@Test void testUriWhichContainsLotsOfForwardSlashes() throws IOException { Mockito.when(request.getRequestURI()) .thenReturn(BAR_REQUEST_WITH_SLASHES_URI); assertFalse(compositeUriAuthorizationFilter.ensureUserIsAuthorized(request, response)); Mockito.verify(fooUriAuthorizationFilter, Mockito.never()) .ensureUserIsAuthorized(request, response); Mockito.verify(barUriAuthorizationFilter) .ensureUserIsAuthorized(request, response); }
@Override protected boolean ensureUserIsAuthorized(HttpServletRequest request, HttpServletResponse response) throws IOException { try { String uri = ServletUtil.decodeUri(request); String normalizedUri = ServletUtil.removeInvalidForwardSlashes(uri); LOGGER.trace("Looking for a matching authorization filter for request to \"{}\"...", uri); LOGGER.trace("Registered authorization filters: {}", uriAuthorizationFilters); for (UriAuthorizationFilter uriAuthorizationFilter : uriAuthorizationFilters) { if (normalizedUri.matches(uriAuthorizationFilter.getUriRegex())) { return ensureUserIsAuthorized(uriAuthorizationFilter, request, response); } } LOGGER.trace("No matching authorization filter for request to \"{}\".", uri); return true; } catch (Exception e) { ResponseEntity<String> responseEntity = exceptionMapper.handleException(e); ServletUtil.send(response, responseEntity.getStatusCodeValue(), responseEntity.getBody()); return false; } }
CompositeUriAuthorizationFilter extends AuthorizationFilter { @Override protected boolean ensureUserIsAuthorized(HttpServletRequest request, HttpServletResponse response) throws IOException { try { String uri = ServletUtil.decodeUri(request); String normalizedUri = ServletUtil.removeInvalidForwardSlashes(uri); LOGGER.trace("Looking for a matching authorization filter for request to \"{}\"...", uri); LOGGER.trace("Registered authorization filters: {}", uriAuthorizationFilters); for (UriAuthorizationFilter uriAuthorizationFilter : uriAuthorizationFilters) { if (normalizedUri.matches(uriAuthorizationFilter.getUriRegex())) { return ensureUserIsAuthorized(uriAuthorizationFilter, request, response); } } LOGGER.trace("No matching authorization filter for request to \"{}\".", uri); return true; } catch (Exception e) { ResponseEntity<String> responseEntity = exceptionMapper.handleException(e); ServletUtil.send(response, responseEntity.getStatusCodeValue(), responseEntity.getBody()); return false; } } }
CompositeUriAuthorizationFilter extends AuthorizationFilter { @Override protected boolean ensureUserIsAuthorized(HttpServletRequest request, HttpServletResponse response) throws IOException { try { String uri = ServletUtil.decodeUri(request); String normalizedUri = ServletUtil.removeInvalidForwardSlashes(uri); LOGGER.trace("Looking for a matching authorization filter for request to \"{}\"...", uri); LOGGER.trace("Registered authorization filters: {}", uriAuthorizationFilters); for (UriAuthorizationFilter uriAuthorizationFilter : uriAuthorizationFilters) { if (normalizedUri.matches(uriAuthorizationFilter.getUriRegex())) { return ensureUserIsAuthorized(uriAuthorizationFilter, request, response); } } LOGGER.trace("No matching authorization filter for request to \"{}\".", uri); return true; } catch (Exception e) { ResponseEntity<String> responseEntity = exceptionMapper.handleException(e); ServletUtil.send(response, responseEntity.getStatusCodeValue(), responseEntity.getBody()); return false; } } @Inject  CompositeUriAuthorizationFilter(List<UriAuthorizationFilter> uriAuthorizationFilters, CFExceptionMapper exceptionMapper); }
CompositeUriAuthorizationFilter extends AuthorizationFilter { @Override protected boolean ensureUserIsAuthorized(HttpServletRequest request, HttpServletResponse response) throws IOException { try { String uri = ServletUtil.decodeUri(request); String normalizedUri = ServletUtil.removeInvalidForwardSlashes(uri); LOGGER.trace("Looking for a matching authorization filter for request to \"{}\"...", uri); LOGGER.trace("Registered authorization filters: {}", uriAuthorizationFilters); for (UriAuthorizationFilter uriAuthorizationFilter : uriAuthorizationFilters) { if (normalizedUri.matches(uriAuthorizationFilter.getUriRegex())) { return ensureUserIsAuthorized(uriAuthorizationFilter, request, response); } } LOGGER.trace("No matching authorization filter for request to \"{}\".", uri); return true; } catch (Exception e) { ResponseEntity<String> responseEntity = exceptionMapper.handleException(e); ServletUtil.send(response, responseEntity.getStatusCodeValue(), responseEntity.getBody()); return false; } } @Inject  CompositeUriAuthorizationFilter(List<UriAuthorizationFilter> uriAuthorizationFilters, CFExceptionMapper exceptionMapper);  }
CompositeUriAuthorizationFilter extends AuthorizationFilter { @Override protected boolean ensureUserIsAuthorized(HttpServletRequest request, HttpServletResponse response) throws IOException { try { String uri = ServletUtil.decodeUri(request); String normalizedUri = ServletUtil.removeInvalidForwardSlashes(uri); LOGGER.trace("Looking for a matching authorization filter for request to \"{}\"...", uri); LOGGER.trace("Registered authorization filters: {}", uriAuthorizationFilters); for (UriAuthorizationFilter uriAuthorizationFilter : uriAuthorizationFilters) { if (normalizedUri.matches(uriAuthorizationFilter.getUriRegex())) { return ensureUserIsAuthorized(uriAuthorizationFilter, request, response); } } LOGGER.trace("No matching authorization filter for request to \"{}\".", uri); return true; } catch (Exception e) { ResponseEntity<String> responseEntity = exceptionMapper.handleException(e); ServletUtil.send(response, responseEntity.getStatusCodeValue(), responseEntity.getBody()); return false; } } @Inject  CompositeUriAuthorizationFilter(List<UriAuthorizationFilter> uriAuthorizationFilters, CFExceptionMapper exceptionMapper);   }