Skip to content

Commit 215316d

Browse files
fl4viafl4via
committed
[UNDERTOW-1997] Add test for a security constraint with "/" path URL Pattern
Signed-off-by: Flavia Rainone <frainone@redhat.com>
1 parent e2b1e68 commit 215316d

File tree

2 files changed

+213
-6
lines changed

2 files changed

+213
-6
lines changed

‎servlet/src/test/java/io/undertow/servlet/test/security/constraint/SecurityConstraintUrlMappingTestCase.java

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@
1818

1919
package io.undertow.servlet.test.security.constraint;
2020

21-
import java.io.IOException;
22-
23-
import javax.servlet.ServletException;
24-
2521
import io.undertow.server.handlers.PathHandler;
2622
import io.undertow.servlet.api.DeploymentInfo;
2723
import io.undertow.servlet.api.DeploymentManager;
@@ -36,18 +32,21 @@
3632
import io.undertow.servlet.test.util.TestClassIntrospector;
3733
import io.undertow.testutils.DefaultServer;
3834
import io.undertow.testutils.HttpClientUtils;
35+
import io.undertow.testutils.TestHttpClient;
3936
import io.undertow.util.FlexBase64;
37+
import io.undertow.util.StatusCodes;
4038
import org.apache.http.Header;
4139
import org.apache.http.HttpResponse;
4240
import org.apache.http.client.methods.HttpGet;
4341
import org.apache.http.client.methods.HttpPost;
44-
import io.undertow.testutils.TestHttpClient;
45-
import io.undertow.util.StatusCodes;
4642
import org.junit.Assert;
4743
import org.junit.BeforeClass;
4844
import org.junit.Test;
4945
import org.junit.runner.RunWith;
5046

47+
import javax.servlet.ServletException;
48+
import java.io.IOException;
49+
5150
import static io.undertow.util.Headers.AUTHORIZATION;
5251
import static io.undertow.util.Headers.BASIC;
5352
import static io.undertow.util.Headers.WWW_AUTHENTICATE;
@@ -196,6 +195,19 @@ public void testAggregatedRoles() throws IOException {
196195
runSimpleUrlTest(DefaultServer.getDefaultServerURL() + "/servletContext/secured/1/2/aa", "user1:password1", "user2:password2");
197196
}
198197

198+
@Test
199+
public void testUnknown() throws IOException {
200+
TestHttpClient client = new TestHttpClient();
201+
try {
202+
HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/unknown");
203+
HttpResponse result = client.execute(get);
204+
assertEquals(StatusCodes.NOT_FOUND, result.getStatusLine().getStatusCode());
205+
HttpClientUtils.readResponse(result);
206+
} finally {
207+
client.getConnectionManager().shutdown();
208+
}
209+
}
210+
199211
@Test
200212
public void testHttpMethod() throws IOException {
201213
TestHttpClient client = new TestHttpClient();

‎servlet/src/test/java/io/undertow/servlet/test/security/constraint/SecurityConstraintUrlMappingWithUnspecifiedForbiddenTestCase.java

