Skip to content

Commit ec5a56c

Browse files
arjantijmsarjantijms
committedMay 7, 2017
Fixed many issues in the Servlet security tests
1 parent 6daa744 commit ec5a56c

File tree

31 files changed

+355
-216
lines changed

31 files changed

+355
-216
lines changed
 

‎pom.xml

+10
Original file line numberDiff line numberDiff line change
@@ -472,6 +472,16 @@
472472
</dependency>
473473
</dependencies>
474474
<build>
475+
<plugins>
476+
<plugin>
477+
<artifactId>maven-surefire-plugin</artifactId>
478+
<configuration>
479+
<systemPropertyVariables>
480+
<javaEEServer>payara-remote</javaEEServer>
481+
</systemPropertyVariables>
482+
</configuration>
483+
</plugin>
484+
</plugins>
475485
<testResources>
476486
<testResource>
477487
<directory>src/test/resources</directory>

‎servlet/async-servlet/pom.xml

+13-13
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3-
<modelVersion>4.0.0</modelVersion>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
45

5-
<parent>
6-
<groupId>org.javaee7</groupId>
7-
<artifactId>servlet</artifactId>
8-
<version>1.0-SNAPSHOT</version>
9-
<relativePath>../pom.xml</relativePath>
10-
</parent>
11-
<groupId>org.javaee7</groupId>
12-
<artifactId>servlet-async-servlet</artifactId>
13-
<version>1.0-SNAPSHOT</version>
14-
<packaging>war</packaging>
15-
<name>Java EE 7 Sample: servlet - async-servlet</name>
6+
<parent>
7+
<groupId>org.javaee7</groupId>
8+
<artifactId>servlet</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
</parent>
11+
12+
<artifactId>servlet-async-servlet</artifactId>
13+
<packaging>war</packaging>
14+
15+
<name>Java EE 7 Sample: servlet - async-servlet</name>
1616
</project>

‎servlet/pom.xml

+10-9
Original file line numberDiff line numberDiff line change
@@ -6,34 +6,35 @@
66
<groupId>org.javaee7</groupId>
77
<artifactId>samples-parent</artifactId>
88
<version>1.0-SNAPSHOT</version>
9-
<relativePath>../pom.xml</relativePath>
109
</parent>
11-
<groupId>org.javaee7</groupId>
10+
1211
<artifactId>servlet</artifactId>
1312
<packaging>pom</packaging>
13+
1414
<name>Java EE 7 Sample: servlet</name>
1515

1616
<modules>
17-
<module>cookies</module>
17+
<module>simple-servlet</module>
1818
<module>async-servlet</module>
19+
<module>servlet-filters</module>
20+
<module>cookies</module>
1921
<module>error-mapping</module>
2022
<module>event-listeners</module>
2123
<module>metadata-complete</module>
24+
<module>web-fragment</module>
2225
<module>nonblocking</module>
2326
<module>protocol-handler</module>
2427
<module>resource-packaging</module>
25-
<module>servlet-filters</module>
2628
<module>file-upload</module>
27-
<module>web-fragment</module>
29+
<module>programmatic-registration</module>
30+
31+
<!-- Security samples assuming the container identity store -->
2832
<module>security-basicauth</module>
2933
<module>security-form-based</module>
3034
<module>security-programmatic</module>
3135
<module>security-deny-uncovered</module>
32-
<!-- <module>security-annotated</module>
33-
<module>security-digest</module>-->
36+
<module>security-annotated</module>
3437
<module>security-basicauth-omission</module>
35-
<module>programmatic-registration</module>
36-
<module>simple-servlet</module>
3738
</modules>
3839

3940
<dependencies>

‎servlet/security-annotated/pom.xml

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
33
<modelVersion>4.0.0</modelVersion>
4+
45
<parent>
5-
<groupId>org.javaee7.servlet</groupId>
6-
<artifactId>servlet-samples</artifactId>
6+
<groupId>org.javaee7</groupId>
7+
<artifactId>servlet</artifactId>
78
<version>1.0-SNAPSHOT</version>
8-
<relativePath>../pom.xml</relativePath>
99
</parent>
1010

1111
<artifactId>security-annotated</artifactId>
1212
<packaging>war</packaging>
13+
14+
<name>Java EE 7 Sample: servlet - security-annotated</name>
1315
</project>

‎servlet/security-annotated/src/main/java/org/javaee7/servlet/security/annotated/SecureServlet.java

