@Test public void shouldIgnoreInvalidCookieValues() { HttpServletRequest mockRequest = createMock(HttpServletRequest.class); HttpServletResponse mockResponse = createMock(HttpServletResponse.class); WebSubjectContext context = new DefaultWebSubjectContext(); context.setServletRequest(mockRequest); context.setServletResponse(mockResponse); CookieRememberMeManager mgr = new CookieRememberMeManager(); Cookie[] cookies = new Cookie[]{ new Cookie(CookieRememberMeManager.DEFAULT_REMEMBER_ME_COOKIE_NAME, UUID.randomUUID().toString() + "%%ldapRealm") }; expect(mockRequest.getAttribute(ShiroHttpServletRequest.IDENTITY_REMOVED_KEY)).andReturn(null); expect(mockRequest.getContextPath()).andReturn(null); expect(mockRequest.getCookies()).andReturn(cookies); replay(mockRequest); final byte[] rememberedSerializedIdentity = mgr.getRememberedSerializedIdentity(context); assertNull("should ignore invalid cookie values", rememberedSerializedIdentity); }
protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) { if (!WebUtils.isHttp(subjectContext)) { if (log.isDebugEnabled()) { String msg = "SubjectContext argument is not an HTTP-aware instance. This is required to obtain a " + "servlet request and response in order to retrieve the rememberMe cookie. Returning " + "immediately and ignoring rememberMe operation."; log.debug(msg); } return null; } WebSubjectContext wsc = (WebSubjectContext) subjectContext; if (isIdentityRemoved(wsc)) { return null; } HttpServletRequest request = WebUtils.getHttpRequest(wsc); HttpServletResponse response = WebUtils.getHttpResponse(wsc); String base64 = getCookie().readValue(request, response); if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null; if (base64 != null) { base64 = ensurePadding(base64); if (log.isTraceEnabled()) { log.trace("Acquired Base64 encoded identity [" + base64 + "]"); } byte[] decoded; try { decoded = Base64.decode(base64); } catch (RuntimeException rtEx) { getCookie().removeFrom(request, response); log.warn("Unable to decode existing base64 encoded entity: [" + base64 + "].", rtEx); return null; } if (log.isTraceEnabled()) { log.trace("Base64 decoded byte array length: " + decoded.length + " bytes."); } return decoded; } else { return null; } }
CookieRememberMeManager extends AbstractRememberMeManager { protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) { if (!WebUtils.isHttp(subjectContext)) { if (log.isDebugEnabled()) { String msg = "SubjectContext argument is not an HTTP-aware instance. This is required to obtain a " + "servlet request and response in order to retrieve the rememberMe cookie. Returning " + "immediately and ignoring rememberMe operation."; log.debug(msg); } return null; } WebSubjectContext wsc = (WebSubjectContext) subjectContext; if (isIdentityRemoved(wsc)) { return null; } HttpServletRequest request = WebUtils.getHttpRequest(wsc); HttpServletResponse response = WebUtils.getHttpResponse(wsc); String base64 = getCookie().readValue(request, response); if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null; if (base64 != null) { base64 = ensurePadding(base64); if (log.isTraceEnabled()) { log.trace("Acquired Base64 encoded identity [" + base64 + "]"); } byte[] decoded; try { decoded = Base64.decode(base64); } catch (RuntimeException rtEx) { getCookie().removeFrom(request, response); log.warn("Unable to decode existing base64 encoded entity: [" + base64 + "].", rtEx); return null; } if (log.isTraceEnabled()) { log.trace("Base64 decoded byte array length: " + decoded.length + " bytes."); } return decoded; } else { return null; } } }