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
/*
2+
* JBoss, Home of Professional Open Source.
3+
* Copyright 2022 Red Hat, Inc., and individual contributors
4+
* as indicated by the @author tags.
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
19+
package io.undertow.servlet.test.security.constraint;
20+
21+
import io.undertow.server.handlers.PathHandler;
22+
import io.undertow.servlet.api.DeploymentInfo;
23+
import io.undertow.servlet.api.DeploymentManager;
24+
import io.undertow.servlet.api.LoginConfig;
25+
import io.undertow.servlet.api.SecurityConstraint;
26+
import io.undertow.servlet.api.SecurityInfo;
27+
import io.undertow.servlet.api.ServletContainer;
28+
import io.undertow.servlet.api.ServletInfo;
29+
import io.undertow.servlet.api.WebResourceCollection;
30+
import io.undertow.servlet.test.SimpleServletTestCase;
31+
import io.undertow.servlet.test.util.MessageServlet;
32+
import io.undertow.servlet.test.util.TestClassIntrospector;
33+
import io.undertow.testutils.DefaultServer;
34+
import io.undertow.testutils.HttpClientUtils;
35+
import io.undertow.testutils.TestHttpClient;
36+
import io.undertow.util.StatusCodes;
37+
import org.apache.http.HttpResponse;
38+
import org.apache.http.client.methods.HttpGet;
39+
import org.junit.BeforeClass;
40+
import org.junit.Test;
41+
import org.junit.runner.RunWith;
42+
43+
import javax.servlet.ServletException;
44+
import java.io.IOException;
45+
46+
import static org.junit.Assert.assertEquals;
47+
48+
/**
49+
* Do the same as SecurityConstraintURLMappingTestCase, with a small difference, all access to / are denied and public/* is no longer
50+
* covered by a SecurityConstraint.
51+
* Verify that all works as in the super class test case, except for public/*, that now is forbidden for all HTTP methods.
52+
*
53+
* @author Flavia Rainone
54+
*/
55+
@RunWith(DefaultServer.class)
56+
public class SecurityConstraintUrlMappingWithUnspecifiedForbiddenTestCase extends SecurityConstraintUrlMappingTestCase {
57+
58+
@BeforeClass
59+
public static void setup() throws ServletException {
60+
61+
final PathHandler root = new PathHandler();
62+
final ServletContainer container = ServletContainer.Factory.newInstance();
63+
64+
ServletInfo s = new ServletInfo("servlet", AuthenticationMessageServlet.class)
65+
.addInitParam(MessageServlet.MESSAGE, HELLO_WORLD)
66+
.addMapping("/role1")
67+
.addMapping("/role2")
68+
.addMapping("/starstar")
69+
.addMapping("/secured/role2/*")
70+
.addMapping("/secured/1/2/*")
71+
.addMapping("/public/*")
72+
.addMapping("/extension/*");
73+
74+
ServletIdentityManager identityManager = new ServletIdentityManager();
75+
identityManager.addUser("user1", "password1", "role1");
76+
identityManager.addUser("user2", "password2", "role2", "**");
77+
identityManager.addUser("user3", "password3", "role1", "role2");
78+
identityManager.addUser("user4", "password4", "badRole");
79+
80+
DeploymentInfo builder = new DeploymentInfo()
81+
.setClassLoader(SimpleServletTestCase.class.getClassLoader())
82+
.setContextPath("/servletContext")
83+
.setClassIntrospecter(TestClassIntrospector.INSTANCE)
84+
.setDeploymentName("servletContext.war")
85+
.setIdentityManager(identityManager)
86+
.setLoginConfig(new LoginConfig("BASIC", "Test Realm"))
87+
.addServlet(s);
88+
89+
builder.addSecurityConstraint(new SecurityConstraint()
90+
.addWebResourceCollection(new WebResourceCollection()
91+
.addUrlPattern("/role1"))
92+
.addRoleAllowed("role1"));
93+
94+
builder.addSecurityConstraint(new SecurityConstraint()
95+
.addWebResourceCollection(new WebResourceCollection()
96+
.addUrlPattern("/starstar"))
97+
.addRoleAllowed("**"));
98+
builder.addSecurityConstraint(new SecurityConstraint()
99+
.addWebResourceCollection(new WebResourceCollection()
100+
.addUrlPattern("/secured/*"))
