Return-Path: Delivered-To: apmail-geronimo-scm-archive@www.apache.org Received: (qmail 24389 invoked from network); 27 Sep 2010 05:38:48 -0000 Received: from unknown (HELO mail.apache.org) (140.211.11.3) by 140.211.11.9 with SMTP; 27 Sep 2010 05:38:48 -0000 Received: (qmail 40143 invoked by uid 500); 27 Sep 2010 05:38:47 -0000 Delivered-To: apmail-geronimo-scm-archive@geronimo.apache.org Received: (qmail 40013 invoked by uid 500); 27 Sep 2010 05:38:44 -0000 Mailing-List: contact scm-help@geronimo.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: Reply-To: dev@geronimo.apache.org List-Id: Delivered-To: mailing list scm@geronimo.apache.org Received: (qmail 40006 invoked by uid 99); 27 Sep 2010 05:38:44 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 27 Sep 2010 05:38:44 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=10.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 27 Sep 2010 05:38:42 +0000 Received: by eris.apache.org (Postfix, from userid 65534) id A9DDA2388999; Mon, 27 Sep 2010 05:38:22 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: svn commit: r1001592 - in /geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src: main/java/org/apache/geronimo/web25/deployment/security/ test/java/org/apache/geronimo/web25/deployment/security/ test/resources/security/ Date: Mon, 27 Sep 2010 05:38:22 -0000 To: scm@geronimo.apache.org From: xuhaihong@apache.org X-Mailer: svnmailer-1.0.8 Message-Id: <20100927053822.A9DDA2388999@eris.apache.org> Author: xuhaihong Date: Mon Sep 27 05:38:22 2010 New Revision: 1001592 URL: http://svn.apache.org/viewvc?rev=1001592&view=rev Log: GERONIMO-5578 WebResourcePermission must be added to the corresponding role for each distinct combination in the cross-product of url-pattern and role-name (Patch from Han Hong Fang) Added: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml (with props) Modified: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/SpecSecurityBuilder.java geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/URLPattern.java geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/java/org/apache/geronimo/web25/deployment/security/SpecSecurityParsingTest.java Modified: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/SpecSecurityBuilder.java URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/SpecSecurityBuilder.java?rev=1001592&r1=1001591&r2=1001592&view=diff ============================================================================== --- geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/SpecSecurityBuilder.java (original) +++ geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/SpecSecurityBuilder.java Mon Sep 27 05:38:22 2010 @@ -53,7 +53,7 @@ public class SpecSecurityBuilder { private final Map uncheckedResourcePatterns = new HashMap(); private final Map uncheckedUserPatterns = new HashMap(); private final Map excludedPatterns = new HashMap(); - private final Map rolesPatterns = new HashMap(); + private final Map> rolesPatterns = new HashMap>(); private final Set allSet = new HashSet(); // == allMap.values() private final Map allMap = new HashMap(); //uncheckedPatterns union excludedPatterns union rolesPatterns. // private boolean useExcluded = false; @@ -83,12 +83,19 @@ public class SpecSecurityBuilder { public void analyzeSecurityConstraints(SecurityConstraintType[] securityConstraintArray) { for (SecurityConstraintType securityConstraintType : securityConstraintArray) { - Map currentPatterns; + Map currentPatterns = null; + Set roleNames = null; if (securityConstraintType.isSetAuthConstraint()) { if (securityConstraintType.getAuthConstraint().getRoleNameArray().length == 0) { currentPatterns = excludedPatterns; } else { - currentPatterns = rolesPatterns; + roleNames = new HashSet(); + for (RoleNameType roleName : securityConstraintType.getAuthConstraint().getRoleNameArray()) { + roleNames.add(roleName.getStringValue().trim()); + } + if (roleNames.remove("*")) { + roleNames.addAll(securityRoles); + } } } else { currentPatterns = uncheckedPatterns; @@ -104,48 +111,46 @@ public class SpecSecurityBuilder { UrlPatternType[] urlPatternTypeArray = webResourceCollectionType.getUrlPatternArray(); for (UrlPatternType urlPatternType : urlPatternTypeArray) { String url = urlPatternType.getStringValue().trim(); - URLPattern pattern = currentPatterns.get(url); - if (pattern == null) { - pattern = new URLPattern(url); - currentPatterns.put(url, pattern); + if(currentPatterns == null) { + for (String roleName : roleNames) { + currentPatterns = rolesPatterns.get(roleName); + if (currentPatterns == null) { + currentPatterns = new HashMap(); + rolesPatterns.put(roleName, currentPatterns); + } + analyzeURLPattern(url, webResourceCollectionType.getHttpMethodArray(), transport, currentPatterns); + } + } else { + analyzeURLPattern(url, webResourceCollectionType.getHttpMethodArray(), transport, currentPatterns); } - URLPattern allPattern = allMap.get(url); if (allPattern == null) { allPattern = new URLPattern(url); allSet.add(allPattern); allMap.put(url, allPattern); } + analyzeURLPattern(url, webResourceCollectionType.getHttpMethodArray(), transport, allMap); + } + } + } + } - String[] httpMethodTypeArray = webResourceCollectionType.getHttpMethodArray(); - if (httpMethodTypeArray.length == 0) { - pattern.addMethod(""); - allPattern.addMethod(""); - } else { - for (String aHttpMethodTypeArray : httpMethodTypeArray) { - String method = (aHttpMethodTypeArray == null ? null : aHttpMethodTypeArray.trim()); - if (method != null) { - pattern.addMethod(method); - allPattern.addMethod(method); - } - } - } - if (currentPatterns == rolesPatterns) { - RoleNameType[] roleNameTypeArray = securityConstraintType.getAuthConstraint().getRoleNameArray(); - for (RoleNameType roleNameType : roleNameTypeArray) { - String role = roleNameType.getStringValue().trim(); - if (role.equals("*")) { - pattern.addAllRoles(securityRoles); - } else { - pattern.addRole(role); - } - } - } - - pattern.setTransport(transport); + private void analyzeURLPattern(String urlPattern, String[] httpMethods, String transport, Map currentPatterns) { + URLPattern pattern = currentPatterns.get(urlPattern); + if (pattern == null) { + pattern = new URLPattern(urlPattern); + currentPatterns.put(urlPattern, pattern); + } + if (httpMethods.length == 0) { + pattern.addMethod(""); + } else { + for (String httpMethod : httpMethods) { + if (httpMethod != null) { + pattern.addMethod(httpMethod.trim()); } } } + pattern.setTransport(transport); } public void removeExcludedDups() { @@ -153,7 +158,9 @@ public class SpecSecurityBuilder { String url = excluded.getKey(); URLPattern pattern = excluded.getValue(); removeExcluded(url, pattern, uncheckedPatterns); - removeExcluded(url, pattern, rolesPatterns); + for (Map rolePatterns : rolesPatterns.values()) { + removeExcluded(url, pattern, rolePatterns); + } } } @@ -177,21 +184,17 @@ public class SpecSecurityBuilder { policyConfiguration.addToExcludedPolicy(new WebUserDataPermission(name, actions)); } } - - for (URLPattern pattern : rolesPatterns.values()) { - String name = pattern.getQualifiedPattern(allSet); - String actions = pattern.getMethods(); - WebResourcePermission permission = new WebResourcePermission(name, actions); - - for (String roleName : pattern.getRoles()) { - policyConfiguration.addToRole(roleName, permission); + for (Map.Entry> entry : rolesPatterns.entrySet()) { + for (URLPattern pattern : entry.getValue().values()) { + String name = pattern.getQualifiedPattern(allSet); + String actions = pattern.getMethods(); + WebResourcePermission permission = new WebResourcePermission(name, actions); + policyConfiguration.addToRole(entry.getKey(), permission); + HTTPMethods methods = pattern.getHTTPMethods(); + int transportType = pattern.getTransport(); + addOrUpdatePattern(uncheckedUserPatterns, name, methods, transportType); } - HTTPMethods methods = pattern.getHTTPMethods(); - int transportType = pattern.getTransport(); - - addOrUpdatePattern(uncheckedUserPatterns, name, methods, transportType); } - for (URLPattern pattern : uncheckedPatterns.values()) { String name = pattern.getQualifiedPattern(allSet); HTTPMethods methods = pattern.getHTTPMethods(); @@ -246,8 +249,7 @@ public class SpecSecurityBuilder { policyConfiguration.addToUncheckedPolicy(new WebUserDataPermission(item.getName(), actions)); } - -// System.out.println(policyConfiguration.getAudit()); + //System.out.println(policyConfiguration.getAudit()); return policyConfiguration.getComponentPermissions(); } Modified: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/URLPattern.java URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/URLPattern.java?rev=1001592&r1=1001591&r2=1001592&view=diff ============================================================================== --- geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/URLPattern.java (original) +++ geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/main/java/org/apache/geronimo/web25/deployment/security/URLPattern.java Mon Sep 27 05:38:22 2010 @@ -38,7 +38,6 @@ public class URLPattern { private final String pattern; private final HTTPMethods httpMethods = new HTTPMethods(); private int transport; - private final HashSet roles = new HashSet(); /** * Construct an instance of the utility class for WebModuleConfiguration. @@ -176,19 +175,6 @@ public class URLPattern { return transport; } - public void addRole(String role) { - roles.add(role); - } - - public void addAllRoles(Collection collection) { - roles.addAll(collection); - } - - public HashSet getRoles() { - return