/** * Provide a custom {@link AfterInvocationManager} for the default implementation of * {@link #methodSecurityInterceptor()}. The default is null if pre post is not * enabled. Otherwise, it returns a {@link AfterInvocationProviderManager}. * * <p> * Subclasses should override this method to provide a custom * {@link AfterInvocationManager} * </p> * * @return the {@link AfterInvocationManager} to use */ protected AfterInvocationManager afterInvocationManager() { if (prePostEnabled()) { AfterInvocationProviderManager invocationProviderManager = new AfterInvocationProviderManager(); ExpressionBasedPostInvocationAdvice postAdvice = new ExpressionBasedPostInvocationAdvice( getExpressionHandler()); PostInvocationAdviceProvider postInvocationAdviceProvider = new PostInvocationAdviceProvider( postAdvice); List<AfterInvocationProvider> afterInvocationProviders = new ArrayList<>(); afterInvocationProviders.add(postInvocationAdviceProvider); invocationProviderManager.setProviders(afterInvocationProviders); return invocationProviderManager; } return null; }
public void afterPropertiesSet() throws Exception { checkIfValidList(this.providers); }
@Test public void testRejectsNullProvidersList() throws Exception { AfterInvocationProviderManager manager = new AfterInvocationProviderManager(); try { manager.afterPropertiesSet(); fail("Should have thrown IllegalArgumentException"); } catch (IllegalArgumentException expected) { assertThat(true).isTrue(); } }
@Test public void testSupportsConfigAttributeIteration() throws Exception { AfterInvocationProviderManager manager = new AfterInvocationProviderManager(); List list = new Vector(); list.add(new MockAfterInvocationProvider("swap1", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP1"))); list.add(new MockAfterInvocationProvider("swap2", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP2"))); list.add(new MockAfterInvocationProvider("swap3", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP3"))); manager.setProviders(list); manager.afterPropertiesSet(); assertThat(manager.supports(new SecurityConfig("UNKNOWN_ATTRIB"))).isFalse(); assertThat(manager.supports(new SecurityConfig("GIVE_ME_SWAP2"))).isTrue(); }
@Test public void testCorrectOperation() throws Exception { AfterInvocationProviderManager manager = new AfterInvocationProviderManager(); List list = new Vector(); list.add(new MockAfterInvocationProvider("swap1", MethodInvocation.class, list.add(new MockAfterInvocationProvider("swap3", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP3"))); manager.setProviders(list); assertThat(manager.getProviders()).isEqualTo(list); manager.afterPropertiesSet(); new String[] { "NEVER_CAUSES_SWAP" }); assertThat(manager.decide(null, new SimpleMethodInvocation(), attr1, "content-before-swapping")).isEqualTo("swap1"); assertThat(manager.decide(null, new SimpleMethodInvocation(), attr2, "content-before-swapping")).isEqualTo("swap2"); assertThat(manager.decide(null, new SimpleMethodInvocation(), attr3, "content-before-swapping")).isEqualTo("swap3"); assertThat(manager.decide(null, new SimpleMethodInvocation(), attr4, "content-before-swapping")).isEqualTo("content-before-swapping"); assertThat(manager.decide(null, new SimpleMethodInvocation(), attr2and3, "content-before-swapping")).isEqualTo("swap3");
@SuppressWarnings("unchecked") @Test public void expressionVoterAndAfterInvocationProviderUseSameExpressionHandlerInstance() throws Exception { setContext("<global-method-security pre-post-annotations='enabled'/>" + AUTH_PROVIDER_XML); AffirmativeBased adm = (AffirmativeBased) appContext .getBeansOfType(AffirmativeBased.class).values().toArray()[0]; List voters = (List) FieldUtils.getFieldValue(adm, "decisionVoters"); PreInvocationAuthorizationAdviceVoter mev = (PreInvocationAuthorizationAdviceVoter) voters .get(0); MethodSecurityMetadataSourceAdvisor msi = (MethodSecurityMetadataSourceAdvisor) appContext .getBeansOfType(MethodSecurityMetadataSourceAdvisor.class).values() .toArray()[0]; AfterInvocationProviderManager pm = (AfterInvocationProviderManager) ((MethodSecurityInterceptor) msi .getAdvice()).getAfterInvocationManager(); PostInvocationAdviceProvider aip = (PostInvocationAdviceProvider) pm .getProviders().get(0); assertThat(FieldUtils.getFieldValue(mev, "preAdvice.expressionHandler")).isSameAs(FieldUtils .getFieldValue(aip, "postAdvice.expressionHandler")); }