+15-32
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,9 @@
22

33
import java.io.IOException;
44
import java.io.PrintWriter;
5-
import javax.annotation.security.RolesAllowed;
5+
66
import javax.servlet.ServletException;
77
import javax.servlet.annotation.HttpConstraint;
8-
import javax.servlet.annotation.HttpMethodConstraint;
98
import javax.servlet.annotation.ServletSecurity;
109
import javax.servlet.annotation.WebServlet;
1110
import javax.servlet.http.HttpServlet;
@@ -16,32 +15,27 @@
1615
* @author Arun Gupta
1716
*/
1817
@WebServlet("/SecureServlet")
19-
//@ServletSecurity(value = @HttpConstraint(rolesAllowed = {"g1"}),
20-
// httpMethodConstraints = {
21-
// @HttpMethodConstraint(value = "GET", rolesAllowed = {"g1"}),
22-
// @HttpMethodConstraint(value = "POST", rolesAllowed = {"g1"})
23-
// })
24-
@ServletSecurity(@HttpConstraint(rolesAllowed = { "g1" }))
25-
@RolesAllowed("g1")
18+
@ServletSecurity(@HttpConstraint(rolesAllowed = "g1"))
2619
public class SecureServlet extends HttpServlet {
2720

28-
protected void processRequest(HttpServletRequest request, HttpServletResponse response, String method)
29-
throws ServletException, IOException {
21+
private static final long serialVersionUID = 1L;
22+
23+
protected void processRequest(HttpServletRequest request, HttpServletResponse response, String method) throws ServletException, IOException {
3024
response.setContentType("text/html;charset=UTF-8");
25+
3126
PrintWriter out = response.getWriter();
3227
out.println("<!DOCTYPE html>");
3328
out.println("<html>");
34-
out.println("<head>");
35-
out.println("<title>Servlet Security Annotated - Basic Auth with File-base Realm</title>");
36-
out.println("</head>");
37-
out.println("<body>");
38-
out.println("<h1>Basic Auth with File-base Realm (" + method + ")</h1>");
39-
out.println("<h2>Were you prompted for username/password ?</h2>");
40-
out.println("</body>");
29+
out.println( "<head>");
30+
out.println( "<title>Servlet Security Annotated - Basic Auth with File-base Realm</title>");
31+
out.println( "</head>");
32+
out.println( "<body>");
33+
out.println( "<h1>Basic Auth with File-base Realm (" + method + ")</h1>");
34+
out.println( "<h2>Were you prompted for username/password ?</h2>");
35+
out.println( "</body>");
4136
out.println("</html>");
4237
}
4338

44-
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
4539
/**
4640
* Handles the HTTP <code>GET</code> method.
4741
*
@@ -51,8 +45,7 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re
5145
* @throws IOException if an I/O error occurs
5246
*/
5347
@Override
54-
protected void doGet(HttpServletRequest request, HttpServletResponse response)
55-
throws ServletException, IOException {
48+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
5649
processRequest(request, response, "GET");
5750
}
5851

@@ -65,18 +58,8 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
6558
* @throws IOException if an I/O error occurs
6659
*/
6760
@Override
68-
protected void doPost(HttpServletRequest request, HttpServletResponse response)
69-
throws ServletException, IOException {
61+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
7062
processRequest(request, response, "POST");
7163
}
7264

73-
/**
74-
* Returns a short description of the servlet.
75-
*
76-
* @return a String containing servlet description
77-
*/
78-
@Override
79-
public String getServletInfo() {
80-
return "Short description";
81-
}// </editor-fold>
8265
}

‎servlet/security-annotated/src/main/webapp/WEB-INF/glassfish-web.xml

-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@
4444
<glassfish-web-app error-url="">
4545
<security-role-mapping>
4646
<role-name>g1</role-name>
47-
<principal-name>g1</principal-name>
4847
<group-name>g1</group-name>
4948
</security-role-mapping>
5049
</glassfish-web-app>

‎servlet/security-annotated/src/test/java/org/javaee7/servlet/security/annotated/SecureServletTest.java

+41-19
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,29 @@
11
package org.javaee7.servlet.security.annotated;
22

3-
import com.gargoylesoftware.htmlunit.DefaultCredentialsProvider;
4-
import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
5-
import com.gargoylesoftware.htmlunit.WebClient;
6-
import com.gargoylesoftware.htmlunit.WebRequest;
7-
import com.gargoylesoftware.htmlunit.html.HtmlPage;
3+
import static com.gargoylesoftware.htmlunit.HttpMethod.POST;
4+
import static org.javaee7.ServerOperations.addUsersToContainerIdentityStore;
5+
import static org.jboss.shrinkwrap.api.ShrinkWrap.create;
6+
import static org.junit.Assert.assertEquals;
7+
import static org.junit.Assert.assertNotNull;
8+
import static org.junit.Assert.fail;
9+
810
import java.net.URL;
9-
import javax.ws.rs.HttpMethod;
11+
1012
import org.jboss.arquillian.container.test.api.Deployment;
1113
import org.jboss.arquillian.junit.Arquillian;
1214
import org.jboss.arquillian.test.api.ArquillianResource;
13-
import org.jboss.shrinkwrap.api.ShrinkWrap;
1415
import org.jboss.shrinkwrap.api.spec.WebArchive;
15-
import org.junit.Test;
16-
import static org.junit.Assert.*;
16+
import org.junit.After;
1717
import org.junit.Before;
18+
import org.junit.Test;
1819
import org.junit.runner.RunWith;
1920

