-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Ensure that Security annotation are always places on non-final methods
We need security annotations to result in the creation of an interceptor which is not possible when a method is final. The solution we follow is to remove the final modifier from methods that need intercepting. Fixes: #5051
- Loading branch information
Showing
7 changed files
with
147 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
...yment/src/test/java/io/quarkus/security/test/cdi/SecurityAnnotationOnFinalMethodTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package io.quarkus.security.test.cdi; | ||
|
|
||
| import static io.quarkus.security.test.cdi.SecurityTestUtils.assertFailureFor; | ||
| import static io.quarkus.security.test.cdi.SecurityTestUtils.assertSuccess; | ||
| import static io.quarkus.security.test.utils.IdentityMock.ADMIN; | ||
| import static io.quarkus.security.test.utils.IdentityMock.ANONYMOUS; | ||
| import static io.quarkus.security.test.utils.IdentityMock.USER; | ||
|
|
||
| import javax.annotation.security.DenyAll; | ||
| import javax.annotation.security.RolesAllowed; | ||
| import javax.inject.Inject; | ||
| import javax.inject.Singleton; | ||
|
|
||
| import org.jboss.shrinkwrap.api.ShrinkWrap; | ||
| import org.jboss.shrinkwrap.api.spec.JavaArchive; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.junit.jupiter.api.extension.RegisterExtension; | ||
|
|
||
| import io.quarkus.security.ForbiddenException; | ||
| import io.quarkus.security.UnauthorizedException; | ||
| import io.quarkus.security.test.utils.AuthData; | ||
| import io.quarkus.security.test.utils.IdentityMock; | ||
| import io.quarkus.test.QuarkusUnitTest; | ||
|
|
||
| public class SecurityAnnotationOnFinalMethodTest { | ||
|
|
||
| @RegisterExtension | ||
| static final QuarkusUnitTest config = new QuarkusUnitTest() | ||
| .setArchiveProducer(() -> ShrinkWrap.create(JavaArchive.class) | ||
| .addClasses(BeanWithSecuredFinalMethod.class, IdentityMock.class, | ||
| AuthData.class, SecurityTestUtils.class)); | ||
|
|
||
| @Inject | ||
| BeanWithSecuredFinalMethod bean; | ||
|
|
||
| @Test | ||
| public void shouldRestrictAccessToSpecificRole() { | ||
| assertFailureFor(() -> bean.securedMethod(), UnauthorizedException.class, ANONYMOUS); | ||
| assertSuccess(() -> bean.securedMethod(), "accessibleForAdminOnly", ADMIN); | ||
| } | ||
|
|
||
| @Test | ||
| public void shouldFailToAccessCompletely() { | ||
| assertFailureFor(() -> bean.otherSecuredMethod("whatever"), UnauthorizedException.class, ANONYMOUS); | ||
| assertFailureFor(() -> bean.otherSecuredMethod("whatever"), ForbiddenException.class, USER, ADMIN); | ||
| } | ||
|
|
||
| @Singleton | ||
| public static class BeanWithSecuredFinalMethod { | ||
|
|
||
| @RolesAllowed("admin") | ||
| public final String securedMethod() { | ||
| return "accessibleForAdminOnly"; | ||
| } | ||
|
|
||
| @DenyAll | ||
| public final String otherSecuredMethod(String input) { | ||
| return "denied"; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
24 changes: 24 additions & 0 deletions
24
...nt-projects/arc/processor/src/main/java/io/quarkus/arc/processor/BytecodeTransformer.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| package io.quarkus.arc.processor; | ||
|
|
||
| import java.util.function.BiFunction; | ||
| import org.objectweb.asm.ClassVisitor; | ||
|
|
||
| public class BytecodeTransformer { | ||
|
|
||
| final String classToTransform; | ||
| final BiFunction<String, ClassVisitor, ClassVisitor> visitorFunction; | ||
|
|
||
| public BytecodeTransformer(String classToTransform, | ||
| BiFunction<String, ClassVisitor, ClassVisitor> visitorFunction) { | ||
| this.classToTransform = classToTransform; | ||
| this.visitorFunction = visitorFunction; | ||
| } | ||
|
|
||
| public String getClassToTransform() { | ||
| return classToTransform; | ||
| } | ||
|
|
||
| public BiFunction<String, ClassVisitor, ClassVisitor> getVisitorFunction() { | ||
| return visitorFunction; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters