|
|
|
@ -1,5 +1,5 @@ |
|
|
|
/* |
|
|
|
/* |
|
|
|
* Copyright 2006-2009 the original author or authors. |
|
|
|
* Copyright 2002-2009 the original author or authors. |
|
|
|
* |
|
|
|
* |
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
|
|
|
* you may not use this file except in compliance with the License. |
|
|
|
* you may not use this file except in compliance with the License. |
|
|
|
@ -13,8 +13,15 @@ |
|
|
|
* See the License for the specific language governing permissions and |
|
|
|
* See the License for the specific language governing permissions and |
|
|
|
* limitations under the License. |
|
|
|
* limitations under the License. |
|
|
|
*/ |
|
|
|
*/ |
|
|
|
|
|
|
|
|
|
|
|
package org.springframework.beans.factory.support.security; |
|
|
|
package org.springframework.beans.factory.support.security; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
import static junit.framework.Assert.assertEquals; |
|
|
|
|
|
|
|
import static junit.framework.Assert.assertNotNull; |
|
|
|
|
|
|
|
import static junit.framework.Assert.assertNull; |
|
|
|
|
|
|
|
import static junit.framework.Assert.assertTrue; |
|
|
|
|
|
|
|
import static junit.framework.Assert.fail; |
|
|
|
|
|
|
|
|
|
|
|
import java.lang.reflect.Method; |
|
|
|
import java.lang.reflect.Method; |
|
|
|
import java.net.URL; |
|
|
|
import java.net.URL; |
|
|
|
import java.security.AccessControlContext; |
|
|
|
import java.security.AccessControlContext; |
|
|
|
@ -31,8 +38,8 @@ import java.util.Set; |
|
|
|
import javax.security.auth.AuthPermission; |
|
|
|
import javax.security.auth.AuthPermission; |
|
|
|
import javax.security.auth.Subject; |
|
|
|
import javax.security.auth.Subject; |
|
|
|
|
|
|
|
|
|
|
|
import junit.framework.TestCase; |
|
|
|
import org.junit.Before; |
|
|
|
|
|
|
|
import org.junit.Test; |
|
|
|
import org.springframework.beans.BeansException; |
|
|
|
import org.springframework.beans.BeansException; |
|
|
|
import org.springframework.beans.factory.BeanClassLoaderAware; |
|
|
|
import org.springframework.beans.factory.BeanClassLoaderAware; |
|
|
|
import org.springframework.beans.factory.BeanCreationException; |
|
|
|
import org.springframework.beans.factory.BeanCreationException; |
|
|
|
@ -62,7 +69,7 @@ import org.springframework.core.io.Resource; |
|
|
|
* |
|
|
|
* |
|
|
|
* @author Costin Leau |
|
|
|
* @author Costin Leau |
|
|
|
*/ |
|
|
|
*/ |
|
|
|
public class CallbacksSecurityTests extends TestCase { |
|
|
|
public class CallbacksSecurityTests { |
|
|
|
|
|
|
|
|
|
|
|
private XmlBeanFactory beanFactory; |
|
|
|
private XmlBeanFactory beanFactory; |
|
|
|
private SecurityContextProvider provider; |
|
|
|
private SecurityContextProvider provider; |
|
|
|
@ -264,8 +271,8 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
@Before |
|
|
|
protected void setUp() throws Exception { |
|
|
|
public void setUp() throws Exception { |
|
|
|
|
|
|
|
|
|
|
|
final ProtectionDomain empty = new ProtectionDomain(null, |
|
|
|
final ProtectionDomain empty = new ProtectionDomain(null, |
|
|
|
new Permissions()); |
|
|
|
new Permissions()); |
|
|
|
@ -286,6 +293,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
beanFactory.setSecurityContextProvider(provider); |
|
|
|
beanFactory.setSecurityContextProvider(provider); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testSecuritySanity() throws Exception { |
|
|
|
public void testSecuritySanity() throws Exception { |
|
|
|
AccessControlContext acc = provider.getAccessControlContext(); |
|
|
|
AccessControlContext acc = provider.getAccessControlContext(); |
|
|
|
try { |
|
|
|
try { |
|
|
|
@ -300,7 +308,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
method.setAccessible(true); |
|
|
|
method.setAccessible(true); |
|
|
|
|
|
|
|
|
|
|
|
try { |
|
|
|
try { |
|
|
|
AccessController.doPrivileged(new PrivilegedExceptionAction() { |
|
|
|
AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() { |
|
|
|
|
|
|
|
|
|
|
|
public Object run() throws Exception { |
|
|
|
public Object run() throws Exception { |
|
|
|
method.invoke(bean, null); |
|
|
|
method.invoke(bean, null); |
|
|
|
@ -325,6 +333,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testSpringInitBean() throws Exception { |
|
|
|
public void testSpringInitBean() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("spring-init"); |
|
|
|
beanFactory.getBean("spring-init"); |
|
|
|
@ -333,7 +342,8 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
assertTrue(ex.getCause() instanceof SecurityException); |
|
|
|
assertTrue(ex.getCause() instanceof SecurityException); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testCustomInitBean() throws Exception { |
|
|
|
public void testCustomInitBean() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("custom-init"); |
|
|
|
beanFactory.getBean("custom-init"); |
|
|
|
@ -343,18 +353,21 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testSpringDestroyBean() throws Exception { |
|
|
|
public void testSpringDestroyBean() throws Exception { |
|
|
|
beanFactory.getBean("spring-destroy"); |
|
|
|
beanFactory.getBean("spring-destroy"); |
|
|
|
beanFactory.destroySingletons(); |
|
|
|
beanFactory.destroySingletons(); |
|
|
|
assertNull(System.getProperty("security.destroy")); |
|
|
|
