Fixed NullReferenceException when no SOAPAction header is provided by client.
Closes
MODIFY
soap-authorization-policy/src/main/java/io/apiman/plugins/soap_authorization_policy/SoapAuthorizationPolicy.java
soap-authorization-policy/src/main/java/io/apiman/plugins/soap_authorization_policy/SoapAuthorizationPolicy.java
@@ -31,6 +31,8 @@ import io.apiman.gateway.engine.policy.IPolicyContext;
import java.util.HashSet;
import java.util.Set;
+import org.apache.commons.lang3.StringUtils;
+
/**
* Adds authorization capabilities to apiman. This policy allows users to
* specify what roles the authenticated user must have in order to be allowed to
@@ -45,12 +47,15 @@ import java.util.Set;
*
* @author eric.wittmann@redhat.com
* @author rachel.yordan@redhat.com
+ * @author tevo.souza@hotmail.com
*/
public class SoapAuthorizationPolicy extends AbstractMappedPolicy<SoapAuthorizationConfig> {
public static final String AUTHENTICATED_USER_ROLES = "io.apiman.policies.auth::authenticated-user-roles"; //$NON-NLS-1$
public static final String HEADER_SOAP_ACTION = "SOAPAction"; //$NON-NLS-1$
+ public static final int SOAP_ACTION_NOTDEFINED = 13003;
+
public SoapAuthorizationPolicy() {
}
@@ -71,9 +76,21 @@ public class SoapAuthorizationPolicy extends AbstractMappedPolicy<SoapAuthorizat
Set<String> userRoles = context.getAttribute(AUTHENTICATED_USER_ROLES, (HashSet<String>) null);
String action = request.getHeaders().get(HEADER_SOAP_ACTION);
+ // Check if action are defined then fail with configuration error.
+ if (action == null || StringUtils.isBlank(action)) { //"SOAPAction header is not defined."
+ String msg = Messages.i18n.format("SoapAuthorizationPolicy.SOAPActionHeaderNotDefined"); //$NON-NLS-1$
+
+ PolicyFailure failure = context.getComponent(IPolicyFailureFactoryComponent.class).createFailure(
+ PolicyFailureType.Other, SOAP_ACTION_NOTDEFINED, msg );
+
+ chain.doFailure(failure);
+
+ return;
+ }
+
// If no roles are set in the context - then fail with a configuration error
if (userRoles == null) {
- String msg = Messages.i18n.format("SoapAuthorizationPolicy.MissingRoles"); //$NON-NLS-1$
+ String msg = Messages.i18n.format("SoapAuthorizationPolicy.MissingRoles"); //$NON-NLS-1$ TODO where are these defined?!
PolicyFailure failure = context.getComponent(IPolicyFailureFactoryComponent.class).createFailure(
PolicyFailureType.Other, PolicyFailureCodes.CONFIGURATION_ERROR, msg);
chain.doFailure(failure);

MODIFY
soap-authorization-policy/src/test/java/io/apiman/plugins/soap_authorization_policy/SoapAuthorizationPolicyTest.java
soap-authorization-policy/src/test/java/io/apiman/plugins/soap_authorization_policy/SoapAuthorizationPolicyTest.java
@@ -38,6 +38,7 @@ import org.junit.Test;
*
* @author rubenrm1@gmail.com
* @author rachel.yordan@redhat.com
+ * @author tevo.souza@hotmail.com
* Test the {@link SoapAuthorizationPolicy}.
*
*/
@@ -65,6 +66,28 @@ public class SoapAuthorizationPolicyTest extends ApimanPolicyTest {
Assert.assertNotNull(echo);
}
+ @Test
+ @Configuration("{\r\n" +
+ " \"rules\" : [\r\n" +
+ " { \"action\" : \"*\", \"role\" : \"role-1\" }\r\n" +
+ " ]\r\n" +
+ "}")
+ public void testNoSOAPHeader() throws Throwable {
+ HashSet<String> userRoles = new HashSet<>();
+ userRoles.add("role-1");
+
+ PolicyTestRequest request = PolicyTestRequest.build(PolicyTestRequestType.GET, "/invoices/1");
+
+ try {
+ request.contextAttribute(SoapAuthorizationPolicy.AUTHENTICATED_USER_ROLES, userRoles);
+ send(request);
+ Assert.fail("expected a failure response");
+ } catch (PolicyFailureError failure) {
+ Assert.assertNotNull(failure.getFailure());
+ Assert.assertEquals(PolicyFailureType.Other, failure.getFailure().getType());
+ }
+ }
+
@Test
@Configuration("{\r\n" +
" \"requestUnmatched\" : \"pass\"," +

Fixed NullReferenceException when no SOAPAction header is provided by client.

Closes #84