RestrictedMethodAuthorizer implements MethodInvocationAuthorizer { @Override public boolean authorize(Method method, Object target) { if (!isAllowedByDefault(method, target)) { return false; } try { authorizeRegionAccess(securityService, target); } catch (NotAuthorizedException noAuthorizedException) { return false; } return true; } RestrictedMethodAuthorizer(Cache cache); boolean isAllowedGeodeMethod(Method method, Object target); boolean isPermanentlyForbiddenMethod(Method method,
      @SuppressWarnings("unused") Object target); @Override boolean authorize(Method method, Object target); static final String UNAUTHORIZED_STRING; }
@Test public void authorizeShouldReturnFalseForNotAllowedMethods() throws Exception { TestBean testBean = new TestBean(); List<Method> dangerousMethods = new ArrayList<>(); dangerousMethods.add(TestBean.class.getMethod("getClass")); dangerousMethods.add(TestBean.class.getMethod("readResolve")); dangerousMethods.add(TestBean.class.getMethod("readObjectNoData")); dangerousMethods.add(TestBean.class.getMethod("readObject", ObjectInputStream.class)); dangerousMethods.add(TestBean.class.getMethod("writeReplace")); dangerousMethods.add(TestBean.class.getMethod("writeObject", ObjectOutputStream.class)); dangerousMethods .forEach(method -> assertThat(methodAuthorizer.authorize(method, testBean)).isFalse()); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnAnyObjectInstance() throws NoSuchMethodException { Method toStringMethod = Object.class.getMethod("toString"); Method equalsMethod = Object.class.getMethod("equals", Object.class); Method compareToMethod = Comparable.class.getMethod("compareTo", Object.class); assertThat(methodAuthorizer.authorize(toStringMethod, new Object())).isTrue(); assertThat(methodAuthorizer.authorize(equalsMethod, new Object())).isTrue(); assertThat(methodAuthorizer.authorize(compareToMethod, new Object())).isTrue(); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnBooleanInstances() throws Exception { Method booleanValueMethod = Boolean.class.getMethod("booleanValue"); assertThat(methodAuthorizer.authorize(booleanValueMethod, Boolean.TRUE)).isTrue(); verifyObjectMethods(Boolean.class, Boolean.TRUE); verifyComparableMethods(Boolean.class, Boolean.TRUE); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnNumberInstances() throws Exception { List<Number> instances = new ArrayList<>(); instances.add(new AtomicInteger(0)); instances.add(new AtomicLong(0)); instances.add(new BigDecimal("0")); instances.add(new BigInteger("0")); instances.add(new Byte("0")); instances.add(new Double("0d")); instances.add(new DoubleAccumulator(Double::sum, 0L)); instances.add(new DoubleAdder()); instances.add(new Float("1f")); instances.add(new Integer("1")); instances.add(new Long("1")); instances.add(new LongAccumulator(Long::sum, 0L)); instances.add(new LongAdder()); instances.add(new Short("1")); Method byteValueMethod = Number.class.getMethod("byteValue"); Method doubleValueMethod = Number.class.getMethod("doubleValue"); Method intValueMethod = Number.class.getMethod("intValue"); Method floatValueMethod = Number.class.getMethod("longValue"); Method longValueMethod = Number.class.getMethod("floatValue"); Method shortValueMethod = Number.class.getMethod("shortValue"); instances.forEach((number) -> { assertThat(methodAuthorizer.authorize(byteValueMethod, number)).isTrue(); assertThat(methodAuthorizer.authorize(doubleValueMethod, number)).isTrue(); assertThat(methodAuthorizer.authorize(intValueMethod, number)).isTrue(); assertThat(methodAuthorizer.authorize(floatValueMethod, number)).isTrue(); assertThat(methodAuthorizer.authorize(longValueMethod, number)).isTrue(); assertThat(methodAuthorizer.authorize(shortValueMethod, number)).isTrue(); verifyObjectMethods(number.getClass(), number); }); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnDateInstances() throws Exception { List<Date> instances = new ArrayList<>(); instances.add(new Date(0)); instances.add(new java.sql.Date(0)); instances.add(new Time(0)); instances.add(new Timestamp(0)); Method afterMethod = Date.class.getMethod("after", Date.class); Method beforeMethod = Date.class.getMethod("before", Date.class); Method getTimeMethod = Date.class.getMethod("getTime"); instances.forEach((date) -> { assertThat(methodAuthorizer.authorize(afterMethod, date)).isTrue(); assertThat(methodAuthorizer.authorize(beforeMethod, date)).isTrue(); assertThat(methodAuthorizer.authorize(getTimeMethod, date)).isTrue(); verifyObjectMethods(date.getClass(), date); verifyComparableMethods(date.getClass(), date); }); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnTimestampInstances() throws Exception { Timestamp timestamp = new Timestamp(0); Method afterMethod = Timestamp.class.getMethod("after", Date.class); Method beforeMethod = Timestamp.class.getMethod("before", Date.class); Method getNanosMethod = Timestamp.class.getMethod("getNanos"); Method getTimeMethod = Timestamp.class.getMethod("getTime"); assertThat(methodAuthorizer.authorize(afterMethod, timestamp)).isTrue(); assertThat(methodAuthorizer.authorize(beforeMethod, timestamp)).isTrue(); assertThat(methodAuthorizer.authorize(getNanosMethod, timestamp)).isTrue(); assertThat(methodAuthorizer.authorize(getTimeMethod, timestamp)).isTrue(); verifyObjectMethods(Timestamp.class, timestamp); verifyComparableMethods(Timestamp.class, timestamp); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnStringInstances() throws Exception { String string = ""; List<Method> stringMethods = new ArrayList<>(); stringMethods.add(String.class.getMethod("charAt", int.class)); stringMethods.add(String.class.getMethod("codePointAt", int.class)); stringMethods.add(String.class.getMethod("codePointBefore", int.class)); stringMethods.add(String.class.getMethod("codePointCount", int.class, int.class)); stringMethods.add(String.class.getMethod("compareToIgnoreCase", String.class)); stringMethods.add(String.class.getMethod("concat", String.class)); stringMethods.add(String.class.getMethod("contains", CharSequence.class)); stringMethods.add(String.class.getMethod("contentEquals", CharSequence.class)); stringMethods.add(String.class.getMethod("contentEquals", StringBuffer.class)); stringMethods.add(String.class.getMethod("endsWith", String.class)); stringMethods.add(String.class.getMethod("equalsIgnoreCase", String.class)); stringMethods.add(String.class.getMethod("getBytes")); stringMethods.add(String.class.getMethod("getBytes", Charset.class)); stringMethods.add(String.class.getMethod("hashCode")); stringMethods.add(String.class.getMethod("indexOf", int.class)); stringMethods.add(String.class.getMethod("indexOf", String.class)); stringMethods.add(String.class.getMethod("indexOf", String.class, int.class)); stringMethods.add(String.class.getMethod("intern")); stringMethods.add(String.class.getMethod("isEmpty")); stringMethods.add(String.class.getMethod("lastIndexOf", int.class)); stringMethods.add(String.class.getMethod("lastIndexOf", int.class, int.class)); stringMethods.add(String.class.getMethod("lastIndexOf", String.class)); stringMethods.add(String.class.getMethod("lastIndexOf", String.class, int.class)); stringMethods.add(String.class.getMethod("length")); stringMethods.add(String.class.getMethod("matches", String.class)); stringMethods.add(String.class.getMethod("offsetByCodePoints", int.class, int.class)); stringMethods.add(String.class.getMethod("regionMatches", boolean.class, int.class, String.class, int.class, int.class)); stringMethods.add( String.class.getMethod("regionMatches", int.class, String.class, int.class, int.class)); stringMethods.add(String.class.getMethod("replace", char.class, char.class)); stringMethods.add(String.class.getMethod("replace", CharSequence.class, CharSequence.class)); stringMethods.add(String.class.getMethod("replaceAll", String.class, String.class)); stringMethods.add(String.class.getMethod("replaceFirst", String.class, String.class)); stringMethods.add(String.class.getMethod("split", String.class)); stringMethods.add(String.class.getMethod("split", String.class, int.class)); stringMethods.add(String.class.getMethod("startsWith", String.class)); stringMethods.add(String.class.getMethod("startsWith", String.class, int.class)); stringMethods.add(String.class.getMethod("substring", int.class)); stringMethods.add(String.class.getMethod("substring", int.class, int.class)); stringMethods.add(String.class.getMethod("toCharArray")); stringMethods.add(String.class.getMethod("toLowerCase")); stringMethods.add(String.class.getMethod("toUpperCase")); stringMethods.add(String.class.getMethod("trim")); stringMethods .forEach(method -> assertThat(methodAuthorizer.authorize(method, string)).isTrue()); verifyObjectMethods(String.class, string); verifyComparableMethods(String.class, string); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnMapEntryInstances() throws Exception { List<Map.Entry> instances = new ArrayList<>(); instances.add(mock(Map.Entry.class)); instances.add(mock(NonTXEntry.class)); instances.add(mock(EntrySnapshot.class)); instances.add(mock(Region.Entry.class)); Method getKeyMethod = Map.Entry.class.getMethod("getKey"); Method getValueMethod = Map.Entry.class.getMethod("getValue"); instances.forEach((mapEntry) -> { assertThat(methodAuthorizer.authorize(getKeyMethod, mapEntry)).isTrue(); assertThat(methodAuthorizer.authorize(getValueMethod, mapEntry)).isTrue(); verifyObjectMethods(mapEntry.getClass(), mapEntry); }); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnMapInstances() throws Exception { Map mapInstance = mock(Map.class); List<Method> mapMethods = new ArrayList<>(); mapMethods.add(Map.class.getMethod("containsKey", Object.class)); mapMethods.add(Map.class.getMethod("entrySet")); mapMethods.add(Map.class.getMethod("get", Object.class)); mapMethods.add(Map.class.getMethod("keySet")); mapMethods.add(Map.class.getMethod("values")); mapMethods .forEach(method -> assertThat(methodAuthorizer.authorize(method, mapInstance)).isTrue()); verifyObjectMethods(mapInstance.getClass(), mapInstance); }
@Test public void authorizeShouldReturnTrueForAllowedMethodsOnQRegionInstances() throws Exception { QRegion qRegionInstance = mock(QRegion.class); DummyQRegion dummyQRegionInstance = mock(DummyQRegion.class); List<Method> methods = new ArrayList<>(); methods.add(Map.class.getMethod("containsKey", Object.class)); methods.add(Map.class.getMethod("entrySet")); methods.add(Map.class.getMethod("get", Object.class)); methods.add(Map.class.getMethod("keySet")); methods.add(Map.class.getMethod("values")); methods.add(QRegion.class.getMethod("getEntries")); methods.add(QRegion.class.getMethod("getValues")); methods.forEach(method -> { assertThat(methodAuthorizer.authorize(method, qRegionInstance)).isTrue(); assertThat(methodAuthorizer.authorize(method, dummyQRegionInstance)).isTrue(); }); verifyObjectMethods(qRegionInstance.getClass(), qRegionInstance); verifyObjectMethods(dummyQRegionInstance.getClass(), dummyQRegionInstance); }
@Test public void authorizeShouldReturnTrueForMapMethodsOnRegionInstancesWheneverTheSecurityServiceAllowsOperationsOnTheRegion() throws Exception { Region region = mock(Region.class); Region localRegion = mock(LocalRegion.class); PartitionedRegion partitionedRegion = mock(PartitionedRegion.class); List<Method> methods = new ArrayList<>(); methods.add(Map.class.getMethod("containsKey", Object.class)); methods.add(Map.class.getMethod("entrySet")); methods.add(Map.class.getMethod("get", Object.class)); methods.add(Map.class.getMethod("keySet")); methods.add(Map.class.getMethod("values")); methods.forEach(method -> { assertThat(methodAuthorizer.authorize(method, region)).isTrue(); assertThat(methodAuthorizer.authorize(method, localRegion)).isTrue(); assertThat(methodAuthorizer.authorize(method, partitionedRegion)).isTrue(); }); verifyObjectMethods(region.getClass(), region); verifyObjectMethods(localRegion.getClass(), localRegion); verifyObjectMethods(partitionedRegion.getClass(), partitionedRegion); }
@Test public void authorizeShouldReturnFalseWheneverTheSecurityServiceDoesNotAllowOperationsOnTheRegion() throws Exception { doThrow(new NotAuthorizedException("Mock Exception")).when(mockSecurityService).authorize( ResourcePermission.Resource.DATA, ResourcePermission.Operation.READ, "testRegion"); Region region = mock(Region.class); when(region.getName()).thenReturn("testRegion"); PartitionedRegion partitionedRegion = mock(PartitionedRegion.class); when(partitionedRegion.getName()).thenReturn("testRegion"); List<Method> methods = new ArrayList<>(); methods.add(Map.class.getMethod("containsKey", Object.class)); methods.add(Map.class.getMethod("entrySet")); methods.add(Map.class.getMethod("get", Object.class)); methods.add(Map.class.getMethod("keySet")); methods.add(Map.class.getMethod("values")); methods.forEach(method -> { assertThat(methodAuthorizer.authorize(method, region)).isFalse(); assertThat(methodAuthorizer.authorize(method, partitionedRegion)).isFalse(); }); }