|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one or more |
| 3 | + * contributor license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright ownership. |
| 5 | + * The ASF licenses this file to You under the Apache License, Version 2.0 |
| 6 | + * (the "License"); you may not use this file except in compliance with |
| 7 | + * the License. You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, software |
| 12 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | + * See the License for the specific language governing permissions and |
| 15 | + * limitations under the License. |
| 16 | + */ |
| 17 | + |
| 18 | +package org.apache.spark.ui |
| 19 | + |
| 20 | +import java.util.{Base64, HashMap => JHashMap} |
| 21 | + |
| 22 | +import scala.jdk.CollectionConverters._ |
| 23 | + |
| 24 | +import jakarta.servlet.{FilterChain, FilterConfig, ServletContext} |
| 25 | +import jakarta.servlet.http.{HttpServletRequest, HttpServletResponse} |
| 26 | +import org.mockito.ArgumentMatchers.{any, eq => meq} |
| 27 | +import org.mockito.Mockito.{mock, times, verify, when} |
| 28 | + |
| 29 | +import org.apache.spark._ |
| 30 | + |
| 31 | +class JWSFilterSuite extends SparkFunSuite { |
| 32 | + // {"alg":"HS256","typ":"JWT"} => eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9, {} => e30 |
| 33 | + private val TOKEN = |
| 34 | + "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.4EKWlOkobpaAPR0J4BE0cPQ-ZD1tRQKLZp1vtE7upPw" |
| 35 | + |
| 36 | + private val TEST_KEY = Base64.getUrlEncoder.encodeToString( |
| 37 | + "Visit https://spark.apache.org to download Apache Spark.".getBytes()) |
| 38 | + |
| 39 | + test("Should fail when a parameter is missing") { |
| 40 | + val filter = new JWSFilter() |
| 41 | + val params = new JHashMap[String, String] |
| 42 | + val m = intercept[IllegalArgumentException] { |
| 43 | + filter.init(new DummyFilterConfig(params)) |
| 44 | + }.getMessage() |
| 45 | + assert(m.contains("Decode argument cannot be null")) |
| 46 | + } |
| 47 | + |
| 48 | + test("Succeed to initialize") { |
| 49 | + val filter = new JWSFilter() |
| 50 | + val params = new JHashMap[String, String] |
| 51 | + params.put("key", TEST_KEY) |
| 52 | + filter.init(new DummyFilterConfig(params)) |
| 53 | + } |
| 54 | + |
| 55 | + test("Should response with SC_FORBIDDEN when it cannot verify JWS") { |
| 56 | + val req = mockRequest() |
| 57 | + val res = mock(classOf[HttpServletResponse]) |
| 58 | + val chain = mock(classOf[FilterChain]) |
| 59 | + |
| 60 | + val filter = new JWSFilter() |
| 61 | + val params = new JHashMap[String, String] |
| 62 | + params.put("key", TEST_KEY) |
| 63 | + val conf = new DummyFilterConfig(params) |
| 64 | + filter.init(conf) |
| 65 | + |
| 66 | + // 'Authorization' header is missing |
| 67 | + filter.doFilter(req, res, chain) |
| 68 | + verify(res).sendError(meq(HttpServletResponse.SC_FORBIDDEN), |
| 69 | + meq("Authorization header is missing.")) |
| 70 | + verify(chain, times(0)).doFilter(any(), any()) |
| 71 | + |
| 72 | + // The value of Authorization field is not 'Bearer <token>' style. |
| 73 | + when(req.getHeader("Authorization")).thenReturn("Invalid") |
| 74 | + filter.doFilter(req, res, chain) |
| 75 | + verify(res).sendError(meq(HttpServletResponse.SC_FORBIDDEN), |
| 76 | + meq("Malformed Authorization header.")) |
| 77 | + verify(chain, times(0)).doFilter(any(), any()) |
| 78 | + } |
| 79 | + |
| 80 | + test("Should succeed on valid JWS") { |
| 81 | + val req = mockRequest() |
| 82 | + val res = mock(classOf[HttpServletResponse]) |
| 83 | + val chain = mock(classOf[FilterChain]) |
| 84 | + |
| 85 | + val filter = new JWSFilter() |
| 86 | + val params = new JHashMap[String, String] |
| 87 | + params.put("key", TEST_KEY) |
| 88 | + val conf = new DummyFilterConfig(params) |
| 89 | + filter.init(conf) |
| 90 | + |
| 91 | + when(req.getHeader("Authorization")).thenReturn(s"Bearer $TOKEN") |
| 92 | + filter.doFilter(req, res, chain) |
| 93 | + verify(chain, times(1)).doFilter(any(), any()) |
| 94 | + } |
| 95 | + |
| 96 | + private def mockRequest(params: Map[String, Array[String]] = Map()): HttpServletRequest = { |
| 97 | + val req = mock(classOf[HttpServletRequest]) |
| 98 | + when(req.getParameterMap()).thenReturn(params.asJava) |
| 99 | + req |
| 100 | + } |
| 101 | + |
| 102 | + class DummyFilterConfig (val map: java.util.Map[String, String]) extends FilterConfig { |
| 103 | + override def getFilterName: String = "dummy" |
| 104 | + |
| 105 | + override def getInitParameter(arg0: String): String = map.get(arg0) |
| 106 | + |
| 107 | + override def getInitParameterNames: java.util.Enumeration[String] = |
| 108 | + java.util.Collections.enumeration(map.keySet) |
| 109 | + |
| 110 | + override def getServletContext: ServletContext = null |
| 111 | + } |
| 112 | +} |
0 commit comments