UnrestrictedMethodAuthorizer implements MethodInvocationAuthorizer { @Override public boolean authorize(Method method, Object target) { if (restrictedMethodAuthorizer.isPermanentlyForbiddenMethod(method, target)) { return false; } String packageName = target.getClass().getPackage().getName().toLowerCase(); if (!packageName.startsWith(GEODE_BASE_PACKAGE)) { return true; } return restrictedMethodAuthorizer.isAllowedGeodeMethod(method, target); } UnrestrictedMethodAuthorizer(Cache cache);  UnrestrictedMethodAuthorizer(RestrictedMethodAuthorizer restrictedMethodAuthorizer); @Override boolean authorize(Method method, Object target);  }
@Test public void authorizeShouldReturnFalseForKnownDangerousMethods() throws Exception { TestBean testBean = new TestBean(); List<Method> dangerousMethods = new ArrayList<>(); dangerousMethods.add(TestBean.class.getMethod("getClass")); dangerousMethods.add(TestBean.class.getMethod("readResolve")); dangerousMethods.add(TestBean.class.getMethod("readObjectNoData")); dangerousMethods.add(TestBean.class.getMethod("readObject", ObjectInputStream.class)); dangerousMethods.add(TestBean.class.getMethod("writeReplace")); dangerousMethods.add(TestBean.class.getMethod("writeObject", ObjectOutputStream.class)); dangerousMethods.forEach( method -> assertThat(unrestrictedMethodAuthorizer.authorize(method, testBean)).isFalse()); }
@Test public void authorizeShouldReturnTrueForNonGeodeMethodsThatAreNotFlaggedAsDangerous() throws Exception { Map<Method, Object> nonGeodeMutatorMethods = new HashMap<>(); nonGeodeMutatorMethods.put(Date.class.getMethod("setYear", int.class), mock(Date.class)); nonGeodeMutatorMethods.put(Map.class.getMethod("remove", Object.class), mock(Map.class)); nonGeodeMutatorMethods.put(Map.class.getMethod("put", Object.class, Object.class), mock(Map.class)); nonGeodeMutatorMethods.put(Map.Entry.class.getMethod("setValue", Object.class), mock(Map.Entry.class)); Map<Method, Object> nonGeodeAccessorMethods = new HashMap<>(); nonGeodeAccessorMethods.put(Date.class.getMethod("getDay"), mock(Date.class)); nonGeodeAccessorMethods.put(Map.class.getMethod("entrySet"), mock(Map.class)); nonGeodeAccessorMethods.put(Map.class.getMethod("get", Object.class), mock(Map.class)); nonGeodeAccessorMethods.put(Map.Entry.class.getMethod("getValue"), mock(Map.Entry.class)); nonGeodeMutatorMethods.forEach((method, object) -> assertThat(unrestrictedMethodAuthorizer.authorize(method, object)).isTrue()); nonGeodeAccessorMethods.forEach((method, object) -> assertThat(unrestrictedMethodAuthorizer.authorize(method, object)).isTrue()); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnQRegionInstances() throws Exception { QRegion qRegionInstance = mock(QRegion.class); DummyQRegion dummyQRegionInstance = mock(DummyQRegion.class); List<Method> methods = new ArrayList<>(); methods.add(Map.class.getMethod("containsKey", Object.class)); methods.add(Map.class.getMethod("entrySet")); methods.add(Map.class.getMethod("get", Object.class)); methods.add(Map.class.getMethod("keySet")); methods.add(Map.class.getMethod("values")); methods.add(QRegion.class.getMethod("getEntries")); methods.add(QRegion.class.getMethod("getValues")); methods.add(Object.class.getMethod("toString")); methods.add(Object.class.getMethod("equals", Object.class)); methods.forEach(method -> { assertThat(unrestrictedMethodAuthorizer.authorize(method, qRegionInstance)).isTrue(); assertThat(unrestrictedMethodAuthorizer.authorize(method, dummyQRegionInstance)).isTrue(); }); }
@Test public void authorizeShouldReturnTrueForMapMethodsOnRegionInstancesWheneverTheSecurityServiceAllowsOperationsOnTheRegion() throws Exception { Region region = mock(Region.class); Region localRegion = mock(LocalRegion.class); PartitionedRegion partitionedRegion = mock(PartitionedRegion.class); List<Method> methods = new ArrayList<>(); methods.add(Map.class.getMethod("containsKey", Object.class)); methods.add(Map.class.getMethod("entrySet")); methods.add(Map.class.getMethod("get", Object.class)); methods.add(Map.class.getMethod("keySet")); methods.add(Map.class.getMethod("values")); methods.add(Object.class.getMethod("toString")); methods.add(Object.class.getMethod("equals", Object.class)); methods.forEach(method -> { assertThat(unrestrictedMethodAuthorizer.authorize(method, region)).isTrue(); assertThat(unrestrictedMethodAuthorizer.authorize(method, localRegion)).isTrue(); assertThat(unrestrictedMethodAuthorizer.authorize(method, partitionedRegion)).isTrue(); }); }
