mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-08-29 03:06:45 +08:00
Allow OPTIONS requests in interceptors
Update `MvcEndpointSecurityInterceptor` and `CloudFoundrySecurityInterceptor` to allow OPTIONS requests to be processed. Fixes gh-7720
This commit is contained in:
parent
a35a1022c2
commit
a167db7b37
@ -24,6 +24,7 @@ import org.apache.commons.logging.LogFactory;
|
||||
|
||||
import org.springframework.boot.actuate.cloudfoundry.CloudFoundryAuthorizationException.Reason;
|
||||
import org.springframework.boot.actuate.endpoint.mvc.MvcEndpoint;
|
||||
import org.springframework.http.HttpMethod;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.util.StringUtils;
|
||||
import org.springframework.web.cors.CorsUtils;
|
||||
@ -57,7 +58,7 @@ class CloudFoundrySecurityInterceptor extends HandlerInterceptorAdapter {
|
||||
|
||||
@Override
|
||||
public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
|
||||
Object o) throws Exception {
|
||||
Object handler) throws Exception {
|
||||
if (CorsUtils.isPreFlightRequest(request)) {
|
||||
return true;
|
||||
}
|
||||
@ -70,7 +71,11 @@ class CloudFoundrySecurityInterceptor extends HandlerInterceptorAdapter {
|
||||
throw new CloudFoundryAuthorizationException(Reason.SERVICE_UNAVAILABLE,
|
||||
"Cloud controller URL is not available");
|
||||
}
|
||||
HandlerMethod handlerMethod = (HandlerMethod) o;
|
||||
HandlerMethod handlerMethod = (HandlerMethod) handler;
|
||||
if (HttpMethod.OPTIONS.matches(request.getMethod())
|
||||
&& !(handlerMethod.getBean() instanceof MvcEndpoint)) {
|
||||
return true;
|
||||
}
|
||||
MvcEndpoint mvcEndpoint = (MvcEndpoint) handlerMethod.getBean();
|
||||
check(request, mvcEndpoint);
|
||||
}
|
||||
|
@ -25,6 +25,7 @@ import javax.servlet.http.HttpServletResponse;
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
|
||||
import org.springframework.http.HttpMethod;
|
||||
import org.springframework.http.HttpStatus;
|
||||
import org.springframework.util.StringUtils;
|
||||
import org.springframework.web.cors.CorsUtils;
|
||||
@ -60,6 +61,10 @@ public class MvcEndpointSecurityInterceptor extends HandlerInterceptorAdapter {
|
||||
return true;
|
||||
}
|
||||
HandlerMethod handlerMethod = (HandlerMethod) handler;
|
||||
if (HttpMethod.OPTIONS.matches(request.getMethod())
|
||||
&& !(handlerMethod.getBean() instanceof MvcEndpoint)) {
|
||||
return true;
|
||||
}
|
||||
MvcEndpoint mvcEndpoint = (MvcEndpoint) handlerMethod.getBean();
|
||||
if (!mvcEndpoint.isSensitive()) {
|
||||
return true;
|
||||
|
@ -0,0 +1,146 @@
|
||||
/*
|
||||
* Copyright 2012-2016 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.boot.actuate.endpoint.mvc;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
|
||||
import org.junit.After;
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.boot.actuate.autoconfigure.EndpointWebMvcAutoConfiguration;
|
||||
import org.springframework.boot.actuate.autoconfigure.ManagementServerPropertiesAutoConfiguration;
|
||||
import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration;
|
||||
import org.springframework.boot.autoconfigure.web.HttpMessageConvertersAutoConfiguration;
|
||||
import org.springframework.boot.autoconfigure.web.WebMvcAutoConfiguration;
|
||||
import org.springframework.boot.test.context.SpringBootTest;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.test.context.junit4.SpringRunner;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
|
||||
import org.springframework.util.FileCopyUtils;
|
||||
import org.springframework.web.context.WebApplicationContext;
|
||||
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.options;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
/**
|
||||
* Tests for {@link HeapdumpMvcEndpoint} OPTIONS call with security.