roles; - } - - /** * TODO this is kinda weird without an explanation * @param obj object to compare with Modified: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/java/org/apache/geronimo/web25/deployment/security/SpecSecurityParsingTest.java URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/java/org/apache/geronimo/web25/deployment/security/SpecSecurityParsingTest.java?rev=1001592&r1=1001591&r2=1001592&view=diff ============================================================================== --- geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/java/org/apache/geronimo/web25/deployment/security/SpecSecurityParsingTest.java (original) +++ geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/java/org/apache/geronimo/web25/deployment/security/SpecSecurityParsingTest.java Mon Sep 27 05:38:22 2010 @@ -21,30 +21,17 @@ package org.apache.geronimo.web25.deployment.security; import java.net.URL; -import java.util.Collection; -import java.util.Set; -import java.util.HashSet; -import java.util.Map; -import java.util.HashMap; -import java.util.Collections; -import java.util.jar.JarFile; -import java.security.PermissionCollection; import java.security.Permission; +import java.security.PermissionCollection; import javax.security.jacc.WebResourcePermission; import javax.security.jacc.WebUserDataPermission; import junit.framework.TestCase; -import org.apache.geronimo.common.DeploymentException; -import org.apache.geronimo.deployment.ModuleIDBuilder; -import org.apache.geronimo.gbean.AbstractName; -import org.apache.geronimo.j2ee.deployment.EARContext; -import org.apache.geronimo.j2ee.deployment.Module; -import org.apache.geronimo.kernel.Naming; -import org.apache.geronimo.xbeans.javaee.WebAppType; -import org.apache.geronimo.xbeans.javaee.WebAppDocument; + import org.apache.geronimo.security.jacc.ComponentPermissions; -import org.apache.geronimo.web25.deployment.AbstractWebModuleBuilder; +import org.apache.geronimo.xbeans.javaee.WebAppDocument; +import org.apache.geronimo.xbeans.javaee.WebAppType; import org.apache.xmlbeans.XmlOptions; /** @@ -86,7 +73,7 @@ public class SpecSecurityParsingTest ext assertFalse(implies(new WebResourcePermission("/Test", ""), permissions, null)); assertFalse(implies(new WebResourcePermission("/Test", "!"), permissions, null)); } - + public void testExcludedConstraint() throws Exception { URL srcXml = classLoader.getResource("security/web3.xml"); WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options); @@ -164,6 +151,20 @@ public class SpecSecurityParsingTest ext assertTrue(implies(p, permissions, null)); } + public void testDifferentRoleDifferentHttpMethod() throws Exception { + URL srcXml = classLoader.getResource("security/web6.xml"); + WebAppDocument webAppDoc = WebAppDocument.Factory.parse(srcXml, options); + WebAppType webAppType = webAppDoc.getWebApp(); + SpecSecurityBuilder builder = new SpecSecurityBuilder(); + ComponentPermissions permissions = builder.buildSpecSecurityConfig(webAppType); + Permission p = new WebResourcePermission("/app/*", "GET"); + assertTrue(implies(p, permissions, "userGet")); + assertFalse(implies(p, permissions, "userPost")); + p = new WebResourcePermission("/app/home", "POST"); + assertTrue(implies(p, permissions, "userPost")); + assertFalse(implies(p, permissions, "userGet")); + } + private boolean implies(Permission p, ComponentPermissions permissions, String role) { PermissionCollection excluded = permissions.getExcludedPermissions(); if (excluded.implies(p)) return false; @@ -173,5 +174,4 @@ public class SpecSecurityParsingTest ext PermissionCollection rolePermissions = permissions.getRolePermissions().get(role); return rolePermissions != null && rolePermissions.implies(p); } - } Added: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml?rev=1001592&view=auto ============================================================================== --- geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml (added) +++ geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml Mon Sep 27 05:38:22 2010 @@ -0,0 +1,42 @@ + + + + + + resource1 + /app/* + /app/home + GET + + + userGet + + + + + resource2 + /app/* + /app/home + POST + + + userPost + + + \ No newline at end of file Propchange: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml ------------------------------------------------------------------------------ svn:eol-style = native Propchange: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml ------------------------------------------------------------------------------ svn:keywords = Date Revision Propchange: geronimo/server/branches/2.2/plugins/j2ee/geronimo-web-2.5-builder/src/test/resources/security/web6.xml ------------------------------------------------------------------------------ svn:mime-type = text/xml