@Test public void authorizeShouldReturnFalseWheneverTheSecurityServiceDoesNotAllowOperationsOnTheRegion() throws Exception { doThrow(new NotAuthorizedException("Mock Exception")).when(mockSecurityService).authorize( ResourcePermission.Resource.DATA, ResourcePermission.Operation.READ, "testRegion"); Region region = mock(Region.class); when(region.getName()).thenReturn("testRegion"); PartitionedRegion partitionedRegion = mock(PartitionedRegion.class); when(partitionedRegion.getName()).thenReturn("testRegion"); List<Method> methods = new ArrayList<>(); methods.add(Map.class.getMethod("containsKey", Object.class)); methods.add(Map.class.getMethod("entrySet")); methods.add(Map.class.getMethod("get", Object.class)); methods.add(Map.class.getMethod("keySet")); methods.add(Map.class.getMethod("values")); methods.forEach(method -> { assertThat(unrestrictedMethodAuthorizer.authorize(method, region)).isFalse(); assertThat(unrestrictedMethodAuthorizer.authorize(method, partitionedRegion)).isFalse(); }); }
@Test public void authorizeShouldReturnFalseForGeodeObjectsThatAreNotInstanceOfRegionAndRegionEntry() throws Exception { EntryEvent entryEvent = mock(EntryEvent.class); HAContainerMap haContainerMap = mock(HAContainerMap.class); GatewayQueueEvent gatewayQueueEvent = mock(GatewayQueueEvent.class); PartitionedRegionDataStore partitionedRegionDataStore = mock(PartitionedRegionDataStore.class); List<Method> queueRegionMethods = new ArrayList<>(); queueRegionMethods.add(QRegion.class.getMethod("getEntries")); queueRegionMethods.add(QRegion.class.getMethod("getValues")); List<Method> regionEntryMethods = new ArrayList<>(); regionEntryMethods.add(Region.Entry.class.getMethod("getKey")); regionEntryMethods.add(Region.Entry.class.getMethod("getValue")); List<Method> regionMethods = new ArrayList<>(); regionMethods.add(Region.class.getMethod("containsKey", Object.class)); regionMethods.add(Region.class.getMethod("entrySet")); regionMethods.add(Region.class.getMethod("get", Object.class)); regionMethods.add(Region.class.getMethod("keySet")); regionMethods.add(Region.class.getMethod("values")); regionEntryMethods.forEach(method -> { assertThat(unrestrictedMethodAuthorizer.authorize(method, entryEvent)).isFalse(); assertThat(unrestrictedMethodAuthorizer.authorize(method, gatewayQueueEvent)).isFalse(); }); regionMethods.forEach(method -> { assertThat(unrestrictedMethodAuthorizer.authorize(method, haContainerMap)).isFalse(); assertThat(unrestrictedMethodAuthorizer.authorize(method, partitionedRegionDataStore)) .isFalse(); }); queueRegionMethods.forEach(method -> { assertThat(unrestrictedMethodAuthorizer.authorize(method, haContainerMap)).isFalse(); assertThat(unrestrictedMethodAuthorizer.authorize(method, partitionedRegionDataStore)) .isFalse(); }); }
@Test public void authorizeShouldReturnTrueForRegionEntryMethods() throws Exception { List<Region.Entry> regionEntryInstances = new ArrayList<>(); regionEntryInstances.add(mock(NonTXEntry.class)); regionEntryInstances.add(mock(Region.Entry.class)); regionEntryInstances.add(mock(EntrySnapshot.class)); Method getKeyMethod = Region.Entry.class.getMethod("getKey"); Method getValueMethod = Region.Entry.class.getMethod("getValue"); Method toStringMethod = Object.class.getMethod("toString"); Method equalsMethod = Object.class.getMethod("equals", Object.class); regionEntryInstances.forEach((regionEntry) -> { assertThat(unrestrictedMethodAuthorizer.authorize(getKeyMethod, regionEntry)).isTrue(); assertThat(unrestrictedMethodAuthorizer.authorize(getValueMethod, regionEntry)).isTrue(); assertThat(unrestrictedMethodAuthorizer.authorize(equalsMethod, regionEntry)).isTrue(); assertThat(unrestrictedMethodAuthorizer.authorize(toStringMethod, regionEntry)).isTrue(); }); }