WebUtil { public static CsrfProtectionDefinition parseXmlCsrfProtectionDefinition( Element csrfProtectionElem ) { List<RequestMatcherDefinition> requestMatchers = new ArrayList<>(); for ( Node csrfRequestMatcherNode : csrfProtectionElem.selectNodes( "request-matcher" ) ) { requestMatchers.add( getCsrfRequestMatcher( (Element) csrfRequestMatcherNode ) ); } if ( requestMatchers.size() == 0 ) { return null; } CsrfProtectionDefinition protectionDefinition = new CsrfProtectionDefinition(); protectionDefinition.setProtectedRequestMatchers( requestMatchers ); return protectionDefinition; }  static void setCorsResponseHeaders( HttpServletRequest request, HttpServletResponse response ); static void setCorsResponseHeaders( HttpServletRequest request, HttpServletResponse response,
                                             Map<String, List<String>> corsHeadersConfiguration ); static CsrfProtectionDefinition parseXmlCsrfProtectionDefinition( Element csrfProtectionElem ); static RequestMatcher buildCsrfRequestMatcher( Collection<CsrfProtectionDefinition> csrfProtectionDefinitions ); static final String CORS_EXPOSE_HEADERS_HEADER; }
@Test public void testParseXmlCsrfNoChildRequestMatchers() { Element csrfProtectionDefinitionElem = mock( Element.class ); when( csrfProtectionDefinitionElem.selectNodes( eq( "request-matcher" ) ) ) .thenReturn( Collections.emptyList() ); CsrfProtectionDefinition result = WebUtil.parseXmlCsrfProtectionDefinition( csrfProtectionDefinitionElem ); assertNull( result ); }
@Test public void testParseXmlCsrfOneChildRequestMatchers() { Element csrfRequestMatcherElem = mock( Element.class ); when( csrfRequestMatcherElem.attributeValue( eq( "type" ), anyString() ) ).thenReturn( "regex" ); when( csrfRequestMatcherElem.attributeValue( eq( "pattern" ), anyString() ) ).thenReturn( "abc" ); when( csrfRequestMatcherElem.attributeValue( eq( "methods" ), anyString() ) ).thenReturn( "GET,POST" ); Element csrfProtectionDefinitionElem = mock( Element.class ); when( csrfProtectionDefinitionElem.selectNodes( eq( "request-matcher" ) ) ) .thenReturn( Collections.singletonList( csrfRequestMatcherElem ) ); CsrfProtectionDefinition result = WebUtil.parseXmlCsrfProtectionDefinition( csrfProtectionDefinitionElem ); assertNotNull( result ); RequestMatcherDefinition[] requestMatchers = result.getProtectedRequestMatchers() .toArray( new RequestMatcherDefinition[0] ); assertNotNull( requestMatchers ); assertEquals( 1, requestMatchers.length ); assertEquals( "regex", requestMatchers[0].getType() ); assertEquals( "abc", requestMatchers[0].getPattern() ); assertEquals( 2, requestMatchers[0].getMethods().size() ); Assert.assertArrayEquals( new String[] { "GET", "POST" }, requestMatchers[0].getMethods().toArray() ); }
@Test public void testParseXmlCsrfTwoChildRequestMatchers() { Element csrfRequestMatcher1Elem = mock( Element.class ); when( csrfRequestMatcher1Elem.attributeValue( eq( "type" ), anyString() ) ).thenReturn( "regex" ); when( csrfRequestMatcher1Elem.attributeValue( eq( "pattern" ), anyString() ) ).thenReturn( "abc" ); when( csrfRequestMatcher1Elem.attributeValue( eq( "methods" ), anyString() ) ).thenReturn( "GET,POST" ); Element csrfRequestMatcher2Elem = mock( Element.class ); when( csrfRequestMatcher2Elem.attributeValue( eq( "type" ), anyString() ) ).thenReturn( "regex" ); when( csrfRequestMatcher2Elem.attributeValue( eq( "pattern" ), anyString() ) ).thenReturn( "abc2" ); when( csrfRequestMatcher2Elem.attributeValue( eq( "methods" ), anyString() ) ).thenReturn( "POST" ); Element csrfProtectionDefinitionElem = mock( Element.class ); when( csrfProtectionDefinitionElem.selectNodes( eq( "request-matcher" ) ) ) .thenReturn( Arrays.asList( csrfRequestMatcher1Elem, csrfRequestMatcher2Elem ) ); CsrfProtectionDefinition result = WebUtil.parseXmlCsrfProtectionDefinition( csrfProtectionDefinitionElem ); assertNotNull( result ); RequestMatcherDefinition[] requestMatchers = result.getProtectedRequestMatchers() .toArray( new RequestMatcherDefinition[ 0 ] ); assertNotNull( requestMatchers ); assertEquals( 2, requestMatchers.length ); assertEquals( "regex", requestMatchers[0].getType() ); assertEquals( "abc", requestMatchers[0].getPattern() ); assertEquals( 2, requestMatchers[0].getMethods().size() ); Assert.assertArrayEquals( new String[] { "GET", "POST" }, requestMatchers[0].getMethods().toArray() ); assertEquals( "regex", requestMatchers[1].getType() ); assertEquals( "abc2", requestMatchers[1].getPattern() ); assertEquals( 1, requestMatchers[1].getMethods().size() ); Assert.assertArrayEquals( new String[] { "POST" }, requestMatchers[1].getMethods().toArray() ); }
@Test( expected = IllegalArgumentException.class ) public void testParseXmlCsrfInvalidType() { Element csrfRequestMatcherElem = mock( Element.class ); when( csrfRequestMatcherElem.attributeValue( eq( "type" ), anyString() ) ).thenReturn( "foo" ); when( csrfRequestMatcherElem.attributeValue( eq( "pattern" ), anyString() ) ).thenReturn( "abc" ); when( csrfRequestMatcherElem.attributeValue( eq( "methods" ), anyString() ) ).thenReturn( "GET,POST" ); Element csrfProtectionDefinitionElem = mock( Element.class ); when( csrfProtectionDefinitionElem.selectNodes( eq( "request-matcher" ) ) ) .thenReturn( Collections.singletonList( csrfRequestMatcherElem ) ); WebUtil.parseXmlCsrfProtectionDefinition( csrfProtectionDefinitionElem ); }
@Test public void testParseXmlCsrfEmptyValues() { ArgumentCaptor<String> defaultTypeCapture = ArgumentCaptor.forClass( String.class ); ArgumentCaptor<String> defaultMethodsCapture = ArgumentCaptor.forClass( String.class ); Element csrfRequestMatcherElem = mock( Element.class ); when( csrfRequestMatcherElem.attributeValue( eq( "type" ), defaultTypeCapture.capture() ) ) .thenReturn( "regex" ); when( csrfRequestMatcherElem.attributeValue( eq( "pattern" ), anyString() ) ) .thenReturn( "abc" ); when( csrfRequestMatcherElem.attributeValue( eq( "methods" ), defaultMethodsCapture.capture() ) ) .thenReturn( "GET,POST" ); Element csrfProtectionDefinitionElem = mock( Element.class ); when( csrfProtectionDefinitionElem.selectNodes( eq( "request-matcher" ) ) ) .thenReturn( Collections.singletonList( csrfRequestMatcherElem ) ); WebUtil.parseXmlCsrfProtectionDefinition( csrfProtectionDefinitionElem ); assertEquals( "regex", defaultTypeCapture.getValue() ); assertEquals( "GET,POST", defaultMethodsCapture.getValue() ); }
@Test( expected = IllegalArgumentException.class ) public void testParseXmlCsrfEmptyPattern() { Element csrfRequestMatcherElem = mock( Element.class ); when( csrfRequestMatcherElem.attributeValue( eq( "type" ), anyString() ) ).thenReturn( "regex" ); when( csrfRequestMatcherElem.attributeValue( eq( "pattern" ), anyString() ) ).thenReturn( "" ); when( csrfRequestMatcherElem.attributeValue( eq( "methods" ), anyString() ) ).thenReturn( "GET,POST" ); Element csrfProtectionDefinitionElem = mock( Element.class ); when( csrfProtectionDefinitionElem.selectNodes( eq( "request-matcher" ) ) ) .thenReturn( Collections.singletonList( csrfRequestMatcherElem ) ); WebUtil.parseXmlCsrfProtectionDefinition( csrfProtectionDefinitionElem ); }
@Test( expected = IllegalArgumentException.class ) public void testParseXmlCsrfInvalidMethods() { Element csrfRequestMatcherElem = mock( Element.class ); when( csrfRequestMatcherElem.attributeValue( eq( "type" ), anyString() ) ).thenReturn( "regex" ); when( csrfRequestMatcherElem.attributeValue( eq( "pattern" ), anyString() ) ).thenReturn( "abc" ); when( csrfRequestMatcherElem.attributeValue( eq( "methods" ), anyString() ) ).thenReturn( "GET,FOO" ); Element csrfProtectionDefinitionElem = mock( Element.class ); when( csrfProtectionDefinitionElem.selectNodes( eq( "request-matcher" ) ) ) .thenReturn( Collections.singletonList( csrfRequestMatcherElem ) ); WebUtil.parseXmlCsrfProtectionDefinition( csrfProtectionDefinitionElem ); }