|
||||
*
|
||||
* @author Phillip Webb
|
||||
*/
|
||||
@RunWith(SpringRunner.class)
|
||||
@SpringBootTest
|
||||
public class HeapdumpMvcEndpointSecureOptionsTests {
|
||||
|
||||
@Autowired
|
||||
private WebApplicationContext context;
|
||||
|
||||
private MockMvc mvc;
|
||||
|
||||
@Autowired
|
||||
private TestHeapdumpMvcEndpoint endpoint;
|
||||
|
||||
@Before
|
||||
public void setup() {
|
||||
this.context.getBean(HeapdumpMvcEndpoint.class).setEnabled(true);
|
||||
this.mvc = MockMvcBuilders.webAppContextSetup(this.context).build();
|
||||
}
|
||||
|
||||
@After
|
||||
public void reset() {
|
||||
this.endpoint.reset();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void invokeOptionsShouldReturnSize() throws Exception {
|
||||
this.mvc.perform(options("/heapdump")).andExpect(status().isOk());
|
||||
}
|
||||
|
||||
@Import({ JacksonAutoConfiguration.class,
|
||||
HttpMessageConvertersAutoConfiguration.class,
|
||||
EndpointWebMvcAutoConfiguration.class, WebMvcAutoConfiguration.class,
|
||||
ManagementServerPropertiesAutoConfiguration.class })
|
||||
@Configuration
|
||||
public static class TestConfiguration {
|
||||
|
||||
@Bean
|
||||
public HeapdumpMvcEndpoint endpoint() {
|
||||
return new TestHeapdumpMvcEndpoint();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
private static class TestHeapdumpMvcEndpoint extends HeapdumpMvcEndpoint {
|
||||
|
||||
private boolean available;
|
||||
|
||||
private boolean locked;
|
||||
|
||||
private String heapDump;
|
||||
|
||||
TestHeapdumpMvcEndpoint() {
|
||||
super(TimeUnit.SECONDS.toMillis(1));
|
||||
reset();
|
||||
}
|
||||
|
||||
public void reset() {
|
||||
this.available = true;
|
||||
this.locked = false;
|
||||
this.heapDump = "HEAPDUMP";
|
||||
}
|
||||
|
||||
@Override
|
||||
protected HeapDumper createHeapDumper() {
|
||||
return new HeapDumper() {
|
||||
|
||||
@Override
|
||||
public void dumpHeap(File file, boolean live)
|
||||
throws IOException, InterruptedException {
|
||||
if (!TestHeapdumpMvcEndpoint.this.available) {
|
||||
throw new HeapDumperUnavailableException("Not available", null);
|
||||
}
|
||||
if (TestHeapdumpMvcEndpoint.this.locked) {
|
||||
throw new InterruptedException();
|
||||
}
|
||||
if (file.exists()) {
|
||||
throw new IOException("File exists");
|
||||
}
|
||||
FileCopyUtils.copy(TestHeapdumpMvcEndpoint.this.heapDump.getBytes(),
|
||||
file);
|
||||
}
|
||||
|
||||
};
|
||||
}
|
||||
|
||||
public void setAvailable(boolean available) {
|
||||
this.available = available;
|
||||
}
|
||||
|
||||
public void setLocked(boolean locked) {
|
||||
this.locked = locked;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
@ -47,6 +47,7 @@ import org.springframework.web.context.WebApplicationContext;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.options;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
/**
|
||||
@ -108,6 +109,11 @@ public class HeapdumpMvcEndpointTests {
|
||||
assertThat(uncompressed).isEqualTo("HEAPDUMP".getBytes());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void invokeOptionsShouldReturnSize() throws Exception {
|
||||
this.mvc.perform(options("/heapdump")).andExpect(status().isOk());
|
||||
}
|
||||
|
||||
@Import({ JacksonAutoConfiguration.class,
|
||||
HttpMessageConvertersAutoConfiguration.class,
|
||||
EndpointWebMvcAutoConfiguration.class, WebMvcAutoConfiguration.class,
|
||||
|
Loading…
Reference in New Issue
Block a user