Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 2073b81

Browse files
Added sample to test uncovered methods are accessible
1 parent 207fe5b commit 2073b81

File tree

8 files changed

+226
-0
lines changed

8 files changed

+226
-0
lines changed

‎servlet/pom.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
<module>security-clientcert-jce</module>
3737
<module>security-programmatic</module>
3838
<module>security-deny-uncovered</module>
39+
<module>security-allow-uncovered</module>
3940
<module>security-annotated</module>
4041
<module>security-basicauth-omission</module>
4142
</modules>
Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<parent>
6+
<groupId>org.javaee7</groupId>
7+
<artifactId>servlet</artifactId>
8+
<version>1.0-SNAPSHOT</version>
9+
</parent>
10+
11+
<artifactId>servlet-security-allow-uncovered</artifactId>
12+
<packaging>war</packaging>
13+
14+
<name>Java EE 7 Sample: servlet - security-allow-uncovered</name>
15+
16+
<profiles>
17+
<profile>
18+
<id>payara-micro-managed</id>
19+
<build>
20+
<testResources>
21+
<testResource>
22+
<directory>src/test/resources</directory>
23+
<filtering>true</filtering>
24+
</testResource>
25+
</testResources>
26+
<plugins>
27+
<plugin>
28+
<artifactId>maven-surefire-plugin</artifactId>
29+
<configuration>
30+
<systemProperties>
31+
<payara.extraMicroOptions>--postdeploycommandfile ${project.build.directory}/test-classes/addUsersPayara.txt</payara.extraMicroOptions>
32+
</systemProperties>
33+
</configuration>
34+
</plugin>
35+
</plugins>
36+
</build>
37+
</profile>
38+
</profiles>
39+
</project>
Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package org.javaee7.servlet.security.allow.uncovered;
2+
3+
import java.io.IOException;
4+
5+
import javax.servlet.ServletException;
6+
import javax.servlet.annotation.WebServlet;
7+
import javax.servlet.http.HttpServlet;
8+
import javax.servlet.http.HttpServletRequest;
9+
import javax.servlet.http.HttpServletResponse;
10+
11+
/**
12+
* @author Arun Gupta
13+
* @author Arjan Tijms
14+
*/
15+
@WebServlet("/SecureServlet")
16+
public class SecureServlet extends HttpServlet {
17+
private static final long serialVersionUID = 1L;
18+
19+
@Override
20+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
21+
response.getWriter().print("my GET");
22+
}
23+
24+
@Override
25+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
26+
response.getWriter().print("my POST");
27+
}
28+
29+
@Override
30+
protected void doPut(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
31+
response.getWriter().print("my PUT");
32+
}
33+
}
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
3+
<glassfish-web-app error-url="">
4+
<security-role-mapping>
5+
<role-name>g1</role-name>
6+
<group-name>g1</group-name>
7+
</security-role-mapping>
8+
</glassfish-web-app>
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
5+
version="3.1">
6+
7+
8+
<!--
9+
Note that deny-uncovered-http-methods is NOT specified here, so uncovered methods have
10+
to be allowed.
11+
-->
12+
13+
<security-constraint>
14+
<web-resource-collection>
15+
<web-resource-name>SecureServlet</web-resource-name>
16+
<url-pattern>/SecureServlet</url-pattern>
17+
<http-method>GET</http-method>
18+
</web-resource-collection>
19+
<auth-constraint>
20+
<role-name>g1</role-name>
21+
</auth-constraint>
22+
</security-constraint>
23+
24+
<login-config>
25+
<auth-method>BASIC</auth-method>
26+
<realm-name>file</realm-name>
27+
</login-config>
28+
29+
<security-role>
30+
<role-name>g1</role-name>
31+
</security-role>
32+
</web-app>
Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
package org.javaee7.servlet.security.allow.uncovered;
2+
3+
import static com.gargoylesoftware.htmlunit.HttpMethod.POST;
4+
