Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1635: Stop security interceptors from calling AfterInvocationManager if exception occurs during invocation

Browse Source
This commit is contained in:
Luke Taylor
2010-12-14 16:20:27 +00:00
parent 2be2660b13
commit ce421f22bf
7 changed files with 105 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
core/src/test/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptorTests.java
View File

@@ -259,6 +259,27 @@ public class MethodSecurityInterceptorTests {
advisedTarget.makeUpperCase("hello");
}
@Test
public void afterInvocationManagerIsNotInvokedIfExceptionIsRaised() throws Throwable {
MethodInvocation mi = mock(MethodInvocation.class);
token.setAuthenticated(true);
SecurityContextHolder.getContext().setAuthentication(token);
mdsReturnsUserRole();
AfterInvocationManager aim = mock(AfterInvocationManager.class);
interceptor.setAfterInvocationManager(aim);
when(mi.proceed()).thenThrow(new Throwable());
try {
interceptor.invoke(mi);
fail("Expected exception");
} catch (Throwable expected) {
}
verifyZeroInteractions(aim);
}
void mdsReturnsNull() {
when(mds.getAttributes(any(MethodInvocation.class))).thenReturn(null);
}

22
core/src/test/java/org/springframework/security/access/intercept/aspectj/AspectJMethodSecurityInterceptorTests.java
View File

@@ -19,6 +19,7 @@ import static org.junit.Assert.*;
import static org.mockito.Matchers.any;
import static org.mockito.Mockito.*;
import org.aopalliance.intercept.MethodInvocation;
import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.Signature;
@@ -32,6 +33,7 @@ import org.springframework.security.TargetObject;
import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.access.intercept.AfterInvocationManager;
import org.springframework.security.access.method.MethodSecurityMetadataSource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.TestingAuthenticationToken;
@@ -129,4 +131,24 @@ public class AspectJMethodSecurityInterceptorTests {
assertEquals(m, mia.getMethod());
assertSame(to, mia.getThis());
}
@Test
public void afterInvocationManagerIsNotInvokedIfExceptionIsRaised() throws Throwable {
token.setAuthenticated(true);
SecurityContextHolder.getContext().setAuthentication(token);
AfterInvocationManager aim = mock(AfterInvocationManager.class);
interceptor.setAfterInvocationManager(aim);
when(aspectJCallback.proceedWithObject()).thenThrow(new RuntimeException());
try {
interceptor.invoke(joinPoint, aspectJCallback);
fail("Expected exception");
} catch (RuntimeException expected) {
}
verifyZeroInteractions(aim);
}
}