Examples with DefaultExcludedPatternsChecker com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker used on opensource projects

Example 1 with DefaultExcludedPatternsChecker

use of com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker in project struts by apache.

the class CookieInterceptorTest method testCookiesWithClassPollution.

public void testCookiesWithClassPollution() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    String pollution1 = "model['class']['classLoader']['jarPath']";
    String pollution2 = "model.class.classLoader.jarPath";
    String pollution3 = "class.classLoader.jarPath";
    String pollution4 = "class['classLoader']['jarPath']";
    String pollution5 = "model[\"class\"]['classLoader']['jarPath']";
    String pollution6 = "class[\"classLoader\"]['jarPath']";
    request.setCookies(new Cookie(pollution1, "pollution1"), new Cookie("pollution1", pollution1), new Cookie(pollution2, "pollution2"), new Cookie("pollution2", pollution2), new Cookie(pollution3, "pollution3"), new Cookie("pollution3", pollution3), new Cookie(pollution4, "pollution4"), new Cookie("pollution4", pollution4), new Cookie(pollution5, "pollution5"), new Cookie("pollution5", pollution5), new Cookie(pollution6, "pollution6"), new Cookie("pollution6", pollution6));
    ServletActionContext.setRequest(request);
    final Map<String, Boolean> excludedName = new HashMap<String, Boolean>();
    CookieInterceptor interceptor = new CookieInterceptor() {

        @Override
        protected boolean isAcceptableName(String name) {
            boolean accepted = super.isAcceptableName(name);
            excludedName.put(name, accepted);
            return accepted;
        }
    };
    DefaultExcludedPatternsChecker excludedPatternsChecker = new DefaultExcludedPatternsChecker();
    excludedPatternsChecker.setAdditionalExcludePatterns(".*(^|\\.|\\[|'|\")class(\\.|\\[|'|\").*");
    interceptor.setExcludedPatternsChecker(excludedPatternsChecker);
    interceptor.setAcceptedPatternsChecker(new DefaultAcceptedPatternsChecker());
    interceptor.setCookiesName("*");
    MockActionInvocation invocation = new MockActionInvocation();
    invocation.setAction(new MockActionWithCookieAware());
    interceptor.intercept(invocation);
    assertFalse(excludedName.get(pollution1));
    assertFalse(excludedName.get(pollution2));
    assertFalse(excludedName.get(pollution3));
    assertFalse(excludedName.get(pollution4));
    assertFalse(excludedName.get(pollution5));
    assertFalse(excludedName.get(pollution6));
}

Example 2 with DefaultExcludedPatternsChecker

use of com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker in project struts by apache.

the class CookieInterceptorTest method testInterceptAll1.

public void testInterceptAll1() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setCookies(new Cookie("cookie1", "cookie1value"), new Cookie("cookie2", "cookie2value"), new Cookie("cookie3", "cookie3value"));
    ServletActionContext.setRequest(request);
    MockActionWithCookieAware action = new MockActionWithCookieAware();
    ActionContext.getContext().getValueStack().push(action);
    ActionInvocation invocation = (ActionInvocation) createMock(ActionInvocation.class);
    expect(invocation.getAction()).andReturn(action);
    expect(invocation.invoke()).andReturn(Action.SUCCESS);
    replay(invocation);
    CookieInterceptor interceptor = new CookieInterceptor();
    interceptor.setExcludedPatternsChecker(new DefaultExcludedPatternsChecker());
    interceptor.setAcceptedPatternsChecker(new DefaultAcceptedPatternsChecker());
    interceptor.setCookiesName("*");
    interceptor.setCookiesValue("*");
    interceptor.intercept(invocation);
    assertFalse(action.getCookiesMap().isEmpty());
    assertEquals(action.getCookiesMap().size(), 3);
    assertEquals(action.getCookiesMap().get("cookie1"), "cookie1value");
    assertEquals(action.getCookiesMap().get("cookie2"), "cookie2value");
    assertEquals(action.getCookiesMap().get("cookie3"), "cookie3value");
    assertEquals(action.getCookie1(), "cookie1value");
    assertEquals(action.getCookie2(), "cookie2value");
    assertEquals(action.getCookie3(), "cookie3value");
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie1"), "cookie1value");
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie2"), "cookie2value");
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie3"), "cookie3value");
    verify(invocation);
}

Example 3 with DefaultExcludedPatternsChecker

use of com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker in project struts by apache.

the class CookieInterceptorTest method testInterceptSelectedCookiesNameOnly2.