import static com.gargoylesoftware.htmlunit.HttpMethod.PUT;
5+
import static org.javaee7.ServerOperations.addUsersToContainerIdentityStore;
6+
import static org.jboss.shrinkwrap.api.ShrinkWrap.create;
7+
import static org.junit.Assert.assertEquals;
8+
import static org.junit.Assert.assertNotEquals;
9+
import static org.junit.Assert.assertTrue;
10+
11+
import java.io.File;
12+
import java.net.URL;
13+
14+
import org.jboss.arquillian.container.test.api.Deployment;
15+
import org.jboss.arquillian.junit.Arquillian;
16+
import org.jboss.arquillian.test.api.ArquillianResource;
17+
import org.jboss.shrinkwrap.api.spec.WebArchive;
18+
import org.junit.After;
19+
import org.junit.Before;
20+
import org.junit.Test;
21+
import org.junit.runner.RunWith;
22+
23+
import com.gargoylesoftware.htmlunit.DefaultCredentialsProvider;
24+
import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
25+
import com.gargoylesoftware.htmlunit.TextPage;
26+
import com.gargoylesoftware.htmlunit.WebClient;
27+
import com.gargoylesoftware.htmlunit.WebRequest;
28+
29+
/**
30+
* @author Arun Gupta
31+
* @author Arjan Tijms
32+
*/
33+
@RunWith(Arquillian.class)
34+
public class SecureServletTest {
35+
36+
@ArquillianResource
37+
private URL base;
38+
39+
DefaultCredentialsProvider correctCreds = new DefaultCredentialsProvider();
40+
DefaultCredentialsProvider incorrectCreds = new DefaultCredentialsProvider();
41+
WebClient webClient;
42+
43+
@Deployment(testable = false)
44+
public static WebArchive createDeployment() {
45+
46+
addUsersToContainerIdentityStore();
47+
48+
WebArchive war = create(WebArchive.class)
49+
.addClass(SecureServlet.class)
50+
.addAsWebInfResource((new File("src/main/webapp/WEB-INF/web.xml")));
51+
52+
System.out.println(war.toString(true));
53+
54+
return war;
55+
}
56+
57+
@Before
58+
public void setup() {
59+
correctCreds.addCredentials("u1", "p1");
60+
incorrectCreds.addCredentials("random", "random");
61+
webClient = new WebClient();
62+
}
63+
64+
@After
65+
public void tearDown() {
66+
webClient.getCookieManager().clearCookies();
67+
webClient.close();
68+
}
69+
70+
@Test
71+
public void testGetMethod() throws Exception {
72+
webClient.setCredentialsProvider(correctCreds);
73+
TextPage page = webClient.getPage(base + "/SecureServlet");
74+
assertEquals("my GET", page.getContent());
75+
}
76+
77+
@Test
78+
public void testPostMethod() throws Exception {
79+
webClient.setCredentialsProvider(correctCreds);
80+
WebRequest request = new WebRequest(new URL(base + "SecureServlet"), POST);
81+
82+
TextPage page = null;
83+
try {
84+
page = webClient.getPage(request);
85+
System.out.println(page.getContent());
86+
87+
assertTrue(
88+
"POST method could not be called even without deny-uncovered-http-methods",
89+
page.getContent().contains("my POST"));
90+
} catch (FailingHttpStatusCodeException e) {
91+
assertNotEquals("Post denied, but should be allowed", 403, e.getStatusCode());
92+
throw e;
93+
}
94+
}
95+
96+
@Test
97+
public void testPutMethod() throws Exception {
98+
webClient.setCredentialsProvider(correctCreds);
99+
WebRequest request = new WebRequest(new URL(base + "SecureServlet"), PUT);
100+
101+
TextPage page = null;
102+
try {
103+
page = webClient.getPage(request);
104+
System.out.println(page.getContent());
105+
} catch (FailingHttpStatusCodeException e) {
106+
assertNotEquals("PUT denied, but should be allowed", 403, e.getStatusCode());
107+
throw e;
108+
}
109+
110+
}
111+
}
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
create-file-user --groups g1 --passwordfile ${project.build.directory}/test-classes/password.txt u1
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
AS_ADMIN_USERPASSWORD=p1

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /