RestrictedMethodAuthorizer implements MethodInvocationAuthorizer { public boolean isAllowedGeodeMethod(Method method, Object target) { String methodName = method.getName(); Set<Class> allowedGeodeClassesForMethod = allowedGeodeMethodsPerClass.get(methodName); if (allowedGeodeClassesForMethod == null) { return false; } for (Class<?> clazz : allowedGeodeClassesForMethod) { if (clazz.isAssignableFrom(target.getClass())) { try { authorizeRegionAccess(securityService, target); return true; } catch (NotAuthorizedException noAuthorizedException) { return false; } } } return false; } RestrictedMethodAuthorizer(Cache cache); boolean isAllowedGeodeMethod(Method method, Object target); boolean isPermanentlyForbiddenMethod(Method method,
      @SuppressWarnings("unused") Object target); @Override boolean authorize(Method method, Object target); static final String UNAUTHORIZED_STRING; }
@Test public void isAllowedGeodeMethodShouldReturnFalseForNonGeodeObjectInstances() throws Exception { Map mapInstance = mock(Map.class); List<Method> mapMethods = new ArrayList<>(); mapMethods.add(Map.class.getMethod("containsKey", Object.class)); mapMethods.add(Map.class.getMethod("entrySet")); mapMethods.add(Map.class.getMethod("get", Object.class)); mapMethods.add(Map.class.getMethod("keySet")); mapMethods.add(Map.class.getMethod("values")); Map.Entry mapEntryInstance = mock(Map.Entry.class); List<Method> mapEntryMethods = new ArrayList<>(); mapEntryMethods.add(Map.Entry.class.getMethod("getKey")); mapEntryMethods.add(Map.Entry.class.getMethod("getValue")); mapMethods.forEach( method -> assertThat(methodAuthorizer.isAllowedGeodeMethod(method, mapInstance)).isFalse()); mapEntryMethods.forEach( method -> assertThat(methodAuthorizer.isAllowedGeodeMethod(method, mapEntryInstance)) .isFalse()); }
@Test public void isAllowedGeodeMethodShouldReturnFalseForGeodeObjectsThatAreNotInstanceOfRegionAndRegionEntry() throws Exception { EntryEvent entryEvent = mock(EntryEvent.class); HAContainerMap haContainerMap = mock(HAContainerMap.class); GatewayQueueEvent gatewayQueueEvent = mock(GatewayQueueEvent.class); PartitionedRegionDataStore partitionedRegionDataStore = mock(PartitionedRegionDataStore.class); List<Method> queueRegionMethods = new ArrayList<>(); queueRegionMethods.add(QRegion.class.getMethod("getEntries")); queueRegionMethods.add(QRegion.class.getMethod("getValues")); List<Method> regionEntryMethods = new ArrayList<>(); regionEntryMethods.add(Region.Entry.class.getMethod("getKey")); regionEntryMethods.add(Region.Entry.class.getMethod("getValue")); List<Method> regionMethods = new ArrayList<>(); regionMethods.add(Region.class.getMethod("containsKey", Object.class)); regionMethods.add(Region.class.getMethod("entrySet")); regionMethods.add(Region.class.getMethod("get", Object.class)); regionMethods.add(Region.class.getMethod("keySet")); regionMethods.add(Region.class.getMethod("values")); regionEntryMethods.forEach(method -> { assertThat(methodAuthorizer.isAllowedGeodeMethod(method, entryEvent)).isFalse(); assertThat(methodAuthorizer.isAllowedGeodeMethod(method, gatewayQueueEvent)).isFalse(); }); regionMethods.forEach(method -> { assertThat(methodAuthorizer.isAllowedGeodeMethod(method, haContainerMap)).isFalse(); assertThat(methodAuthorizer.isAllowedGeodeMethod(method, partitionedRegionDataStore)) .isFalse(); }); queueRegionMethods.forEach(method -> { assertThat(methodAuthorizer.isAllowedGeodeMethod(method, haContainerMap)).isFalse(); assertThat(methodAuthorizer.isAllowedGeodeMethod(method, partitionedRegionDataStore)) .isFalse(); }); }
@Test public void isAllowedGeodeMethodShouldReturnTrueForRegionEntryMethods() throws Exception { List<Region.Entry> regionEntryInstances = new ArrayList<>(); regionEntryInstances.add(mock(NonTXEntry.class)); regionEntryInstances.add(mock(Region.Entry.class)); regionEntryInstances.add(mock(EntrySnapshot.class)); Method getKeyMethod = Region.Entry.class.getMethod("getKey"); Method getValueMethod = Region.Entry.class.getMethod("getValue"); Method toStringMethod = Object.class.getMethod("toString"); Method equalsMethod = Object.class.getMethod("equals", Object.class); regionEntryInstances.forEach((regionEntry) -> { assertThat(methodAuthorizer.isAllowedGeodeMethod(getKeyMethod, regionEntry)).isTrue(); assertThat(methodAuthorizer.isAllowedGeodeMethod(getValueMethod, regionEntry)).isTrue(); assertThat(methodAuthorizer.isAllowedGeodeMethod(equalsMethod, regionEntry)).isTrue(); assertThat(methodAuthorizer.isAllowedGeodeMethod(toStringMethod, regionEntry)).isTrue(); }); }
@Test public void isAllowedGeodeMethodShouldReturnTrueForRegionMethodsOnRegionInstancesWheneverTheSecurityServiceAllowsOperationsOnTheRegion() throws Exception { Region region = mock(Region.class); LocalRegion localRegion = mock(LocalRegion.class); PartitionedRegion partitionedRegion = mock(PartitionedRegion.class); List<Method> regionMethods = new ArrayList<>(); regionMethods.add(Region.class.getMethod("containsKey", Object.class)); regionMethods.add(Region.class.getMethod("entrySet")); regionMethods.add(Region.class.getMethod("get", Object.class)); regionMethods.add(Region.class.getMethod("keySet")); regionMethods.add(Region.class.getMethod("values")); regionMethods.add(Object.class.getMethod("toString")); regionMethods.add(Object.class.getMethod("equals", Object.class)); regionMethods.forEach(method -> { assertThat(methodAuthorizer.isAllowedGeodeMethod(method, region)).isTrue(); assertThat(methodAuthorizer.isAllowedGeodeMethod(method, localRegion)).isTrue(); assertThat(methodAuthorizer.isAllowedGeodeMethod(method, partitionedRegion)).isTrue(); }); }