject);
tag.setHasPermission("READ");
tag.setVar("allowed");
this.tag.setDomainObject(domainObject);
this.tag.setHasPermission("READ");
this.tag.setVar("allowed");
assertThat(tag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat((Boolean) pageContext.getAttribute("allowed")).isFalse();
assertThat(this.tag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat((Boolean) this.pageContext.getAttribute("allowed")).isFalse();
}
}

78
taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthenticationTagTests.java
View File

@@ -51,12 +51,12 @@ public class AuthenticationTagTests {
@Test
public void testOperationWhenPrincipalIsAUserDetailsInstance() throws JspException {
SecurityContextHolder.getContext().setAuthentication(auth);
SecurityContextHolder.getContext().setAuthentication(this.auth);
authenticationTag.setProperty("name");
assertThat(authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(authenticationTag.getLastMessage()).isEqualTo("rodUserDetails");
this.authenticationTag.setProperty("name");
assertThat(this.authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(this.authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(this.authenticationTag.getLastMessage()).isEqualTo("rodUserDetails");
}
@Test
@@ -64,20 +64,20 @@ public class AuthenticationTagTests {
SecurityContextHolder.getContext().setAuthentication(
new TestingAuthenticationToken("rodAsString", "koala", AuthorityUtils.NO_AUTHORITIES));
authenticationTag.setProperty("principal");
assertThat(authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(authenticationTag.getLastMessage()).isEqualTo("rodAsString");
this.authenticationTag.setProperty("principal");
assertThat(this.authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(this.authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(this.authenticationTag.getLastMessage()).isEqualTo("rodAsString");
}
@Test
public void testNestedPropertyIsReadCorrectly() throws JspException {
SecurityContextHolder.getContext().setAuthentication(auth);
SecurityContextHolder.getContext().setAuthentication(this.auth);
authenticationTag.setProperty("principal.username");
assertThat(authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(authenticationTag.getLastMessage()).isEqualTo("rodUserDetails");
this.authenticationTag.setProperty("principal.username");
assertThat(this.authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(this.authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(this.authenticationTag.getLastMessage()).isEqualTo("rodUserDetails");
}
@Test
@@ -85,36 +85,36 @@ public class AuthenticationTagTests {
SecurityContextHolder.getContext()
.setAuthentication(new TestingAuthenticationToken(null, "koala", AuthorityUtils.NO_AUTHORITIES));
authenticationTag.setProperty("principal");
assertThat(authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
this.authenticationTag.setProperty("principal");
assertThat(this.authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(this.authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
}
@Test
public void testOperationWhenSecurityContextIsNull() throws Exception {
SecurityContextHolder.getContext().setAuthentication(null);
authenticationTag.setProperty("principal");
assertThat(authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(authenticationTag.getLastMessage()).isNull();
this.authenticationTag.setProperty("principal");
assertThat(this.authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(this.authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
assertThat(this.authenticationTag.getLastMessage()).isNull();
}
@Test
public void testSkipsBodyIfNullOrEmptyOperation() throws Exception {
authenticationTag.setProperty("");
assertThat(authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
this.authenticationTag.setProperty("");
assertThat(this.authenticationTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
assertThat(this.authenticationTag.doEndTag()).isEqualTo(Tag.EVAL_PAGE);
}
@Test
public void testThrowsExceptionForUnrecognisedProperty() {
SecurityContextHolder.getContext().setAuthentication(auth);
authenticationTag.setProperty("qsq");
SecurityContextHolder.getContext().setAuthentication(this.auth);
this.authenticationTag.setProperty("qsq");
try {
authenticationTag.doStartTag();
authenticationTag.doEndTag();
this.authenticationTag.doStartTag();
this.authenticationTag.doEndTag();
fail("Should have throwns JspException");
}
catch (JspException expected) {
@@ -124,20 +124,20 @@ public class AuthenticationTagTests {
@Test
public void htmlEscapingIsUsedByDefault() throws Exception {
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("<>& ", ""));
authenticationTag.setProperty("name");
authenticationTag.doStartTag();
authenticationTag.doEndTag();
assertThat(authenticationTag.getLastMessage()).isEqualTo("&lt;&gt;&amp;&#32;");
this.authenticationTag.setProperty("name");
this.authenticationTag.doStartTag();
this.authenticationTag.doEndTag();
assertThat(this.authenticationTag.getLastMessage()).isEqualTo("&lt;&gt;&amp;&#32;");
}
@Test
public void settingHtmlEscapeToFalsePreventsEscaping() throws Exception {
SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("<>& ", ""));
authenticationTag.setProperty("name");
authenticationTag.setHtmlEscape("false");
authenticationTag.doStartTag();
authenticationTag.doEndTag();
assertThat(authenticationTag.getLastMessage()).isEqualTo("<>& ");
this.authenticationTag.setProperty("name");
this.authenticationTag.setHtmlEscape("false");
this.authenticationTag.doStartTag();
this.authenticationTag.doEndTag();
assertThat(this.authenticationTag.getLastMessage()).isEqualTo("<>& ");
}
private class MyAuthenticationTag extends AuthenticationTag {
@@ -145,11 +145,11 @@ public class AuthenticationTagTests {
String lastMessage = null;
public String getLastMessage() {
return lastMessage;
return this.lastMessage;
}
protected void writeMessage(String msg) {
lastMessage = msg;
this.lastMessage = msg;
}
}

54
taglibs/src/test/java/org/springframework/security/taglibs/authz/AuthorizeTagTests.java
View File

@@ -64,19 +64,19 @@ public class AuthorizeTagTests {
@Before
public void setUp() {
SecurityContextHolder.getContext().setAuthentication(currentUser);
SecurityContextHolder.getContext().setAuthentication(this.currentUser);
StaticWebApplicationContext ctx = new StaticWebApplicationContext();
BeanDefinitionBuilder webExpressionHandler = BeanDefinitionBuilder
.rootBeanDefinition(DefaultWebSecurityExpressionHandler.class);
webExpressionHandler.addPropertyValue("permissionEvaluator", permissionEvaluator);
webExpressionHandler.addPropertyValue("permissionEvaluator", this.permissionEvaluator);
ctx.registerBeanDefinition("expressionHandler", webExpressionHandler.getBeanDefinition());
ctx.registerSingleton("wipe", MockWebInvocationPrivilegeEvaluator.class);
MockServletContext servletCtx = new MockServletContext();
servletCtx.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, ctx);
authorizeTag = new JspAuthorizeTag();
authorizeTag.setPageContext(new MockPageContext(servletCtx, request, new MockHttpServletResponse()));
this.authorizeTag = new JspAuthorizeTag();
this.authorizeTag.setPageContext(new MockPageContext(servletCtx, this.request, new MockHttpServletResponse()));
}
@After
@@ -89,65 +89,65 @@ public class AuthorizeTagTests {
@Test
public void taglibsDocumentationHasPermissionOr() throws Exception {
Object domain = new Object();
request.setAttribute("domain", domain);
authorizeTag.setAccess("hasPermission(#domain,'read') or hasPermission(#domain,'write')");
when(permissionEvaluator.hasPermission(eq(currentUser), eq(domain), anyString())).thenReturn(true);
this.request.setAttribute("domain", domain);
this.authorizeTag.setAccess("hasPermission(#domain,'read') or hasPermission(#domain,'write')");
when(this.permissionEvaluator.hasPermission(eq(this.currentUser), eq(domain), anyString())).thenReturn(true);
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
}
@Test
public void skipsBodyIfNoAuthenticationPresent() throws Exception {
SecurityContextHolder.clearContext();
authorizeTag.setAccess("permitAll");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
this.authorizeTag.setAccess("permitAll");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
}
@Test
public void skipsBodyIfAccessExpressionDeniesAccess() throws Exception {
authorizeTag.setAccess("denyAll");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
this.authorizeTag.setAccess("denyAll");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
}
@Test
public void showsBodyIfAccessExpressionAllowsAccess() throws Exception {
authorizeTag.setAccess("permitAll");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
this.authorizeTag.setAccess("permitAll");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
}
@Test
public void requestAttributeIsResolvedAsElVariable() throws JspException {
request.setAttribute("blah", "blah");
authorizeTag.setAccess("#blah == 'blah'");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
this.request.setAttribute("blah", "blah");
this.authorizeTag.setAccess("#blah == 'blah'");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
}
// url attribute tests
@Test
public void skipsBodyWithUrlSetIfNoAuthenticationPresent() throws Exception {
SecurityContextHolder.clearContext();
authorizeTag.setUrl("/something");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
this.authorizeTag.setUrl("/something");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
}
@Test
public void skipsBodyIfUrlIsNotAllowed() throws Exception {
authorizeTag.setUrl("/notallowed");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
this.authorizeTag.setUrl("/notallowed");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
}
@Test
public void evaluatesBodyIfUrlIsAllowed() throws Exception {
authorizeTag.setUrl("/allowed");
authorizeTag.setMethod("GET");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
this.authorizeTag.setUrl("/allowed");
this.authorizeTag.setMethod("GET");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.EVAL_BODY_INCLUDE);
}
@Test
public void skipsBodyIfMethodIsNotAllowed() throws Exception {
authorizeTag.setUrl("/allowed");
authorizeTag.setMethod("POST");
assertThat(authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
this.authorizeTag.setUrl("/allowed");
this.authorizeTag.setMethod("POST");
assertThat(this.authorizeTag.doStartTag()).isEqualTo(Tag.SKIP_BODY);
}
public static class MockWebInvocationPrivilegeEvaluator implements WebInvocationPrivilegeEvaluator {