Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Replace expected @Test attributes with AssertJ

Browse Source 
Replace JUnit expected @Test attributes with AssertJ calls.
This commit is contained in:
Phillip Webb
2020-09-10 21:33:16 -07:00
committed by Josh Cummings
parent 20baa7d409
commit c502312719
243 changed files with 2115 additions and 1591 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
itest/context/src/integration-test/java/org/springframework/security/integration/HttpPathParameterStrippingTests.java
View File

@@ -34,7 +34,7 @@ import org.springframework.security.web.firewall.RequestRejectedException;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@ContextConfiguration(locations = { "/http-path-param-stripping-app-context.xml" })
@RunWith(SpringJUnit4ClassRunner.class)
@@ -43,33 +43,35 @@ public class HttpPathParameterStrippingTests {
@Autowired
private FilterChainProxy fcp;
@Test(expected = RequestRejectedException.class)
@Test
public void securedFilterChainCannotBeBypassedByAddingPathParameters() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setPathInfo("/secured;x=y/admin.html");
request.setSession(createAuthenticatedSession("ROLE_USER"));
MockHttpServletResponse response = new MockHttpServletResponse();
this.fcp.doFilter(request, response, new MockFilterChain());
assertThatExceptionOfType(RequestRejectedException.class)
.isThrownBy(() -> this.fcp.doFilter(request, response, new MockFilterChain()));
}
@Test(expected = RequestRejectedException.class)
@Test
public void adminFilePatternCannotBeBypassedByAddingPathParameters() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secured/admin.html;x=user.html");
request.setSession(createAuthenticatedSession("ROLE_USER"));
MockHttpServletResponse response = new MockHttpServletResponse();
this.fcp.doFilter(request, response, new MockFilterChain());
assertThatExceptionOfType(RequestRejectedException.class)
.isThrownBy(() -> this.fcp.doFilter(request, response, new MockFilterChain()));
}
@Test(expected = RequestRejectedException.class)
@Test
public void adminFilePatternCannotBeBypassedByAddingPathParametersWithPathInfo() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setServletPath("/secured");
request.setPathInfo("/admin.html;x=user.html");
request.setSession(createAuthenticatedSession("ROLE_USER"));
MockHttpServletResponse response = new MockHttpServletResponse();
this.fcp.doFilter(request, response, new MockFilterChain());
assertThat(response.getStatus()).isEqualTo(403);
assertThatExceptionOfType(RequestRejectedException.class)
.isThrownBy(() -> this.fcp.doFilter(request, response, new MockFilterChain()));
}
public HttpSession createAuthenticatedSession(String... roles) {

22
itest/context/src/integration-test/java/org/springframework/security/integration/MultiAnnotationTests.java
View File

@@ -31,6 +31,8 @@ import org.springframework.security.integration.multiannotation.SecuredService;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
/**
* @author Luke Taylor
*/
@@ -57,16 +59,16 @@ public class MultiAnnotationTests {
SecurityContextHolder.clearContext();
}
@Test(expected = AccessDeniedException.class)
@Test
public void preAuthorizeDeniedIsDenied() {
SecurityContextHolder.getContext().setAuthentication(this.joe_a);
this.service.preAuthorizeDenyAllMethod();
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.service::preAuthorizeDenyAllMethod);
}
@Test(expected = AccessDeniedException.class)
@Test
public void preAuthorizeRoleAIsDeniedIfRoleMissing() {
SecurityContextHolder.getContext().setAuthentication(this.joe_b);
this.service.preAuthorizeHasRoleAMethod();
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.service::preAuthorizeHasRoleAMethod);
}
@Test
@@ -81,10 +83,10 @@ public class MultiAnnotationTests {
this.service.securedAnonymousMethod();
}
@Test(expected = AccessDeniedException.class)
@Test
public void securedRoleAIsDeniedIfRoleMissing() {
SecurityContextHolder.getContext().setAuthentication(this.joe_b);
this.service.securedRoleAMethod();
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.service::securedRoleAMethod);
}
@Test
@@ -93,16 +95,16 @@ public class MultiAnnotationTests {
this.service.securedRoleAMethod();
}
@Test(expected = AccessDeniedException.class)
@Test
public void preAuthorizedOnlyServiceDeniesIfRoleMissing() {
SecurityContextHolder.getContext().setAuthentication(this.joe_b);
this.preService.preAuthorizedMethod();
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.preService::preAuthorizedMethod);
}
@Test(expected = AccessDeniedException.class)
@Test
public void securedOnlyRoleAServiceDeniesIfRoleMissing() {
SecurityContextHolder.getContext().setAuthentication(this.joe_b);
this.secService.securedMethod();
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.secService::securedMethod);
}
}

8
itest/context/src/integration-test/java/org/springframework/security/integration/SEC936ApplicationContextTests.java
View File

@@ -27,6 +27,8 @@ import org.springframework.security.core.session.SessionRegistry;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
/**
* @author Luke Taylor
* @since 2.0
@@ -35,17 +37,17 @@ import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
@RunWith(SpringJUnit4ClassRunner.class)
public class SEC936ApplicationContextTests {
@Autowired
/**
* SessionRegistry is used as the test service interface (nothing to do with the test)
*/
@Autowired
private SessionRegistry sessionRegistry;
@Test(expected = AccessDeniedException.class)
@Test
public void securityInterceptorHandlesCallWithNoTargetObject() {
SecurityContextHolder.getContext()
.setAuthentication(new UsernamePasswordAuthenticationToken("bob", "bobspassword"));
this.sessionRegistry.getAllPrincipals();
assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(this.sessionRegistry::getAllPrincipals);
}
}