Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1763: Prevent nested switches in SwitchUserFilter by calling attemptExitUser() before doing the switch.

Browse Source
This commit is contained in:
Luke Taylor
2011-07-13 21:56:06 +01:00
parent a504cfae1a
commit de97bac85b
2 changed files with 34 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
web/src/test/java/org/springframework/security/web/authentication/switchuser/SwitchUserFilterTests.java
View File

@@ -374,6 +374,26 @@ public class SwitchUserFilterTests {
assertTrue(AuthorityUtils.authorityListToSet(result.getAuthorities()).contains("ROLE_NEW"));
}
// SEC-1763
@Test
public void nestedSwitchesAreNotAllowed() throws Exception {
// original user
UsernamePasswordAuthenticationToken source = new UsernamePasswordAuthenticationToken("orig", "hawaii50", ROLES_12);
SecurityContextHolder.getContext().setAuthentication(source);
SecurityContextHolder.getContext().setAuthentication(switchToUser("jacklord"));
Authentication switched = switchToUser("dano");
SwitchUserGrantedAuthority switchedFrom = null;
for (GrantedAuthority ga: switched.getAuthorities()) {
if (ga instanceof SwitchUserGrantedAuthority) {
switchedFrom = (SwitchUserGrantedAuthority)ga;
break;
}
}
assertSame(source, switchedFrom.getSource());
}
//~ Inner Classes ==================================================================================================