Costin Leau
15 years ago
21 changed files with 1099 additions and 118 deletions
@ -0,0 +1,33 @@
@@ -0,0 +1,33 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support; |
||||
|
||||
import java.security.AccessControlContext; |
||||
|
||||
/** |
||||
* Provider of the security context of the code running inside the bean factory. |
||||
* |
||||
* @author Costin Leau |
||||
*/ |
||||
public interface SecurityContextProvider { |
||||
|
||||
/** |
||||
* Provides a security access control context relevant to a bean factory. |
||||
* |
||||
* @return bean factory security control context |
||||
*/ |
||||
AccessControlContext getAccessControlContext(); |
||||
} |
||||
@ -0,0 +1,57 @@
@@ -0,0 +1,57 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support; |
||||
|
||||
import java.security.AccessControlContext; |
||||
import java.security.AccessController; |
||||
|
||||
/** |
||||
* Simple #SecurityContextProvider implementation. |
||||
* |
||||
* @author Costin Leau |
||||
*/ |
||||
public class SimpleSecurityContextProvider implements SecurityContextProvider { |
||||
|
||||
private final AccessControlContext acc; |
||||
|
||||
/** |
||||
* Constructs a new <code>SimpleSecurityContextProvider</code> instance. |
||||
* |
||||
* The security context will be retrieved on each call from the current |
||||
* thread. |
||||
*/ |
||||
public SimpleSecurityContextProvider() { |
||||
this(null); |
||||
} |
||||
|
||||
/** |
||||
* Constructs a new <code>SimpleSecurityContextProvider</code> instance. |
||||
* |
||||
* If the given control context is null, the security context will be |
||||
* retrieved on each call from the current thread. |
||||
* |
||||
* @see AccessController#getContext() |
||||
* @param acc |
||||
* access control context (can be null) |
||||
*/ |
||||
public SimpleSecurityContextProvider(AccessControlContext acc) { |
||||
this.acc = acc; |
||||
} |
||||
|
||||
public AccessControlContext getAccessControlContext() { |
||||
return (acc == null ? AccessController.getContext() : acc); |
||||
} |
||||
} |
||||
@ -0,0 +1,223 @@
@@ -0,0 +1,223 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security; |
||||
|
||||
import java.lang.reflect.Method; |
||||
import java.net.URL; |
||||
import java.security.AccessControlContext; |
||||
import java.security.AccessController; |
||||
import java.security.Permissions; |
||||
import java.security.Policy; |
||||
import java.security.PrivilegedExceptionAction; |
||||
import java.security.ProtectionDomain; |
||||
import java.util.PropertyPermission; |
||||
|
||||
import junit.framework.TestCase; |
||||
|
||||
import org.springframework.beans.factory.BeanCreationException; |
||||
import org.springframework.beans.factory.support.AbstractBeanFactory; |
||||
import org.springframework.beans.factory.support.SecurityContextProvider; |
||||
import org.springframework.beans.factory.support.security.support.ConstructorBean; |
||||
import org.springframework.beans.factory.support.security.support.CustomCallbackBean; |
||||
import org.springframework.beans.factory.xml.XmlBeanFactory; |
||||
import org.springframework.core.io.DefaultResourceLoader; |
||||
import org.springframework.core.io.Resource; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class CallbacksSecurityTest extends TestCase { |
||||
|
||||
private XmlBeanFactory beanFactory; |
||||
private SecurityContextProvider provider; |
||||
|
||||
public CallbacksSecurityTest() { |
||||
// setup security
|
||||
if (System.getSecurityManager() == null) { |
||||
Policy policy = Policy.getPolicy(); |
||||
URL policyURL = getClass().getResource("/org/springframework/beans/factory/support/security/policy.all"); |
||||
System.setProperty("java.security.policy", policyURL.toString()); |
||||
System.setProperty("policy.allowSystemProperty", "true"); |
||||
policy.refresh(); |
||||
|
||||
System.setSecurityManager(new SecurityManager()); |
||||
} |
||||
} |
||||
|
||||
@Override |
||||
protected void setUp() throws Exception { |
||||
|
||||
final ProtectionDomain empty = new ProtectionDomain(null, new Permissions()); |
||||
|
||||
provider = new SecurityContextProvider() { |
||||
private final AccessControlContext acc = new AccessControlContext(new ProtectionDomain[] { empty }); |
||||
|
||||
public AccessControlContext getAccessControlContext() { |
||||
return acc; |
||||
} |
||||
}; |
||||
|
||||
DefaultResourceLoader drl = new DefaultResourceLoader(); |
||||
Resource config = drl.getResource("/org/springframework/beans/factory/support/security/callbacks.xml"); |
||||
beanFactory = new XmlBeanFactory(config); |
||||
|
||||
beanFactory.setSecurityContextProvider(provider); |
||||
} |
||||
|
||||
public void testSecuritySanity() throws Exception { |
||||
AccessControlContext acc = provider.getAccessControlContext(); |
||||
try { |
||||
acc.checkPermission(new PropertyPermission("*", "read")); |
||||
fail("Acc should not have any permissions"); |
||||
} catch (SecurityException se) { |
||||
// expected
|
||||
} |
||||
|
||||