101+
.addRoleAllowed("role2"));
102+
builder.addSecurityConstraint(new SecurityConstraint()
103+
.addWebResourceCollection(new WebResourceCollection()
104+
.addUrlPattern("/secured/*"))
105+
.addRoleAllowed("role2"));
106+
builder.addSecurityConstraint(new SecurityConstraint()
107+
.addWebResourceCollection(new WebResourceCollection()
108+
.addUrlPattern("/secured/1/*"))
109+
.addRoleAllowed("role1"));
110+
builder.addSecurityConstraint(new SecurityConstraint()
111+
.addWebResourceCollection(new WebResourceCollection()
112+
.addUrlPattern("/secured/1/2/*"))
113+
.addRoleAllowed("role2"));
114+
builder.addSecurityConstraint(new SecurityConstraint()
115+
.addWebResourceCollection(new WebResourceCollection()
116+
.addUrlPattern("*.html"))
117+
.addRoleAllowed("role2"));
118+
builder.addSecurityConstraint(new SecurityConstraint()
119+
.addWebResourceCollection(new WebResourceCollection()
120+
.addUrlPattern("/")).setEmptyRoleSemantic(SecurityInfo.EmptyRoleSemantic.DENY));
121+
builder.addSecurityConstraint(new SecurityConstraint()
122+
.addWebResourceCollection(new WebResourceCollection()
123+
.addUrlPattern("/public/postSecured/*")
124+
.addHttpMethod("POST"))
125+
.addRoleAllowed("role1"));
126+
127+
DeploymentManager manager = container.addDeployment(builder);
128+
manager.deploy();
129+
root.addPrefixPath(builder.getContextPath(), manager.start());
130+
131+
builder = new DeploymentInfo()
132+
.setClassLoader(SimpleServletTestCase.class.getClassLoader())
133+
.setContextPath("/star")
134+
.setClassIntrospecter(TestClassIntrospector.INSTANCE)
135+
.setDeploymentName("servletContext.war")
136+
.setIdentityManager(identityManager)
137+
.setLoginConfig(new LoginConfig("BASIC", "Test Realm"))
138+
.addSecurityRole("**")
139+
.addServlet(s);
140+
141+
builder.addSecurityConstraint(new SecurityConstraint()
142+
.addWebResourceCollection(new WebResourceCollection()
143+
.addUrlPattern("/starstar"))
144+
.addRoleAllowed("**"));
145+
146+
manager = container.addDeployment(builder);
147+
manager.deploy();
148+
root.addPrefixPath(builder.getContextPath(), manager.start());
149+
DefaultServer.setRootHandler(root);
150+
}
151+
152+
@Test
153+
@Override
154+
public void testUnknown() throws IOException {
155+
TestHttpClient client = new TestHttpClient();
156+
try {
157+
HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/unknown");
158+
HttpResponse result = client.execute(get);
159+
assertEquals(StatusCodes.FORBIDDEN, result.getStatusLine().getStatusCode());
160+
HttpClientUtils.readResponse(result);
161+
} finally {
162+
client.getConnectionManager().shutdown();
163+
}
164+
}
165+
166+
@Test
167+
public void testPublic() throws IOException {
168+
TestHttpClient client = new TestHttpClient();
169+
try {
170+
HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/public");
171+
HttpResponse result = client.execute(get);
172+
assertEquals(StatusCodes.FORBIDDEN, result.getStatusLine().getStatusCode());
173+
HttpClientUtils.readResponse(result);
174+
} finally {
175+
client.getConnectionManager().shutdown();
176+
}
177+
}
178+
179+
@Test
180+
@Override
181+
public void testExtensionMatch() throws IOException {
182+
runSimpleUrlTest(DefaultServer.getDefaultServerURL() + "/servletContext/extension/a.html", "user1:password1", "user2:password2");
183+
TestHttpClient client = new TestHttpClient();
184+
try {
185+
HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/public/a.html");
186+
get.addHeader("ExpectedMechanism", "None");
187+
get.addHeader("ExpectedUser", "None");
188+
HttpResponse result = client.execute(get);
189+
assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
190+
HttpClientUtils.readResponse(result);
191+
} finally {
192+
client.getConnectionManager().shutdown();
193+
}
194+
}
195+
}

0 commit comments

Comments
 (0)