@Test public void testSupportsSecureObjectIteration() throws Exception { AfterInvocationProviderManager manager = new AfterInvocationProviderManager(); List list = new Vector(); list.add(new MockAfterInvocationProvider("swap1", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP1"))); list.add(new MockAfterInvocationProvider("swap2", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP2"))); list.add(new MockAfterInvocationProvider("swap3", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP3"))); manager.setProviders(list); manager.afterPropertiesSet(); // assertFalse(manager.supports(FilterInvocation.class)); assertThat(manager.supports(MethodInvocation.class)).isTrue(); }
@Test public void testRejectsEmptyProvidersList() { AfterInvocationProviderManager manager = new AfterInvocationProviderManager(); List list = new Vector(); try { manager.setProviders(list); fail("Should have thrown IllegalArgumentException"); } catch (IllegalArgumentException expected) { assertThat(true).isTrue(); } }
public void afterPropertiesSet() throws Exception { checkIfValidList(this.providers); }
@Test public void testRejectsNonAfterInvocationProviders() { AfterInvocationProviderManager manager = new AfterInvocationProviderManager(); List list = new Vector(); list.add(new MockAfterInvocationProvider("swap1", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP1"))); list.add(Integer.valueOf(45)); list.add(new MockAfterInvocationProvider("swap3", MethodInvocation.class, new SecurityConfig("GIVE_ME_SWAP3"))); try { manager.setProviders(list); fail("Should have thrown IllegalArgumentException"); } catch (IllegalArgumentException expected) { assertThat(true).isTrue(); } }
public void setProviders(List<?> newList) { checkIfValidList(newList); providers = new ArrayList<>(newList.size()); for (Object currentObject : newList) { Assert.isInstanceOf(AfterInvocationProvider.class, currentObject, () -> "AfterInvocationProvider " + currentObject.getClass().getName() + " must implement AfterInvocationProvider"); providers.add((AfterInvocationProvider) currentObject); } }
private void configureForElAnnotations() { DefaultMethodSecurityExpressionHandler eh = new DefaultMethodSecurityExpressionHandler(); interceptor .setSecurityMetadataSource(new PrePostAnnotationSecurityMetadataSource( new ExpressionBasedAnnotationAttributeFactory(eh))); interceptor.setAccessDecisionManager(adm); AfterInvocationProviderManager aim = new AfterInvocationProviderManager(); aim.setProviders(Arrays.asList(new PostInvocationAdviceProvider( new ExpressionBasedPostInvocationAdvice(eh)))); interceptor.setAfterInvocationManager(aim); } }
public void setProviders(List<?> newList) { checkIfValidList(newList); providers = new ArrayList<>(newList.size()); for (Object currentObject : newList) { Assert.isInstanceOf(AfterInvocationProvider.class, currentObject, () -> "AfterInvocationProvider " + currentObject.getClass().getName() + " must implement AfterInvocationProvider"); providers.add((AfterInvocationProvider) currentObject); } }
/** * Provide a custom {@link AfterInvocationManager} for the default implementation of * {@link #methodSecurityInterceptor()}. The default is null if pre post is not * enabled. Otherwise, it returns a {@link AfterInvocationProviderManager}. * * <p> * Subclasses should override this method to provide a custom * {@link AfterInvocationManager} * </p> * * @return the {@link AfterInvocationManager} to use */ protected AfterInvocationManager afterInvocationManager() { if (prePostEnabled()) { AfterInvocationProviderManager invocationProviderManager = new AfterInvocationProviderManager(); ExpressionBasedPostInvocationAdvice postAdvice = new ExpressionBasedPostInvocationAdvice( getExpressionHandler()); PostInvocationAdviceProvider postInvocationAdviceProvider = new PostInvocationAdviceProvider( postAdvice); List<AfterInvocationProvider> afterInvocationProviders = new ArrayList<>(); afterInvocationProviders.add(postInvocationAdviceProvider); invocationProviderManager.setProviders(afterInvocationProviders); return invocationProviderManager; } return null; }