final CustomCallbackBean bean = new CustomCallbackBean(); |
||||
final Method method = bean.getClass().getMethod("destroy", null); |
||||
method.setAccessible(true); |
||||
|
||||
try { |
||||
AccessController.doPrivileged(new PrivilegedExceptionAction() { |
||||
|
||||
public Object run() throws Exception { |
||||
method.invoke(bean, null); |
||||
return null; |
||||
} |
||||
}, acc); |
||||
fail("expected security exception"); |
||||
} catch (Exception ex) { |
||||
} |
||||
|
||||
final Class<ConstructorBean> cl = ConstructorBean.class; |
||||
try { |
||||
AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() { |
||||
|
||||
public Object run() throws Exception { |
||||
return cl.newInstance(); |
||||
} |
||||
}, acc); |
||||
fail("expected security exception"); |
||||
} catch (Exception ex) { |
||||
} |
||||
} |
||||
|
||||
public void testSpringInitBean() throws Exception { |
||||
try { |
||||
beanFactory.getBean("spring-init"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
assertTrue(ex.getCause() instanceof SecurityException); |
||||
} |
||||
} |
||||
|
||||
public void testCustomInitBean() throws Exception { |
||||
try { |
||||
beanFactory.getBean("custom-init"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
assertTrue(ex.getCause() instanceof SecurityException); |
||||
} |
||||
} |
||||
|
||||
public void testSpringDestroyBean() throws Exception { |
||||
beanFactory.getBean("spring-destroy"); |
||||
beanFactory.destroySingletons(); |
||||
assertNull(System.getProperty("security.destroy")); |
||||
} |
||||
|
||||
public void testCustomDestroyBean() throws Exception { |
||||
beanFactory.getBean("custom-destroy"); |
||||
beanFactory.destroySingletons(); |
||||
assertNull(System.getProperty("security.destroy")); |
||||
} |
||||
|
||||
public void testCustomFactoryObject() throws Exception { |
||||
try { |
||||
beanFactory.getBean("spring-factory"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
assertTrue(ex.getCause() instanceof SecurityException); |
||||
} |
||||
|
||||
} |
||||
|
||||
public void testCustomFactoryType() throws Exception { |
||||
assertNull(beanFactory.getType("spring-factory")); |
||||
assertNull(System.getProperty("factory.object.type")); |
||||
} |
||||
|
||||
public void testCustomStaticFactoryMethod() throws Exception { |
||||
try { |
||||
beanFactory.getBean("custom-static-factory-method"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
assertTrue(ex.getMostSpecificCause() instanceof SecurityException); |
||||
} |
||||
} |
||||
|
||||
public void testCustomInstanceFactoryMethod() throws Exception { |
||||
try { |
||||
beanFactory.getBean("custom-factory-method"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
assertTrue(ex.getMostSpecificCause() instanceof SecurityException); |
||||
} |
||||
} |
||||
|
||||
public void testTrustedFactoryMethod() throws Exception { |
||||
try { |
||||
beanFactory.getBean("trusted-factory-method"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
assertTrue(ex.getMostSpecificCause() instanceof SecurityException); |
||||
} |
||||
} |
||||
|
||||
public void testConstructor() throws Exception { |
||||
try { |
||||
beanFactory.getBean("constructor"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
// expected
|
||||
assertTrue(ex.getMostSpecificCause() instanceof SecurityException); |
||||
} |
||||
} |
||||
|
||||
public void testContainerPriviledges() throws Exception { |
||||
AccessControlContext acc = provider.getAccessControlContext(); |
||||
|
||||
AccessController.doPrivileged(new PrivilegedExceptionAction() { |
||||
|
||||
public Object run() throws Exception { |
||||
beanFactory.getBean("working-factory-method"); |
||||
beanFactory.getBean("container-execution"); |
||||
return null; |
||||
} |
||||
}, acc); |
||||
} |
||||
|
||||
public void testPropertyInjection() throws Exception { |
||||
try { |
||||
beanFactory.getBean("property-injection"); |
||||
fail("expected security exception"); |
||||
} catch (BeanCreationException ex) { |
||||
assertTrue(ex.getMessage().contains("security")); |
||||
} |
||||
|
||||
beanFactory.getBean("working-property-injection"); |
||||
} |
||||
} |
||||
@ -0,0 +1,48 @@
@@ -0,0 +1,48 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<beans xmlns="http://www.springframework.org/schema/beans" |
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||
xsi:schemaLocation=" |
||||
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd" |
||||
default-lazy-init="true"> |
||||
|
||||
<bean name="spring-init" class="org.springframework.beans.factory.support.security.support.InitBean"/> |
||||
|
||||
<bean name="spring-destroy" class="org.springframework.beans.factory.support.security.support.DestroyBean"/> |
||||
|
||||
<bean name="custom-init" class="org.springframework.beans.factory.support.security.support.CustomCallbackBean" |
||||
init-method="init"/> |
||||
|
||||
<bean name="custom-destroy" class="org.springframework.beans.factory.support.security.support.CustomCallbackBean" |
||||
destroy-method="destroy"/> |