CookieRememberMeManager extends AbstractRememberMeManager { protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) { if (!WebUtils.isHttp(subjectContext)) { if (log.isDebugEnabled()) { String msg = "SubjectContext argument is not an HTTP-aware instance. This is required to obtain a " + "servlet request and response in order to retrieve the rememberMe cookie. Returning " + "immediately and ignoring rememberMe operation."; log.debug(msg); } return null; } WebSubjectContext wsc = (WebSubjectContext) subjectContext; if (isIdentityRemoved(wsc)) { return null; } HttpServletRequest request = WebUtils.getHttpRequest(wsc); HttpServletResponse response = WebUtils.getHttpResponse(wsc); String base64 = getCookie().readValue(request, response); if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null; if (base64 != null) { base64 = ensurePadding(base64); if (log.isTraceEnabled()) { log.trace("Acquired Base64 encoded identity [" + base64 + "]"); } byte[] decoded; try { decoded = Base64.decode(base64); } catch (RuntimeException rtEx) { getCookie().removeFrom(request, response); log.warn("Unable to decode existing base64 encoded entity: [" + base64 + "].", rtEx); return null; } if (log.isTraceEnabled()) { log.trace("Base64 decoded byte array length: " + decoded.length + " bytes."); } return decoded; } else { return null; } } CookieRememberMeManager(); }
CookieRememberMeManager extends AbstractRememberMeManager { protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) { if (!WebUtils.isHttp(subjectContext)) { if (log.isDebugEnabled()) { String msg = "SubjectContext argument is not an HTTP-aware instance. This is required to obtain a " + "servlet request and response in order to retrieve the rememberMe cookie. Returning " + "immediately and ignoring rememberMe operation."; log.debug(msg); } return null; } WebSubjectContext wsc = (WebSubjectContext) subjectContext; if (isIdentityRemoved(wsc)) { return null; } HttpServletRequest request = WebUtils.getHttpRequest(wsc); HttpServletResponse response = WebUtils.getHttpResponse(wsc); String base64 = getCookie().readValue(request, response); if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null; if (base64 != null) { base64 = ensurePadding(base64); if (log.isTraceEnabled()) { log.trace("Acquired Base64 encoded identity [" + base64 + "]"); } byte[] decoded; try { decoded = Base64.decode(base64); } catch (RuntimeException rtEx) { getCookie().removeFrom(request, response); log.warn("Unable to decode existing base64 encoded entity: [" + base64 + "].", rtEx); return null; } if (log.isTraceEnabled()) { log.trace("Base64 decoded byte array length: " + decoded.length + " bytes."); } return decoded; } else { return null; } } CookieRememberMeManager(); Cookie getCookie(); @SuppressWarnings({"UnusedDeclaration"}) void setCookie(Cookie cookie); void forgetIdentity(SubjectContext subjectContext); }
CookieRememberMeManager extends AbstractRememberMeManager { protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) { if (!WebUtils.isHttp(subjectContext)) { if (log.isDebugEnabled()) { String msg = "SubjectContext argument is not an HTTP-aware instance. This is required to obtain a " + "servlet request and response in order to retrieve the rememberMe cookie. Returning " + "immediately and ignoring rememberMe operation."; log.debug(msg); } return null; } WebSubjectContext wsc = (WebSubjectContext) subjectContext; if (isIdentityRemoved(wsc)) { return null; } HttpServletRequest request = WebUtils.getHttpRequest(wsc); HttpServletResponse response = WebUtils.getHttpResponse(wsc); String base64 = getCookie().readValue(request, response); if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null; if (base64 != null) { base64 = ensurePadding(base64); if (log.isTraceEnabled()) { log.trace("Acquired Base64 encoded identity [" + base64 + "]"); } byte[] decoded; try { decoded = Base64.decode(base64); } catch (RuntimeException rtEx) { getCookie().removeFrom(request, response); log.warn("Unable to decode existing base64 encoded entity: [" + base64 + "].", rtEx); return null; } if (log.isTraceEnabled()) { log.trace("Base64 decoded byte array length: " + decoded.length + " bytes."); } return decoded; } else { return null; } } CookieRememberMeManager(); Cookie getCookie(); @SuppressWarnings({"UnusedDeclaration"}) void setCookie(Cookie cookie); void forgetIdentity(SubjectContext subjectContext); static final String DEFAULT_REMEMBER_ME_COOKIE_NAME; }