root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 17 Packages Projects Releases Wiki Activity

OPEN - issue SEC-825: Query string isn't beig stripped from URLs when ant matcher is in use (regression issue) 

http://jira.springframework.org/browse/SEC-825. Make sure the property is set on DefaultFilterInvocationDefinitionSource when ant paths are in use.
This commit is contained in:
Luke Taylor 2008-05-09 18:08:32 +00:00
parent 1030dca353
commit 781d88bd30
3 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
core/src/main/java/org/springframework/security/config/HttpSecurityBeanDefinitionParser.java
View File

@ -276,8 +276,11 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
builder.addPropertyValue("observeOncePerRequest", Boolean.FALSE); builder.addPropertyValue("observeOncePerRequest", Boolean.FALSE);
} }
builder.addPropertyValue("objectDefinitionSource", DefaultFilterInvocationDefinitionSource fids =
new DefaultFilterInvocationDefinitionSource(matcher, filterInvocationDefinitionMap)); new DefaultFilterInvocationDefinitionSource(matcher, filterInvocationDefinitionMap);
fids.setStripQueryStringFromUrls(matcher instanceof AntUrlPathMatcher);
builder.addPropertyValue("objectDefinitionSource", fids);
pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_SECURITY_INTERCEPTOR, builder.getBeanDefinition()); pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_SECURITY_INTERCEPTOR, builder.getBeanDefinition());
ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.FILTER_SECURITY_INTERCEPTOR)); ConfigUtils.addHttpFilter(pc, new RuntimeBeanReference(BeanIds.FILTER_SECURITY_INTERCEPTOR));
} }
@ -288,7 +291,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
new RuntimeBeanReference(BeanIds.CHANNEL_DECISION_MANAGER)); new RuntimeBeanReference(BeanIds.CHANNEL_DECISION_MANAGER));
DefaultFilterInvocationDefinitionSource channelFilterInvDefSource = DefaultFilterInvocationDefinitionSource channelFilterInvDefSource =
new DefaultFilterInvocationDefinitionSource(matcher, channelRequestMap); new DefaultFilterInvocationDefinitionSource(matcher, channelRequestMap);
channelFilterInvDefSource.setStripQueryStringFromUrls(matcher instanceof AntUrlPathMatcher);
channelFilter.getPropertyValues().addPropertyValue("filterInvocationDefinitionSource", channelFilter.getPropertyValues().addPropertyValue("filterInvocationDefinitionSource",
channelFilterInvDefSource); channelFilterInvDefSource);

2
core/src/main/java/org/springframework/security/intercept/web/DefaultFilterInvocationDefinitionSource.java
View File

@ -252,7 +252,7 @@ public class DefaultFilterInvocationDefinitionSource implements FilterInvocation
return urlMatcher.requiresLowerCaseUrl(); return urlMatcher.requiresLowerCaseUrl();
} }
protected void setStripQueryStringFromUrls(boolean stripQueryStringFromUrls) { public void setStripQueryStringFromUrls(boolean stripQueryStringFromUrls) {
this.stripQueryStringFromUrls = stripQueryStringFromUrls; this.stripQueryStringFromUrls = stripQueryStringFromUrls;
} }
} }

5
core/src/test/java/org/springframework/security/config/HttpSecurityBeanDefinitionParserTests.java
View File

@ -83,6 +83,7 @@ public class HttpSecurityBeanDefinitionParserTests {
List filterList = getFilters("/anyurl"); List filterList = getFilters("/anyurl");
checkAutoConfigFilters(filterList); checkAutoConfigFilters(filterList);
assertEquals(true, FieldUtils.getFieldValue(filterList.get(10), "objectDefinitionSource.stripQueryStringFromUrls"));
} }
@Test(expected=BeanDefinitionParsingException.class) @Test(expected=BeanDefinitionParsingException.class)
@ -137,7 +138,9 @@ public class HttpSecurityBeanDefinitionParserTests {
" </http>" + AUTH_PROVIDER_XML); " </http>" + AUTH_PROVIDER_XML);
assertEquals(0, getFilters("/imlowercase").size()); assertEquals(0, getFilters("/imlowercase").size());
// This will be matched by the default pattern ".*" // This will be matched by the default pattern ".*"
checkAutoConfigFilters(getFilters("/ImCaughtByTheUniversalMatchPattern")); List allFilters = getFilters("/ImCaughtByTheUniversalMatchPattern");
checkAutoConfigFilters(allFilters);
assertEquals(false, FieldUtils.getFieldValue(allFilters.get(10), "objectDefinitionSource.stripQueryStringFromUrls"));
} }
@Test @Test