Spring/spring-boot
Spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2024-08-29 03:06:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix health endpoint security

Browse Source 
Commit b02aba4 has renamed `management.security.role` to
`management.security.roles`. Unfortunately, the `HealthMvcEndpoint`
was still looking at the old property.

This commit makes sure that the proper key is used and any custom
role is applied rather than an unconditional `ADMIN` role.

See gh-6540
This commit is contained in:
Eddú Meléndez 2016-08-01 09:01:08 -07:00 committed by Stephane Nicoll
parent 42291659db
commit dced154f71
2 changed files with 32 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/mvc/HealthMvcEndpoint.java
View File

@ -17,7 +17,10 @@
package org.springframework.boot.actuate.endpoint.mvc;
import java.security.Principal;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import org.springframework.boot.actuate.endpoint.HealthEndpoint;
@ -35,6 +38,7 @@ import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.util.Assert;
import org.springframework.util.ClassUtils;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@ -45,6 +49,7 @@ import org.springframework.web.bind.annotation.ResponseBody;
* @author Dave Syer
* @author Andy Wilkinson
* @author Phillip Webb
* @author Eddú Meléndez
* @since 1.1.0
*/
@ConfigurationProperties(prefix = "endpoints.health")
@ -184,11 +189,17 @@ public class HealthMvcEndpoint extends AbstractEndpointMvcAdapter<HealthEndpoint
}
if (isSpringSecurityAuthentication(principal)) {
Authentication authentication = (Authentication) principal;
String role = this.roleResolver.getProperty("role", "ROLE_ADMIN");
List<String> roles = Arrays.asList(StringUtils.trimArrayElements(StringUtils
.commaDelimitedListToStringArray(this.roleResolver.getProperty("roles"))));
if (roles.isEmpty()) {
roles = Collections.singletonList("ROLE_ADMIN");
}
for (GrantedAuthority authority : authentication.getAuthorities()) {
String name = authority.getAuthority();
if (role.equals(name) || ("ROLE_" + role).equals(name)) {
return true;
for (String role : roles) {
if (role.equals(name) || ("ROLE_" + role).equals(name)) {
return true;
}
}
}
}

18
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/HealthMvcEndpointTests.java
View File

@ -42,6 +42,7 @@ import static org.mockito.Mockito.mock;
* @author Christian Dupuis
* @author Dave Syer
* @author Andy Wilkinson
* @author Eddú Meléndez
*/
public class HealthMvcEndpointTests {
@ -49,6 +50,10 @@ public class HealthMvcEndpointTests {
Collections.<String, Object>singletonMap("endpoints.health.sensitive",
"false"));
private static final PropertySource<?> SECURITY_ROLES = new MapPropertySource("test",
Collections.<String, Object>singletonMap("management.security.roles",
"HERO, USER"));
private HealthEndpoint endpoint = null;
private HealthMvcEndpoint mvc = null;
@ -140,6 +145,19 @@ public class HealthMvcEndpointTests {
assertThat(((Health) result).getDetails().get("foo")).isNull();
}
@Test
public void secureCustomRole() {
this.mvc = new HealthMvcEndpoint(this.endpoint, false);
this.mvc.setEnvironment(this.environment);
this.environment.getPropertySources().addLast(SECURITY_ROLES);
given(this.endpoint.invoke())
.willReturn(new Health.Builder().up().withDetail("foo", "bar").build());
Object result = this.mvc.invoke(this.user);
assertThat(result instanceof Health).isTrue();
assertThat(((Health) result).getStatus() == Status.UP).isTrue();
assertThat(((Health) result).getDetails().get("foo")).isEqualTo("bar");
}
@Test
public void healthIsCached() {
given(this.endpoint.getTimeToLive()).willReturn(10000L);