Examples with MockFilterChain org.springframework.mock.web.MockFilterChain used on opensource projects

Example 31 with MockFilterChain

use of org.springframework.mock.web.MockFilterChain in project spring-security by spring-projects.

the class HttpPathParameterStrippingTests method adminFilePatternCannotBeBypassedByAddingPathParameters.

@Test
public void adminFilePatternCannotBeBypassedByAddingPathParameters() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setServletPath("/secured/admin.html;x=user.html");
    request.setSession(createAuthenticatedSession("ROLE_USER"));
    MockHttpServletResponse response = new MockHttpServletResponse();
    fcp.doFilter(request, response, new MockFilterChain());
    assertThat(response.getStatus()).isEqualTo(403);
    // Try with pathInfo
    request = new MockHttpServletRequest();
    request.setServletPath("/secured");
    request.setPathInfo("/admin.html;x=user.html");
    request.setSession(createAuthenticatedSession("ROLE_USER"));
    response = new MockHttpServletResponse();
    fcp.doFilter(request, response, new MockFilterChain());
    assertThat(response.getStatus()).isEqualTo(403);
}

Example 32 with MockFilterChain

use of org.springframework.mock.web.MockFilterChain in project spring-security by spring-projects.

the class HttpPathParameterStrippingTests method securedFilterChainCannotBeBypassedByAddingPathParameters.

@Test
public void securedFilterChainCannotBeBypassedByAddingPathParameters() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setPathInfo("/secured;x=y/admin.html");
    request.setSession(createAuthenticatedSession("ROLE_USER"));
    MockHttpServletResponse response = new MockHttpServletResponse();
    fcp.doFilter(request, response, new MockFilterChain());
    assertThat(response.getStatus()).isEqualTo(403);
}

Example 33 with MockFilterChain

use of org.springframework.mock.web.MockFilterChain in project spring-security by spring-projects.

the class FilterChainPerformanceTests method runWithStack.

private void runWithStack(FilterChainProxy stack) throws Exception {
    for (int i = 0; i < N_INVOCATIONS; i++) {
        MockHttpServletRequest request = createRequest("/somefile.html");
        stack.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
        session = request.getSession();
    }
}

Example 34 with MockFilterChain

use of org.springframework.mock.web.MockFilterChain in project spring-security by spring-projects.

the class SessionManagementFilterTests method strategyIsNotInvokedIfSecurityContextAlreadyExistsForRequest.

@Test
public void strategyIsNotInvokedIfSecurityContextAlreadyExistsForRequest() throws Exception {
    SecurityContextRepository repo = mock(SecurityContextRepository.class);
    SessionAuthenticationStrategy strategy = mock(SessionAuthenticationStrategy.class);
    // mock that repo contains a security context
    when(repo.containsContext(any(HttpServletRequest.class))).thenReturn(true);
    SessionManagementFilter filter = new SessionManagementFilter(repo, strategy);
    HttpServletRequest request = new MockHttpServletRequest();
    authenticateUser();
    filter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
    verifyZeroInteractions(strategy);
}

Example 35 with MockFilterChain

use of org.springframework.mock.web.MockFilterChain in project spring-security by spring-projects.

the class RequestCacheAwareFilterTests method savedRequestIsRemovedAfterMatch.

@Test
public void savedRequestIsRemovedAfterMatch() throws Exception {
    RequestCacheAwareFilter filter = new RequestCacheAwareFilter();
    HttpSessionRequestCache cache = new HttpSessionRequestCache();
    MockHttpServletRequest request = new MockHttpServletRequest("POST", "/destination");
    MockHttpServletResponse response = new MockHttpServletResponse();
    cache.saveRequest(request, response);
    assertThat(request.getSession().getAttribute(HttpSessionRequestCache.SAVED_REQUEST)).isNotNull();
    filter.doFilter(request, response, new MockFilterChain());
    assertThat(request.getSession().getAttribute(HttpSessionRequestCache.SAVED_REQUEST)).isNull();
}