21+
import com.gargoylesoftware.htmlunit.DefaultCredentialsProvider;
22+
import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
23+
import com.gargoylesoftware.htmlunit.WebClient;
24+
import com.gargoylesoftware.htmlunit.WebRequest;
25+
import com.gargoylesoftware.htmlunit.html.HtmlPage;
26+
2027
/**
2128
* @author Arun Gupta
2229
*/
@@ -26,15 +33,17 @@ public class SecureServletTest {
2633
@ArquillianResource
2734
private URL base;
2835

29-
DefaultCredentialsProvider correctCreds = new DefaultCredentialsProvider();
30-
DefaultCredentialsProvider incorrectCreds = new DefaultCredentialsProvider();
31-
WebClient webClient;
36+
private DefaultCredentialsProvider correctCreds = new DefaultCredentialsProvider();
37+
private DefaultCredentialsProvider incorrectCreds = new DefaultCredentialsProvider();
38+
private WebClient webClient;
3239

3340
@Deployment(testable = false)
3441
public static WebArchive createDeployment() {
35-
WebArchive war = ShrinkWrap.create(WebArchive.class).
36-
addClass(SecureServlet.class);
37-
return war;
42+
43+
addUsersToContainerIdentityStore();
44+
45+
return create(WebArchive.class)
46+
.addClass(SecureServlet.class);
3847
}
3948

4049
@Before
@@ -43,45 +52,58 @@ public void setup() {
4352
incorrectCreds.addCredentials("random", "random");
4453
webClient = new WebClient();
4554
}
55+
56+
@After
57+
public void tearDown() {
58+
webClient.getCookieManager().clearCookies();
59+
webClient.closeAllWindows();
60+
}
4661

4762
@Test
4863
public void testGetWithCorrectCredentials() throws Exception {
4964
webClient.setCredentialsProvider(correctCreds);
5065
HtmlPage page = webClient.getPage(base + "/SecureServlet");
66+
5167
assertEquals("Servlet Security Annotated - Basic Auth with File-base Realm", page.getTitleText());
5268
}
5369

5470
@Test
5571
public void testGetWithIncorrectCredentials() throws Exception {
5672
webClient.setCredentialsProvider(incorrectCreds);
73+
5774
try {
5875
webClient.getPage(base + "/SecureServlet");
5976
} catch (FailingHttpStatusCodeException e) {
6077
assertNotNull(e);
6178
assertEquals(401, e.getStatusCode());
6279
return;
6380
}
81+
6482
fail("/SecureServlet could be accessed without proper security credentials");
6583
}
6684

6785
@Test
6886
public void testPostWithCorrectCredentials() throws Exception {
6987
webClient.setCredentialsProvider(correctCreds);
70-
WebRequest request = new WebRequest(new URL(base + "SecureServlet"), HttpMethod.POST);
88+
WebRequest request = new WebRequest(new URL(base + "/SecureServlet"), POST);
7189
HtmlPage page = webClient.getPage(request);
90+
7291
assertEquals("Servlet Security Annotated - Basic Auth with File-base Realm", page.getTitleText());
7392
}
7493

7594
@Test
7695
public void testPostWithIncorrectCredentials() throws Exception {
77-
webClient.setCredentialsProvider(correctCreds);
78-
WebRequest request = new WebRequest(new URL(base + "SecureServlet"), HttpMethod.POST);
96+
webClient.setCredentialsProvider(incorrectCreds);
97+
WebRequest request = new WebRequest(new URL(base + "/SecureServlet"), POST);
98+
7999
try {
80100
webClient.getPage(request);
81101
} catch (FailingHttpStatusCodeException e) {
82102
assertNotNull(e);
83-
assertEquals(403, e.getStatusCode());
103+
assertEquals(401, e.getStatusCode());
104+
return;
84105
}
106+
85107
fail("/SecureServlet could be accessed without proper security credentials");
86108
}
87109

‎servlet/security-annotated/src/test/java/resources/password.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
AS_ADMIN_USERPASSWORD=p1

‎servlet/security-basicauth-omission/src/main/java/org/javaee7/servlet/security/basicauth/omission/SecureServlet.java

+5-5
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
package org.javaee7.servlet.security.basicauth.omission;
4141

4242
import java.io.IOException;
43-
import java.io.PrintWriter;
43+
4444
import javax.servlet.ServletException;
4545
import javax.servlet.annotation.WebServlet;
4646
import javax.servlet.http.HttpServlet;
@@ -53,15 +53,15 @@
5353
@WebServlet("/SecureServlet")
5454
public class SecureServlet extends HttpServlet {
5555

56+
private static final long serialVersionUID = 1L;
57+
5658
@Override
57-
protected void doGet(HttpServletRequest request, HttpServletResponse response)
58-
throws ServletException, IOException {
59+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
5960
response.getWriter().print("my GET");
6061
}
6162

6263
@Override
63-
protected void doPost(HttpServletRequest request, HttpServletResponse response)
64-
throws ServletException, IOException {
64+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
6565
response.getWriter().print("my POST");
6666
}
6767
}

0 commit comments

Comments
 (0)
Failed to load comments.