From f38df99730bd4ab806e788b8bdaf9e5e31a9a544 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Thu, 4 Oct 2012 11:34:36 -0500 Subject: [PATCH] SEC-2045: AbstractAuthorizeTag supports custom WebInvocationPrivilegeEvaluator --- .../taglibs/authz/AbstractAuthorizeTag.java | 7 ++ .../authz/AbstractAuthorizeTagTests.java | 90 +++++++++++++++++++ .../security/web/WebAttributes.java | 11 +++ 3 files changed, 108 insertions(+) create mode 100644 taglibs/src/test/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTagTests.java diff --git a/taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java b/taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java index 5a432719e0..6ac7d6546c 100644 --- a/taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java +++ b/taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java @@ -40,6 +40,7 @@ import org.springframework.security.core.Authentication; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.FilterInvocation; +import org.springframework.security.web.WebAttributes; import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator; import org.springframework.util.StringUtils; import org.springframework.web.context.support.WebApplicationContextUtils; @@ -328,6 +329,12 @@ public abstract class AbstractAuthorizeTag { } private WebInvocationPrivilegeEvaluator getPrivilegeEvaluator() throws IOException { + WebInvocationPrivilegeEvaluator privEvaluatorFromRequest = (WebInvocationPrivilegeEvaluator) getRequest() + .getAttribute(WebAttributes.WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE); + if(privEvaluatorFromRequest != null) { + return privEvaluatorFromRequest; + } + ApplicationContext ctx = WebApplicationContextUtils.getRequiredWebApplicationContext(getServletContext()); Map wipes = ctx.getBeansOfType(WebInvocationPrivilegeEvaluator.class); diff --git a/taglibs/src/test/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTagTests.java b/taglibs/src/test/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTagTests.java new file mode 100644 index 0000000000..83770533ff --- /dev/null +++ b/taglibs/src/test/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTagTests.java @@ -0,0 +1,90 @@ +/* + * Copyright 2002-2012 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on + * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the + * specific language governing permissions and limitations under the License. + */ +package org.springframework.security.taglibs.authz; + +import static org.mockito.Matchers.any; +import static org.mockito.Matchers.eq; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.verify; + +import java.io.IOException; + +import javax.servlet.ServletContext; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; + +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.springframework.mock.web.MockHttpServletRequest; +import org.springframework.mock.web.MockHttpServletResponse; +import org.springframework.mock.web.MockServletContext; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.web.WebAttributes; +import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator; + +/** + * + * @author Rob Winch + * + */ +public class AbstractAuthorizeTagTests { + private AbstractAuthorizeTag tag; + private MockHttpServletRequest request; + private MockHttpServletResponse response; + private MockServletContext servletContext; + + @Before + public void setup() { + tag = new AuthzTag(); + request = new MockHttpServletRequest(); + response = new MockHttpServletResponse(); + servletContext = new MockServletContext(); + } + + @After + public void teardown() { + SecurityContextHolder.clearContext(); + } + + @Test + public void privilegeEvaluatorFromRequest() throws IOException { + String uri = "/something"; + WebInvocationPrivilegeEvaluator expected = mock(WebInvocationPrivilegeEvaluator.class); + tag.setUrl(uri); + request.setAttribute(WebAttributes.WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE, expected); + + tag.authorizeUsingUrlCheck(); + + verify(expected).isAllowed(eq(""), eq(uri), eq("GET"), any(Authentication.class)); + } + + private class AuthzTag extends AbstractAuthorizeTag { + + @Override + protected ServletRequest getRequest() { + return request; + } + + @Override + protected ServletResponse getResponse() { + return response; + } + + @Override + protected ServletContext getServletContext() { + return servletContext; + } + } +} diff --git a/web/src/main/java/org/springframework/security/web/WebAttributes.java b/web/src/main/java/org/springframework/security/web/WebAttributes.java index 4b4ff38247..dda1c3a96f 100644 --- a/web/src/main/java/org/springframework/security/web/WebAttributes.java +++ b/web/src/main/java/org/springframework/security/web/WebAttributes.java @@ -1,9 +1,12 @@ package org.springframework.security.web; +import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator; + /** * Well-known keys which are used to store Spring Security information in request or session scope. * * @author Luke Taylor + * @author Rob Winch * @since 3.0.3 */ public final class WebAttributes { @@ -20,4 +23,12 @@ public final class WebAttributes { * @see org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler */ public static final String AUTHENTICATION_EXCEPTION = "SPRING_SECURITY_LAST_EXCEPTION"; + + /** + * Set as a request attribute to override the default {@link WebInvocationPrivilegeEvaluator} + * + * @see WebInvocationPrivilegeEvaluator + * @since 3.1.3 + */ + public static final String WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE = WebAttributes.class.getName() + ".WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE"; }