Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2916: disable-url-rewriting=true by default

Browse Source
This commit is contained in:
Rob Winch
2015-03-23 11:45:24 -05:00
parent ae6af5d73c
commit c94a5cf8e2
7 changed files with 1896 additions and 1875 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/src/test/groovy/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.groovy
View File

@@ -248,7 +248,7 @@ public class NamespaceHttpTests extends BaseSpringSpec {
static class EnableUrlRewritingConfig extends BaseWebConfig {
protected void configure(HttpSecurity http) throws Exception {
HttpSessionSecurityContextRepository repository = new HttpSessionSecurityContextRepository()
repository.disableUrlRewriting = false // explicitly configured (not necessary due to default values)
repository.disableUrlRewriting = false // explicitly configured
http.
securityContext()

61
config/src/test/groovy/org/springframework/security/config/http/HttpConfigTests.groovy
View File

@@ -12,32 +12,17 @@
*/
package org.springframework.security.config.http
import org.springframework.mock.web.MockFilterChain
import org.springframework.mock.web.MockHttpServletRequest
import org.springframework.mock.web.MockHttpServletResponse
import org.springframework.security.access.AccessDeniedException
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
import org.springframework.security.core.Authentication
import org.springframework.security.core.authority.AuthorityUtils
import org.springframework.security.core.context.SecurityContextImpl
import org.springframework.security.web.access.AccessDeniedHandler
import org.springframework.security.web.context.HttpRequestResponseHolder
import org.springframework.security.web.context.HttpSessionSecurityContextRepository
import org.springframework.security.web.csrf.CsrfFilter
import org.springframework.security.web.csrf.CsrfToken
import org.springframework.security.web.csrf.CsrfTokenRepository
import org.springframework.security.web.csrf.DefaultCsrfToken
import org.springframework.security.web.util.matcher.RequestMatcher
import org.springframework.web.servlet.support.RequestDataValueProcessor
import spock.lang.Unroll
import javax.servlet.http.HttpServletRequest
import javax.servlet.http.HttpServletResponse
import static org.mockito.Matchers.any
import static org.mockito.Matchers.eq
import static org.mockito.Mockito.*
import javax.servlet.http.HttpServletResponse
import javax.servlet.http.HttpServletResponseWrapper
import org.springframework.mock.web.MockFilterChain
import org.springframework.mock.web.MockHttpServletRequest
import org.springframework.mock.web.MockHttpServletResponse
/**
*
* @author Rob Winch
@@ -59,4 +44,36 @@ class HttpConfigTests extends AbstractHttpConfigTests {
response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
response.redirectedUrl == 'http://localhost/login'
}
def 'http disable-url-rewriting defaults to true'() {
setup:
xml.http() {}
createAppContext("""<user-service>
<user name="user" password="password" authorities="ROLE_USER" />
</user-service>""")
HttpServletResponse testResponse = new HttpServletResponseWrapper(response) {
public String encodeURL(String url) {
throw new RuntimeException("Unexpected invocation of encodeURL")
}
public String encodeRedirectURL(String url) {
throw new RuntimeException("Unexpected invocation of encodeURL")
}
public String encodeUrl(String url) {
throw new RuntimeException("Unexpected invocation of encodeURL")
}
public String encodeRedirectUrl(String url) {
throw new RuntimeException("Unexpected invocation of encodeURL")
}
}
when: 'request protected URL'
springSecurityFilterChain.doFilter(request,testResponse,{ request,response->
response.encodeURL("/url")
response.encodeRedirectURL("/url")
response.encodeUrl("/url")
response.encodeRedirectUrl("/url")
})
then: 'sent to login page'
response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
response.redirectedUrl == 'http://localhost/login'
}
}

2
config/src/test/groovy/org/springframework/security/config/http/SessionManagementConfigTests.groovy
View File

@@ -67,7 +67,7 @@ class SessionManagementConfigTests extends AbstractHttpConfigTests {
expect:
filter.forceEagerSessionCreation
filter.repo.allowSessionCreation
!filter.repo.disableUrlRewriting
filter.repo.disableUrlRewriting
}
def settingCreateSessionToNeverSetsFilterPropertiesCorrectly() {