public void testInterceptSelectedCookiesNameOnly2() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setCookies(new Cookie("cookie1", "cookie1value"), new Cookie("cookie2", "cookie2value"), new Cookie("cookie3", "cookie3value"));
    ServletActionContext.setRequest(request);
    MockActionWithCookieAware action = new MockActionWithCookieAware();
    ActionContext.getContext().getValueStack().push(action);
    ActionInvocation invocation = (ActionInvocation) createMock(ActionInvocation.class);
    expect(invocation.getAction()).andReturn(action);
    expect(invocation.invoke()).andReturn(Action.SUCCESS);
    replay(invocation);
    CookieInterceptor interceptor = new CookieInterceptor();
    interceptor.setExcludedPatternsChecker(new DefaultExcludedPatternsChecker());
    interceptor.setAcceptedPatternsChecker(new DefaultAcceptedPatternsChecker());
    interceptor.setCookiesName("cookie1, cookie3");
    interceptor.setCookiesValue("*");
    interceptor.intercept(invocation);
    assertFalse(action.getCookiesMap().isEmpty());
    assertEquals(action.getCookiesMap().size(), 2);
    assertEquals(action.getCookiesMap().get("cookie1"), "cookie1value");
    assertEquals(action.getCookiesMap().get("cookie2"), null);
    assertEquals(action.getCookiesMap().get("cookie3"), "cookie3value");
    assertEquals(action.getCookie1(), "cookie1value");
    assertEquals(action.getCookie2(), null);
    assertEquals(action.getCookie3(), "cookie3value");
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie1"), "cookie1value");
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie2"), null);
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie3"), "cookie3value");
    verify(invocation);
}

Example 4 with DefaultExcludedPatternsChecker

use of com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker in project struts by apache.

the class CookieInterceptorTest method testInterceptSelectedCookiesNameOnly3.

public void testInterceptSelectedCookiesNameOnly3() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setCookies(new Cookie("cookie1", "cookie1value"), new Cookie("cookie2", "cookie2value"), new Cookie("cookie3", "cookie3value"));
    ServletActionContext.setRequest(request);
    MockActionWithCookieAware action = new MockActionWithCookieAware();
    ActionContext.getContext().getValueStack().push(action);
    ActionInvocation invocation = (ActionInvocation) createMock(ActionInvocation.class);
    expect(invocation.getAction()).andReturn(action);
    expect(invocation.invoke()).andReturn(Action.SUCCESS);
    replay(invocation);
    CookieInterceptor interceptor = new CookieInterceptor();
    interceptor.setExcludedPatternsChecker(new DefaultExcludedPatternsChecker());
    interceptor.setAcceptedPatternsChecker(new DefaultAcceptedPatternsChecker());
    interceptor.setCookiesName("cookie1, cookie3");
    interceptor.setCookiesValue("");
    interceptor.intercept(invocation);
    assertFalse(action.getCookiesMap().isEmpty());
    assertEquals(action.getCookiesMap().size(), 2);
    assertEquals(action.getCookiesMap().get("cookie1"), "cookie1value");
    assertEquals(action.getCookiesMap().get("cookie2"), null);
    assertEquals(action.getCookiesMap().get("cookie3"), "cookie3value");
    assertEquals(action.getCookie1(), "cookie1value");
    assertEquals(action.getCookie2(), null);
    assertEquals(action.getCookie3(), "cookie3value");
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie1"), "cookie1value");
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie2"), null);
    assertEquals(ActionContext.getContext().getValueStack().findValue("cookie3"), "cookie3value");
    verify(invocation);
}

Example 5 with DefaultExcludedPatternsChecker

use of com.opensymphony.xwork2.security.DefaultExcludedPatternsChecker in project struts by apache.

the class CookieInterceptorTest method testIntercepDefault.

public void testIntercepDefault() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setCookies(new Cookie("cookie1", "cookie1value"), new Cookie("cookie2", "cookie2value"), new Cookie("cookie3", "cookie3value"));
    ServletActionContext.setRequest(request);
    MockActionWithCookieAware action = new MockActionWithCookieAware();
    ActionContext.getContext().getValueStack().push(action);
    ActionInvocation invocation = (ActionInvocation) createMock(ActionInvocation.class);
    expect(invocation.getAction()).andReturn(action);
    expect(invocation.invoke()).andReturn(Action.SUCCESS);
    replay(invocation);
    // by default the interceptor doesn't accept any cookies
    CookieInterceptor interceptor = new CookieInterceptor();
    interceptor.setExcludedPatternsChecker(new DefaultExcludedPatternsChecker());
    interceptor.setAcceptedPatternsChecker(new DefaultAcceptedPatternsChecker());
    interceptor.intercept(invocation);
    assertTrue(action.getCookiesMap().isEmpty());
    assertNull(action.getCookie1(), null);
    assertNull(action.getCookie2(), null);
    assertNull(action.getCookie3(), null);
    assertNull(ActionContext.getContext().getValueStack().findValue("cookie1"));
    assertNull(ActionContext.getContext().getValueStack().findValue("cookie2"));
    assertNull(ActionContext.getContext().getValueStack().findValue("cookie3"));
    verify(invocation);
}