Add RequestRejectedHandler

Closes gh-5007

web/src/test/java/org/springframework/security/web/FilterChainProxyTests.java

@@ -28,6 +28,8 @@ import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.firewall.FirewalledRequest;
 import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.RequestRejectedException;
+import org.springframework.security.web.firewall.RequestRejectedHandler;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 
 import javax.servlet.Filter;
@@ -243,4 +245,21 @@ public class FilterChainProxyTests {
 				any(HttpServletResponse.class));
 		assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
 	}
+
+	@Test(expected = IllegalArgumentException.class)
+	public void setRequestRejectedHandlerDoesNotAcceptNull() {
+		fcp.setRequestRejectedHandler(null);
+	}
+
+	@Test
+	public void requestRejectedHandlerIsCalledIfFirewallThrowsRequestRejectedException() throws Exception {
+		HttpFirewall fw = mock(HttpFirewall.class);
+		RequestRejectedHandler rjh = mock(RequestRejectedHandler.class);
+		fcp.setFirewall(fw);
+		fcp.setRequestRejectedHandler(rjh);
+		RequestRejectedException requestRejectedException = new RequestRejectedException("Contains illegal chars");
+		when(fw.getFirewalledRequest(request)).thenThrow(requestRejectedException);
+		fcp.doFilter(request, response, chain);
+		verify(rjh).handle(eq(request), eq(response), eq((requestRejectedException)));
+	}
 }

web/src/test/java/org/springframework/security/web/firewall/DefaultRequestRejectedHandlerTest.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.firewall;
+
+
+import static org.mockito.Mockito.mock;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.hamcrest.CoreMatchers;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class DefaultRequestRejectedHandlerTest {
+
+	@Test
+	public void defaultRequestRejectedHandlerRethrowsTheException() throws Exception {
+		// given:
+		RequestRejectedException requestRejectedException = new RequestRejectedException("rejected");
+		DefaultRequestRejectedHandler sut = new DefaultRequestRejectedHandler();
+
+		//when:
+		try {
+			sut.handle(mock(HttpServletRequest.class), mock(HttpServletResponse.class), requestRejectedException);
+		} catch (RequestRejectedException exception) {
+			//then:
+			Assert.assertThat(exception.getMessage(), CoreMatchers.is("rejected"));
+			return;
+		}
+		Assert.fail("Exception was not rethrown");
+	}
+}

web/src/test/java/org/springframework/security/web/firewall/HttpStatusRequestRejectedHandlerTest.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.firewall;
+
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.junit.Test;
+
+public class HttpStatusRequestRejectedHandlerTest {
+
+	@Test
+	public void httpStatusRequestRejectedHandlerUsesStatus400byDefault() throws Exception {
+		//given:
+		HttpStatusRequestRejectedHandler sut = new HttpStatusRequestRejectedHandler();
+		HttpServletResponse response = mock(HttpServletResponse.class);
+
+		//when:
+		sut.handle(mock(HttpServletRequest.class), response, mock(RequestRejectedException.class));
+
+		// then:
+		verify(response).sendError(400);
+	}
+
+	@Test
+	public void httpStatusRequestRejectedHandlerCanBeConfiguredToUseStatus() throws Exception {
+		httpStatusRequestRejectedHandlerCanBeConfiguredToUseStatusHelper(400);
+		httpStatusRequestRejectedHandlerCanBeConfiguredToUseStatusHelper(403);
+		httpStatusRequestRejectedHandlerCanBeConfiguredToUseStatusHelper(500);
+	}
+
+	private void httpStatusRequestRejectedHandlerCanBeConfiguredToUseStatusHelper(int status) throws Exception {
+
+		//given:
+		HttpStatusRequestRejectedHandler sut = new HttpStatusRequestRejectedHandler(status);
+		HttpServletResponse response = mock(HttpServletResponse.class);
+
+		//when:
+		sut.handle(mock(HttpServletRequest.class), response, mock(RequestRejectedException.class));
+
+		// then:
+		verify(response).sendError(status);
+	}
+}