Skip to content

Commit 36130bb

Browse files
arun-guptaarun-gupta
committed
Adding a new sample/test to check for deny-uncovered-http element in web.xml
1 parent 7a42d6b commit 36130bb

File tree

6 files changed

+234
-0
lines changed

6 files changed

+234
-0
lines changed

‎servlet/security-deny-uncovered/pom.xml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<parent>
5+
<groupId>org.javaee7.servlet</groupId>
6+
<artifactId>servlet-samples</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
<relativePath>../pom.xml</relativePath>
9+
</parent>
10+
11+
<artifactId>security-deny-uncovered</artifactId>
12+
<packaging>war</packaging>
13+
</project>

‎servlet/security-deny-uncovered/src/main/java/org/javaee7/servlet/security/deny/uncovered/SecureServlet.java

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
package org.javaee7.servlet.security.deny.uncovered;
2+
3+
import java.io.IOException;
4+
import java.io.PrintWriter;
5+
import javax.servlet.ServletException;
6+
import javax.servlet.annotation.WebServlet;
7+
import javax.servlet.http.HttpServlet;
8+
import javax.servlet.http.HttpServletRequest;
9+
import javax.servlet.http.HttpServletResponse;
10+
11+
/**
12+
* @author Arun Gupta
13+
*/
14+
@WebServlet(urlPatterns = {"/SecureServlet"})
15+
public class SecureServlet extends HttpServlet {
16+
17+
/**
18+
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
19+
* methods.
20+
*
21+
* @param request servlet request
22+
* @param response servlet response
23+
* @throws ServletException if a servlet-specific error occurs
24+
* @throws IOException if an I/O error occurs
25+
*/
26+
protected void processRequest(HttpServletRequest request, HttpServletResponse response, String method)
27+
throws ServletException, IOException {
28+
response.setContentType("text/html;charset=UTF-8");
29+
PrintWriter out = response.getWriter();
30+
out.println("<!DOCTYPE html>");
31+
out.println("<html>");
32+
out.println("<head>");
33+
out.println("<title>Servlet Security - Basic Auth with File-base Realm</title>");
34+
out.println("</head>");
35+
out.println("<body>");
36+
out.println("<h1>Basic Auth with File-base Realm (" + method + ")</h1>");
37+
out.println("<h2>Were you prompted for username/password ?</h2>");
38+
out.println("</body>");
39+
out.println("</html>");
40+
}
41+
42+
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
43+
/**
44+
* Handles the HTTP <code>GET</code> method.
45+
*
46+
* @param request servlet request
47+
* @param response servlet response
48+
* @throws ServletException if a servlet-specific error occurs
49+
* @throws IOException if an I/O error occurs
50+
*/
51+
@Override
52+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
53+
throws ServletException, IOException {
54+
processRequest(request, response, "GET");
55+
}
56+
57+
/**
58+
* Handles the HTTP <code>POST</code> method.
59+
*
60+
* @param request servlet request
61+
* @param response servlet response
62+
* @throws ServletException if a servlet-specific error occurs
63+
* @throws IOException if an I/O error occurs
64+
*/
65+
@Override
66+
protected void doPost(HttpServletRequest request, HttpServletResponse response)
67+
throws ServletException, IOException {
68+
processRequest(request, response, "POST");
69+
}
70+
71+
/**
72+
* Returns a short description of the servlet.
73+
*
74+
* @return a String containing servlet description
75+
*/
76+
@Override
77+
public String getServletInfo() {
78+
return "Short description";
79+
}// </editor-fold>
80+
}

‎servlet/security-deny-uncovered/src/main/webapp/WEB-INF/glassfish-web.xml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
3+
<glassfish-web-app error-url="">
4+
<security-role-mapping>
5+
<role-name>g1</role-name>
6+
<principal-name>g1</principal-name>
7+
<group-name>g1</group-name>
8+
</security-role-mapping>
9+
</glassfish-web-app>

‎servlet/security-deny-uncovered/src/main/webapp/WEB-INF/web.xml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
5+
version="3.1">
6+
<deny-uncovered-http-methods/>
7+
<security-constraint>
8+
<web-resource-collection>
9+
<web-resource-name>SecureServlet</web-resource-name>
10+
<url-pattern>/SecureServlet</url-pattern>
11+
<http-method>GET</http-method>
12+
</web-resource-collection>
13+
<auth-constraint>
14+
<role-name>g1</role-name>
15+
</auth-constraint>
16+
</security-constraint>
17+
18+
<login-config>
19+
<auth-method>BASIC</auth-method>
20+
<realm-name>file</realm-name>
21+
</login-config>
22+
23+
<security-role>
24+
<role-name>g1</role-name>
25+
</security-role>
26+
</web-app>

