mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-08-29 03:06:45 +08:00
Switch CF management skip SSL to opt-in
Change CloudFoundryActuatorAutoConfiguration so that skipping of SSL verification is now opt-in rather than enabled by default. Fixes gh-7629 Closes gh-7655
This commit is contained in:
parent
85ed90282d
commit
34712cbf76
@ -84,9 +84,11 @@ public class CloudFoundryActuatorAutoConfiguration {
|
||||
private CloudFoundrySecurityService getCloudFoundrySecurityService(
|
||||
RestTemplateBuilder restTemplateBuilder, Environment environment) {
|
||||
String cloudControllerUrl = environment.getProperty("vcap.application.cf_api");
|
||||
boolean skipSslValidation = Boolean.parseBoolean(
|
||||
environment.getProperty("management.cloudfoundry.skipSslValidation"));
|
||||
return cloudControllerUrl == null ? null
|
||||
: new CloudFoundrySecurityService(restTemplateBuilder,
|
||||
cloudControllerUrl);
|
||||
: new CloudFoundrySecurityService(restTemplateBuilder, cloudControllerUrl,
|
||||
skipSslValidation);
|
||||
}
|
||||
|
||||
private CorsConfiguration getCorsConfiguration() {
|
||||
|
@ -46,11 +46,14 @@ class CloudFoundrySecurityService {
|
||||
private String uaaUrl;
|
||||
|
||||
CloudFoundrySecurityService(RestTemplateBuilder restTemplateBuilder,
|
||||
String cloudControllerUrl) {
|
||||
String cloudControllerUrl, boolean skipSslValidation) {
|
||||
Assert.notNull(restTemplateBuilder, "RestTemplateBuilder must not be null");
|
||||
Assert.notNull(cloudControllerUrl, "CloudControllerUrl must not be null");
|
||||
this.restTemplate = restTemplateBuilder
|
||||
.requestFactory(SkipSslVerificationHttpRequestFactory.class).build();
|
||||
if (skipSslValidation) {
|
||||
restTemplateBuilder = restTemplateBuilder
|
||||
.requestFactory(SkipSslVerificationHttpRequestFactory.class);
|
||||
}
|
||||
this.restTemplate = restTemplateBuilder.build();
|
||||
this.cloudControllerUrl = cloudControllerUrl;
|
||||
}
|
||||
|
||||
|
@ -42,6 +42,7 @@ import org.springframework.mock.web.MockServletContext;
|
||||
import org.springframework.security.config.annotation.web.builders.WebSecurity.IgnoredRequestConfigurer;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.test.util.ReflectionTestUtils;
|
||||
import org.springframework.web.client.RestTemplate;
|
||||
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
|
||||
import org.springframework.web.cors.CorsConfiguration;
|
||||
|
||||
@ -117,6 +118,22 @@ public class CloudFoundryActuatorAutoConfigurationTests {
|
||||
assertThat(cloudControllerUrl).isEqualTo("http://my-cloud-controller.com");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void skipSslValidation() throws Exception {
|
||||
EnvironmentTestUtils.addEnvironment(this.context,
|
||||
"management.cloudfoundry.skipSslValidation:true");
|
||||
this.context.refresh();
|
||||
CloudFoundryEndpointHandlerMapping handlerMapping = getHandlerMapping();
|
||||
Object interceptor = ReflectionTestUtils.getField(handlerMapping,
|
||||
"securityInterceptor");
|
||||
Object interceptorSecurityService = ReflectionTestUtils.getField(interceptor,
|
||||
"cloudFoundrySecurityService");
|
||||
RestTemplate restTemplate = (RestTemplate) ReflectionTestUtils
|
||||
.getField(interceptorSecurityService, "restTemplate");
|
||||
assertThat(restTemplate.getRequestFactory())
|
||||
.isInstanceOf(SkipSslVerificationHttpRequestFactory.class);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void cloudFoundryPlatformActiveAndCloudControllerUrlNotPresent()
|
||||
throws Exception {
|
||||
|
@ -28,7 +28,9 @@ import org.springframework.boot.test.web.client.MockServerRestTemplateCustomizer
|
||||
import org.springframework.boot.web.client.RestTemplateBuilder;
|
||||
import org.springframework.http.HttpStatus;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.test.util.ReflectionTestUtils;
|
||||
import org.springframework.test.web.client.MockRestServiceServer;
|
||||
import org.springframework.web.client.RestTemplate;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.client.match.MockRestRequestMatchers.header;
|
||||
@ -63,10 +65,33 @@ public class CloudFoundrySecurityServiceTests {
|
||||
public void setup() throws Exception {
|
||||
MockServerRestTemplateCustomizer mockServerCustomizer = new MockServerRestTemplateCustomizer();
|
||||
RestTemplateBuilder builder = new RestTemplateBuilder(mockServerCustomizer);
|
||||
this.securityService = new CloudFoundrySecurityService(builder, CLOUD_CONTROLLER);
|
||||
this.securityService = new CloudFoundrySecurityService(builder, CLOUD_CONTROLLER,
|
||||
false);
|
||||
this.server = mockServerCustomizer.getServer();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void skipSslValidationWhenTrue() throws Exception {
|
||||
RestTemplateBuilder builder = new RestTemplateBuilder();
|
||||
this.securityService = new CloudFoundrySecurityService(builder, CLOUD_CONTROLLER,
|
||||
true);
|
||||
RestTemplate restTemplate = (RestTemplate) ReflectionTestUtils
|
||||
.getField(this.securityService, "restTemplate");
|
||||
assertThat(restTemplate.getRequestFactory())
|
||||
.isInstanceOf(SkipSslVerificationHttpRequestFactory.class);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void doNotskipSslValidationWhenFalse() throws Exception {
|
||||
RestTemplateBuilder builder = new RestTemplateBuilder();
|
||||
this.securityService = new CloudFoundrySecurityService(builder, CLOUD_CONTROLLER,
|
||||
false);
|
||||
RestTemplate restTemplate = (RestTemplate) ReflectionTestUtils
|
||||
.getField(this.securityService, "restTemplate");
|
||||
assertThat(restTemplate.getRequestFactory())
|
||||
.isNotInstanceOf(SkipSslVerificationHttpRequestFactory.class);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void getAccessLevelWhenSpaceDeveloperShouldReturnFull() throws Exception {
|
||||
String responseBody = "{\"read_sensitive_data\": true,\"read_basic_data\": true}";
|
||||
|
Loading…
Reference in New Issue
Block a user