||||
|
||||
<bean name="spring-factory" class="org.springframework.beans.factory.support.security.support.CustomFactoryBean"/> |
||||
|
||||
<bean name="custom-static-factory-method" class="org.springframework.beans.factory.support.security.support.FactoryBean" factory-method="makeStaticInstance"/> |
||||
|
||||
<bean name="factory-bean" class="org.springframework.beans.factory.support.security.support.FactoryBean"/> |
||||
|
||||
<bean name="custom-factory-method" factory-bean="factory-bean" factory-method="makeInstance"/> |
||||
|
||||
<bean name="trusted-factory-method" class="java.lang.System" factory-method="getProperties"/> |
||||
|
||||
<bean name="constructor" class="org.springframework.beans.factory.support.security.support.ConstructorBean"/> |
||||
|
||||
<bean name="working-factory-method" class="org.springframework.beans.factory.support.security.support.FactoryBean" factory-method="protectedStaticInstance"/> |
||||
|
||||
<bean name="container-execution" class="org.springframework.beans.factory.support.security.support.ConstructorBean"> |
||||
<constructor-arg ref="working-factory-method"/> |
||||
</bean> |
||||
|
||||
<bean name="property-injection" class="org.springframework.beans.factory.support.security.support.PropertyBean"> |
||||
<property name="securityProperty" value="value"/> |
||||
</bean> |
||||
|
||||
<bean name="working-property-injection" class="org.springframework.beans.factory.support.security.support.PropertyBean"> |
||||
<property name="property"> |
||||
<array> |
||||
<ref bean="working-factory-method"/> |
||||
</array> |
||||
</property> |
||||
</bean> |
||||
|
||||
</beans> |
||||
@ -0,0 +1,3 @@
@@ -0,0 +1,3 @@
|
||||
grant { |
||||
permission java.security.AllPermission; |
||||
}; |
||||
@ -0,0 +1,30 @@
@@ -0,0 +1,30 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security.support; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class ConstructorBean { |
||||
|
||||
public ConstructorBean() { |
||||
System.getProperties(); |
||||
} |
||||
|
||||
public ConstructorBean(Object obj) { |
||||
System.out.println("Received object " + obj); |
||||
} |
||||
} |
||||
@ -0,0 +1,30 @@
@@ -0,0 +1,30 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security.support; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class CustomCallbackBean { |
||||
|
||||
public void init() { |
||||
System.getProperties(); |
||||
} |
||||
|
||||
public void destroy() { |
||||
System.setProperty("security.destroy", "true"); |
||||
} |
||||
} |
||||
@ -0,0 +1,39 @@
@@ -0,0 +1,39 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security.support; |
||||
|
||||
import java.util.Properties; |
||||
|
||||
import org.springframework.beans.factory.FactoryBean; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class CustomFactoryBean implements FactoryBean<Object> { |
||||
|
||||
public Object getObject() throws Exception { |
||||
return System.getProperties(); |
||||
} |
||||
|
||||
public Class getObjectType() { |
||||
System.setProperty("factory.object.type", "true"); |
||||
return Properties.class; |
||||
} |
||||
|
||||
public boolean isSingleton() { |
||||
return true; |
||||
} |
||||
} |
||||
@ -0,0 +1,28 @@
@@ -0,0 +1,28 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security.support; |
||||
|
||||
import org.springframework.beans.factory.DisposableBean; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class DestroyBean implements DisposableBean { |
||||
|
||||
public void destroy() throws Exception { |
||||
System.setProperty("security.destroy", "true"); |
||||
} |
||||
} |
||||
@ -0,0 +1,36 @@
@@ -0,0 +1,36 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security.support; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class FactoryBean { |
||||
|
||||
public static Object makeStaticInstance() { |
||||
System.getProperties(); |
||||
return new Object(); |
||||
} |
||||
|
||||
protected static Object protectedStaticInstance() { |
||||
return "protectedStaticInstance"; |
||||
} |
||||
|
||||
public Object makeInstance() { |
||||
System.getProperties(); |
||||
return new Object(); |
||||
} |
||||
} |
||||
@ -0,0 +1,28 @@
@@ -0,0 +1,28 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security.support; |
||||
|
||||
import org.springframework.beans.factory.InitializingBean; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class InitBean implements InitializingBean { |
||||
|
||||
public void afterPropertiesSet() throws Exception { |
||||
System.getProperties(); |
||||
} |
||||
} |
||||
@ -0,0 +1,30 @@
@@ -0,0 +1,30 @@
|
||||
/* |
||||
* Copyright 2006-2009 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.beans.factory.support.security.support; |
||||
|
||||
/** |
||||
* @author Costin Leau |
||||
*/ |
||||
public class PropertyBean { |
||||
|
||||
public void setSecurityProperty(Object property) { |
||||
System.getProperties(); |
||||
} |
||||
|
||||
public void setProperty(Object property) { |
||||
|
||||
} |
||||
} |
||||
Loading…
Reference in new issue