assertNull(System.getProperty("security.destroy")); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testCustomDestroyBean() throws Exception { |
|
|
|
public void testCustomDestroyBean() throws Exception { |
|
|
|
beanFactory.getBean("custom-destroy"); |
|
|
|
beanFactory.getBean("custom-destroy"); |
|
|
|
beanFactory.destroySingletons(); |
|
|
|
beanFactory.destroySingletons(); |
|
|
|
assertNull(System.getProperty("security.destroy")); |
|
|
|
assertNull(System.getProperty("security.destroy")); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testCustomFactoryObject() throws Exception { |
|
|
|
public void testCustomFactoryObject() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("spring-factory"); |
|
|
|
beanFactory.getBean("spring-factory"); |
|
|
|
@ -365,11 +378,13 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
|
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testCustomFactoryType() throws Exception { |
|
|
|
public void testCustomFactoryType() throws Exception { |
|
|
|
assertNull(beanFactory.getType("spring-factory")); |
|
|
|
assertNull(beanFactory.getType("spring-factory")); |
|
|
|
assertNull(System.getProperty("factory.object.type")); |
|
|
|
assertNull(System.getProperty("factory.object.type")); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testCustomStaticFactoryMethod() throws Exception { |
|
|
|
public void testCustomStaticFactoryMethod() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("custom-static-factory-method"); |
|
|
|
beanFactory.getBean("custom-static-factory-method"); |
|
|
|
@ -379,6 +394,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testCustomInstanceFactoryMethod() throws Exception { |
|
|
|
public void testCustomInstanceFactoryMethod() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("custom-factory-method"); |
|
|
|
beanFactory.getBean("custom-factory-method"); |
|
|
|
@ -388,6 +404,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testTrustedFactoryMethod() throws Exception { |
|
|
|
public void testTrustedFactoryMethod() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("privileged-static-factory-method"); |
|
|
|
beanFactory.getBean("privileged-static-factory-method"); |
|
|
|
@ -397,6 +414,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testConstructor() throws Exception { |
|
|
|
public void testConstructor() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("constructor"); |
|
|
|
beanFactory.getBean("constructor"); |
|
|
|
@ -407,10 +425,11 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testContainerPriviledges() throws Exception { |
|
|
|
public void testContainerPriviledges() throws Exception { |
|
|
|
AccessControlContext acc = provider.getAccessControlContext(); |
|
|
|
AccessControlContext acc = provider.getAccessControlContext(); |
|
|
|
|
|
|
|
|
|
|
|
AccessController.doPrivileged(new PrivilegedExceptionAction() { |
|
|
|
AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() { |
|
|
|
|
|
|
|
|
|
|
|
public Object run() throws Exception { |
|
|
|
public Object run() throws Exception { |
|
|
|
beanFactory.getBean("working-factory-method"); |
|
|
|
beanFactory.getBean("working-factory-method"); |
|
|
|
@ -420,6 +439,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
}, acc); |
|
|
|
}, acc); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testPropertyInjection() throws Exception { |
|
|
|
public void testPropertyInjection() throws Exception { |
|
|
|
try { |
|
|
|
try { |
|
|
|
beanFactory.getBean("property-injection"); |
|
|
|
beanFactory.getBean("property-injection"); |
|
|
|
@ -431,6 +451,7 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
beanFactory.getBean("working-property-injection"); |
|
|
|
beanFactory.getBean("working-property-injection"); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testInitSecurityAwarePrototypeBean() { |
|
|
|
public void testInitSecurityAwarePrototypeBean() { |
|
|
|
final DefaultListableBeanFactory lbf = new DefaultListableBeanFactory(); |
|
|
|
final DefaultListableBeanFactory lbf = new DefaultListableBeanFactory(); |
|
|
|
BeanDefinitionBuilder bdb = BeanDefinitionBuilder |
|
|
|
BeanDefinitionBuilder bdb = BeanDefinitionBuilder |
|
|
|
@ -442,15 +463,16 @@ public class CallbacksSecurityTests extends TestCase { |
|
|
|
final Subject subject = new Subject(); |
|
|
|
final Subject subject = new Subject(); |
|
|
|
subject.getPrincipals().add(new TestPrincipal("user1")); |
|
|
|
subject.getPrincipals().add(new TestPrincipal("user1")); |
|
|
|
|
|
|
|
|
|
|
|
NonPrivilegedBean bean = (NonPrivilegedBean) Subject.doAsPrivileged( |
|
|
|
NonPrivilegedBean bean = Subject.doAsPrivileged( |
|
|
|
subject, new PrivilegedAction() { |
|
|
|
subject, new PrivilegedAction<NonPrivilegedBean>() { |
|
|
|
public Object run() { |
|
|
|
public NonPrivilegedBean run() { |
|
|
|
return lbf.getBean("test"); |
|
|
|
return lbf.getBean("test", NonPrivilegedBean.class); |
|
|
|
} |
|
|
|
} |
|
|
|
}, null); |
|
|
|
}, null); |
|
|
|
assertNotNull(bean); |
|
|
|
assertNotNull(bean); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
public void testTrustedExecution() throws Exception { |
|
|
|
public void testTrustedExecution() throws Exception { |
|
|
|
beanFactory.setSecurityContextProvider(null); |
|
|
|
beanFactory.setSecurityContextProvider(null); |
|
|
|
|
|
|
|
|
|
|
|
|