public void afterPropertiesSet() throws Exception { checkIfValidList(this.providers); }
/** * Provide a custom {@link AfterInvocationManager} for the default * implementation of {@link #methodSecurityInterceptor()}. The default is * null if pre post is not enabled. Otherwise, it returns a {@link AfterInvocationProviderManager}. * * <p> * Subclasses should override this method to provide a custom {@link AfterInvocationManager} * </p> * * @return */ protected AfterInvocationManager afterInvocationManager() { if(prePostEnabled()) { AfterInvocationProviderManager invocationProviderManager = new AfterInvocationProviderManager(); ExpressionBasedPostInvocationAdvice postAdvice = new ExpressionBasedPostInvocationAdvice(getExpressionHandler()); PostInvocationAdviceProvider postInvocationAdviceProvider = new PostInvocationAdviceProvider(postAdvice); List<AfterInvocationProvider> afterInvocationProviders = new ArrayList<AfterInvocationProvider>(); afterInvocationProviders.add(postInvocationAdviceProvider); invocationProviderManager.setProviders(afterInvocationProviders); return invocationProviderManager; } return null; }
public void afterPropertiesSet() throws Exception { checkIfValidList(this.providers); }
/** * Provide a custom {@link AfterInvocationManager} for the default * implementation of {@link #methodSecurityInterceptor()}. The default is null * if pre post is not enabled. Otherwise, it returns a * {@link AfterInvocationProviderManager}. * * <p> * Subclasses should override this method to provide a custom * {@link AfterInvocationManager} * </p> * * @return */ protected AfterInvocationManager afterInvocationManager() { if (prePostEnabled()) { AfterInvocationProviderManager invocationProviderManager = new AfterInvocationProviderManager(); ExpressionBasedPostInvocationAdvice postAdvice = new ExpressionBasedPostInvocationAdvice( getExpressionHandler()); PostInvocationAdviceProvider postInvocationAdviceProvider = new PostInvocationAdviceProvider(postAdvice); List<AfterInvocationProvider> afterInvocationProviders = new ArrayList<>(); afterInvocationProviders.add(postInvocationAdviceProvider); invocationProviderManager.setProviders(afterInvocationProviders); return invocationProviderManager; } return null; }
public void setProviders(List<?> newList) { checkIfValidList(newList); providers = new ArrayList<AfterInvocationProvider>(newList.size()); for(Object currentObject : newList) { Assert.isInstanceOf(AfterInvocationProvider.class, currentObject, "AfterInvocationProvider " + currentObject.getClass().getName() + " must implement AfterInvocationProvider"); providers.add((AfterInvocationProvider) currentObject); } }
/** * Provide a custom {@link AfterInvocationManager} for the default implementation of * {@link #methodSecurityInterceptor()}. The default is null if pre post is not * enabled. Otherwise, it returns a {@link AfterInvocationProviderManager}. * * <p> * Subclasses should override this method to provide a custom * {@link AfterInvocationManager} * </p> * * @return the {@link AfterInvocationManager} to use */ protected AfterInvocationManager afterInvocationManager() { if (prePostEnabled()) { AfterInvocationProviderManager invocationProviderManager = new AfterInvocationProviderManager(); ExpressionBasedPostInvocationAdvice postAdvice = new ExpressionBasedPostInvocationAdvice( getExpressionHandler()); PostInvocationAdviceProvider postInvocationAdviceProvider = new PostInvocationAdviceProvider( postAdvice); List<AfterInvocationProvider> afterInvocationProviders = new ArrayList<>(); afterInvocationProviders.add(postInvocationAdviceProvider); invocationProviderManager.setProviders(afterInvocationProviders); return invocationProviderManager; } return null; }