-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #14563 from stuartwdouglas/rr-security-fixes
Security fixes for RESTEasy Reactive
- Loading branch information
Showing
21 changed files
with
648 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 17 additions & 0 deletions
17
...untime/src/main/java/io/quarkus/resteasy/reactive/common/runtime/JaxRsSecurityConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| package io.quarkus.resteasy.reactive.common.runtime; | ||
|
|
||
| import io.quarkus.runtime.annotations.ConfigItem; | ||
| import io.quarkus.runtime.annotations.ConfigPhase; | ||
| import io.quarkus.runtime.annotations.ConfigRoot; | ||
|
|
||
| /** | ||
| * @author Michal Szynkiewicz, [email protected] | ||
| */ | ||
| @ConfigRoot(name = "security.jaxrs", phase = ConfigPhase.BUILD_AND_RUN_TIME_FIXED) | ||
| public class JaxRsSecurityConfig { | ||
| /** | ||
| * if set to true, access to all JAX-RS resources will be denied by default | ||
| */ | ||
| @ConfigItem(name = "deny-unannotated-endpoints") | ||
| public boolean denyJaxRs; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
88 changes: 88 additions & 0 deletions
88
...ent/src/test/java/io/quarkus/resteasy/reactive/server/test/security/DenyAllJaxRsTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| package io.quarkus.resteasy.reactive.server.test.security; | ||
|
|
||
| import static io.restassured.RestAssured.given; | ||
| import static io.restassured.RestAssured.when; | ||
|
|
||
| import org.jboss.shrinkwrap.api.ShrinkWrap; | ||
| import org.jboss.shrinkwrap.api.asset.StringAsset; | ||
| import org.jboss.shrinkwrap.api.spec.JavaArchive; | ||
| import org.junit.jupiter.api.BeforeAll; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.junit.jupiter.api.extension.RegisterExtension; | ||
|
|
||
| import io.quarkus.security.test.utils.TestIdentityController; | ||
| import io.quarkus.security.test.utils.TestIdentityProvider; | ||
| import io.quarkus.test.QuarkusUnitTest; | ||
|
|
||
| /** | ||
| * @author Michal Szynkiewicz, [email protected] | ||
| */ | ||
| public class DenyAllJaxRsTest { | ||
| @RegisterExtension | ||
| static QuarkusUnitTest runner = new QuarkusUnitTest() | ||
| .setArchiveProducer(() -> ShrinkWrap.create(JavaArchive.class) | ||
| .addClasses(PermitAllResource.class, UnsecuredResource.class, | ||
| TestIdentityProvider.class, | ||
| TestIdentityController.class, | ||
| UnsecuredSubResource.class) | ||
| .addAsResource(new StringAsset("quarkus.security.jaxrs.deny-unannotated-endpoints = true\n"), | ||
| "application.properties")); | ||
|
|
||
| @BeforeAll | ||
| public static void setupUsers() { | ||
| TestIdentityController.resetRoles() | ||
| .add("admin", "admin", "admin") | ||
| .add("user", "user", "user"); | ||
| } | ||
|
|
||
| @Test | ||
| public void shouldDenyUnannotated() { | ||
| String path = "/unsecured/defaultSecurity"; | ||
| assertStatus(path, 403, 401); | ||
| } | ||
|
|
||
| @Test | ||
| public void shouldDenyDenyAllMethod() { | ||
| String path = "/unsecured/denyAll"; | ||
| assertStatus(path, 403, 401); | ||
| } | ||
|
|
||
| @Test | ||
| public void shouldPermitPermitAllMethod() { | ||
| assertStatus("/unsecured/permitAll", 200, 200); | ||
| } | ||
|
|
||
| @Test | ||
| public void shouldDenySubResource() { | ||
| String path = "/unsecured/sub/subMethod"; | ||
| assertStatus(path, 403, 401); | ||
| } | ||
|
|
||
| @Test | ||
| public void shouldAllowPermitAllSubResource() { | ||
| String path = "/unsecured/permitAllSub/subMethod"; | ||
| assertStatus(path, 200, 200); | ||
| } | ||
|
|
||
| @Test | ||
| public void shouldAllowPermitAllClass() { | ||
| String path = "/permitAll/sub/subMethod"; | ||
| assertStatus(path, 200, 200); | ||
| } | ||
|
|
||
| private void assertStatus(String path, int status, int anonStatus) { | ||
| given().auth().preemptive() | ||
| .basic("admin", "admin").get(path) | ||
| .then() | ||
| .statusCode(status); | ||
| given().auth().preemptive() | ||
| .basic("user", "user").get(path) | ||
| .then() | ||
| .statusCode(status); | ||
| when().get(path) | ||
| .then() | ||
| .statusCode(anonStatus); | ||
|
|
||
| } | ||
|
|
||
| } |
53 changes: 53 additions & 0 deletions
53
.../io/quarkus/resteasy/reactive/server/test/security/LazyAuthRolesAllowedJaxRsTestCase.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| package io.quarkus.resteasy.reactive.server.test.security; | ||
|
|
||
| import static org.hamcrest.Matchers.is; | ||
|
|
||
| import org.jboss.shrinkwrap.api.ShrinkWrap; | ||
| import org.jboss.shrinkwrap.api.asset.StringAsset; | ||
| import org.jboss.shrinkwrap.api.spec.JavaArchive; | ||
| import org.junit.jupiter.api.BeforeAll; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.junit.jupiter.api.extension.RegisterExtension; | ||
|
|
||
| import io.quarkus.security.test.utils.TestIdentityController; | ||
| import io.quarkus.security.test.utils.TestIdentityProvider; | ||
| import io.quarkus.test.QuarkusUnitTest; | ||
| import io.restassured.RestAssured; | ||
|
|
||
| public class LazyAuthRolesAllowedJaxRsTestCase { | ||
| @RegisterExtension | ||
| static QuarkusUnitTest runner = new QuarkusUnitTest() | ||
| .setArchiveProducer(() -> ShrinkWrap.create(JavaArchive.class) | ||
| .addClasses(RolesAllowedResource.class, UserResource.class, | ||
| TestIdentityProvider.class, | ||
| TestIdentityController.class, | ||
| UnsecuredSubResource.class) | ||
| .addAsResource(new StringAsset("quarkus.http.auth.proactive=false\n"), | ||
| "application.properties")); | ||
|
|
||
| @BeforeAll | ||
| public static void setupUsers() { | ||
| TestIdentityController.resetRoles() | ||
| .add("admin", "admin", "admin") | ||
| .add("user", "user", "user"); | ||
| } | ||
|
|
||
| @Test | ||
| public void testRolesAllowed() { | ||
| RestAssured.get("/roles").then().statusCode(401); | ||
| RestAssured.given().auth().basic("admin", "admin").get("/roles").then().statusCode(200); | ||
| RestAssured.given().auth().basic("admin", "wrong").get("/roles").then().statusCode(401); | ||
| RestAssured.given().auth().basic("user", "user").get("/roles").then().statusCode(200); | ||
| RestAssured.given().auth().basic("admin", "admin").get("/roles/admin").then().statusCode(200); | ||
| RestAssured.given().auth().basic("user", "user").get("/roles/admin").then().statusCode(403); | ||
| } | ||
|
|
||
| @Test | ||
| public void testUser() { | ||
| RestAssured.get("/user").then().body(is("")); | ||
| RestAssured.given().auth().basic("admin", "admin").get("/user").then().body(is("")); | ||
| RestAssured.given().auth().preemptive().basic("admin", "admin").get("/user").then().body(is("")); | ||
| RestAssured.given().auth().basic("user", "user").get("/user").then().body(is("")); | ||
| RestAssured.given().auth().preemptive().basic("user", "user").get("/user").then().body(is("")); | ||
| } | ||
| } |
24 changes: 24 additions & 0 deletions
24
...nt/src/test/java/io/quarkus/resteasy/reactive/server/test/security/PermitAllResource.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| package io.quarkus.resteasy.reactive.server.test.security; | ||
|
|
||
| import javax.annotation.security.PermitAll; | ||
| import javax.ws.rs.GET; | ||
| import javax.ws.rs.Path; | ||
|
|
||
| /** | ||
| * @author Michal Szynkiewicz, [email protected] | ||
| */ | ||
| @Path("/permitAll") | ||
| @PermitAll | ||
| public class PermitAllResource { | ||
| @Path("/defaultSecurity") | ||
| @GET | ||
| public String defaultSecurity() { | ||
| return "defaultSecurity"; | ||
| } | ||
|
|
||
| @Path("/sub") | ||
| public UnsecuredSubResource sub() { | ||
| return new UnsecuredSubResource(); | ||
| } | ||
|
|
||
| } |
58 changes: 58 additions & 0 deletions
58
...teasy/reactive/server/test/security/ReplaceIdentityLazyAuthRolesAllowedJaxRsTestCase.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| package io.quarkus.resteasy.reactive.server.test.security; | ||
|
|
||
| import static org.hamcrest.Matchers.is; | ||
|
|
||
| import org.jboss.shrinkwrap.api.ShrinkWrap; | ||
| import org.jboss.shrinkwrap.api.asset.StringAsset; | ||
| import org.jboss.shrinkwrap.api.spec.JavaArchive; | ||
| import org.junit.jupiter.api.BeforeAll; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.junit.jupiter.api.extension.RegisterExtension; | ||
|
|
||
| import io.quarkus.security.test.utils.TestIdentityController; | ||
| import io.quarkus.security.test.utils.TestIdentityProvider; | ||
| import io.quarkus.test.QuarkusUnitTest; | ||
| import io.restassured.RestAssured; | ||
|
|
||
| public class ReplaceIdentityLazyAuthRolesAllowedJaxRsTestCase { | ||
| @RegisterExtension | ||
| static QuarkusUnitTest runner = new QuarkusUnitTest() | ||
| .setArchiveProducer(() -> ShrinkWrap.create(JavaArchive.class) | ||
| .addClasses(RolesAllowedResource.class, UserResource.class, | ||
| TestIdentityProvider.class, | ||
| TestIdentityController.class, | ||
| SecurityOverrideFilter.class, | ||
| UnsecuredSubResource.class) | ||
| .addAsResource(new StringAsset("quarkus.http.auth.proactive=false\n"), | ||
| "application.properties")); | ||
|
|
||
| @BeforeAll | ||
| public static void setupUsers() { | ||
| TestIdentityController.resetRoles() | ||
| .add("admin", "admin", "admin") | ||
| .add("user", "user", "user"); | ||
| } | ||
|
|
||
| @Test | ||
| public void testRolesAllowedModified() { | ||
| //make sure that things work as normal when no modification happens | ||
| RestAssured.given() | ||
| .header("user", "admin") | ||
| .header("role", "admin") | ||
| .get("/roles").then().statusCode(200); | ||
| RestAssured.given() | ||
| .auth().basic("user", "user") | ||
| .header("user", "admin") | ||
| .header("role", "admin").get("/roles/admin").then().statusCode(200); | ||
| } | ||
|
|
||
| @Test | ||
| public void testUser() { | ||
| RestAssured.given().auth().basic("user", "user") | ||
| .header("user", "admin") | ||
| .header("role", "admin").get("/user").then().body(is("admin")); | ||
| RestAssured.given().auth().preemptive().basic("user", "user") | ||
| .header("user", "admin") | ||
| .header("role", "admin").get("/user").then().body(is("admin")); | ||
| } | ||
| } |
Oops, something went wrong.