From ac4e7bbadb62bd6839ddb2d7250f1cbe25922196 Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Wed, 9 Sep 2009 10:11:45 +0000 Subject: [PATCH] SEC-1241: Make sure saved request is removed after a match. --- .../savedrequest/HttpSessionRequestCache.java | 2 ++ .../web/savedrequest/RequestCache.java | 2 +- .../RequestCacheAwareFilterTests.java | 27 +++++++++++++++++++ 3 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 web/src/test/java/org/springframework/security/web/savedrequest/RequestCacheAwareFilterTests.java diff --git a/web/src/main/java/org/springframework/security/web/savedrequest/HttpSessionRequestCache.java b/web/src/main/java/org/springframework/security/web/savedrequest/HttpSessionRequestCache.java index bdde08a430..cb74c36856 100644 --- a/web/src/main/java/org/springframework/security/web/savedrequest/HttpSessionRequestCache.java +++ b/web/src/main/java/org/springframework/security/web/savedrequest/HttpSessionRequestCache.java @@ -71,6 +71,8 @@ public class HttpSessionRequestCache implements RequestCache { return null; } + removeRequest(request, response); + return new SavedRequestAwareWrapper(saved, request); } diff --git a/web/src/main/java/org/springframework/security/web/savedrequest/RequestCache.java b/web/src/main/java/org/springframework/security/web/savedrequest/RequestCache.java index 6d74c7399a..7f32d15ccc 100644 --- a/web/src/main/java/org/springframework/security/web/savedrequest/RequestCache.java +++ b/web/src/main/java/org/springframework/security/web/savedrequest/RequestCache.java @@ -39,7 +39,7 @@ public interface RequestCache { HttpServletRequest getMatchingRequest(HttpServletRequest request, HttpServletResponse response); /** - * Removes and returns the cached request + * Removes the cached request * @param currentRequest */ void removeRequest(HttpServletRequest request, HttpServletResponse response); diff --git a/web/src/test/java/org/springframework/security/web/savedrequest/RequestCacheAwareFilterTests.java b/web/src/test/java/org/springframework/security/web/savedrequest/RequestCacheAwareFilterTests.java new file mode 100644 index 0000000000..8e21858033 --- /dev/null +++ b/web/src/test/java/org/springframework/security/web/savedrequest/RequestCacheAwareFilterTests.java @@ -0,0 +1,27 @@ +package org.springframework.security.web.savedrequest; + +import static org.junit.Assert.*; + +import org.junit.Test; +import org.springframework.mock.web.MockFilterChain; +import org.springframework.mock.web.MockHttpServletRequest; +import org.springframework.mock.web.MockHttpServletResponse; + +public class RequestCacheAwareFilterTests { + + + @Test + public void savedRequestIsRemovedAfterMatch() throws Exception { + RequestCacheAwareFilter filter = new RequestCacheAwareFilter(); + HttpSessionRequestCache cache = new HttpSessionRequestCache(); + + MockHttpServletRequest request = new MockHttpServletRequest("POST", "/destination"); + MockHttpServletResponse response = new MockHttpServletResponse(); + cache.saveRequest(request, response); + assertNotNull(request.getSession().getAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY)); + + filter.doFilter(request, response, new MockFilterChain()); + assertNull(request.getSession().getAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY)); + } + +}