‎servlet/security-deny-uncovered/src/main/webapp/index.jsp

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<%@page contentType="text/html" pageEncoding="UTF-8"%>
2+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
3+
"http://www.w3.org/TR/html4/loose.dtd">
4+
5+
<html>
6+
<head>
7+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
8+
<title>Servlet : Security</title>
9+
</head>
10+
<body>
11+
<h1>Servlet : Security</h1>
12+
13+
Make sure to create a user:<br><br>
14+
15+
For WildFly: Invoke "./bin/add-user.sh -a -u u1 -p p1 -g g1"<br>
16+
For GlassFish: Invoke "./bin/asadmin create-file-user --groups g1 u1" and use the password "p1" when prompted.<br><br>
17+
Then call the <a href="${pageContext.request.contextPath}/SecureServlet">GET</a> method.<br/>
18+
</body>
19+
</html>

‎servlet/security-deny-uncovered/src/test/java/org/javaee7/servlet/security/deny/uncovered/SecureServletTest.java

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package org.javaee7.servlet.security.deny.uncovered;
2+
3+
import com.meterware.httpunit.AuthorizationRequiredException;
4+
import com.meterware.httpunit.GetMethodWebRequest;
5+
import com.meterware.httpunit.HttpException;
6+
import com.meterware.httpunit.PostMethodWebRequest;
7+
import com.meterware.httpunit.PutMethodWebRequest;
8+
import com.meterware.httpunit.WebConversation;
9+
import com.meterware.httpunit.WebResponse;
10+
import java.io.ByteArrayInputStream;
11+
import java.io.File;
12+
import java.net.URL;
13+
import org.jboss.arquillian.container.test.api.Deployment;
14+
import org.jboss.arquillian.junit.Arquillian;
15+
import org.jboss.arquillian.test.api.ArquillianResource;
16+
import org.jboss.shrinkwrap.api.ShrinkWrap;
17+
import org.jboss.shrinkwrap.api.spec.WebArchive;
18+
import org.junit.Test;
19+
import static org.junit.Assert.*;
20+
import org.junit.runner.RunWith;
21+
22+
/**
23+
* @author Arun Gupta
24+
*/
25+
@RunWith(Arquillian.class)
26+
public class SecureServletTest {
27+
28+
private static final String WEBAPP_SRC = "src/main/webapp";
29+
30+
@ArquillianResource
31+
private URL base;
32+
33+
@Deployment(testable = false)
34+
public static WebArchive createDeployment() {
35+
WebArchive war = ShrinkWrap.create(WebArchive.class).
36+
addClass(SecureServlet.class).
37+
addAsWebInfResource((new File(WEBAPP_SRC + "/WEB-INF", "web.xml")));
38+
return war;
39+
}
40+
41+
@Test
42+
public void testGetMethod() throws Exception {
43+
WebConversation conv = new WebConversation();
44+
conv.setAuthentication("file", "u1", "p1");
45+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/SecureServlet");
46+
WebResponse response = null;
47+
try {
48+
response = conv.getResponse(getRequest);
49+
} catch (AuthorizationRequiredException e) {
50+
fail(e.getMessage());
51+
}
52+
assertNotNull(response);
53+
assertTrue(response.getText().contains("<title>Servlet Security - Basic Auth with File-base Realm</title>"));
54+
}
55+
56+
@Test
57+
public void testPostMethod() throws Exception {
58+
WebConversation conv = new WebConversation();
59+
conv.setAuthentication("file", "u1", "p1");
60+
61+
PostMethodWebRequest postRequest = new PostMethodWebRequest(base + "/SecureServlet");
62+
try {
63+
conv.getResponse(postRequest);
64+
} catch (HttpException e) {
65+
assertEquals(403, e.getResponseCode());
66+
return;
67+
}
68+
fail("POST method could be called");
69+
}
70+
71+
@Test
72+
public void testPutMethod() throws Exception {
73+
WebConversation conv = new WebConversation();
74+
conv.setAuthentication("file", "u1", "p1");
75+
76+
byte[] bytes = new byte[10];
77+
ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
78+
PutMethodWebRequest putRequest = new PutMethodWebRequest(base + "/SecureServlet", bais, "text/plain");
79+
try {
80+
conv.getResponse(putRequest);
81+
} catch (HttpException e) {
82+
assertEquals(403, e.getResponseCode());
83+
return;
84+
}
85+
fail("PUT method could be called");
86+
}
87+
}

0 commit comments

Comments
 (0)