init

test/javax/servlet/annotation/TestServletSecurity.java

@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package javax.servlet.annotation;
+
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import org.apache.catalina.Context;
+import org.apache.catalina.startup.Tomcat;
+import org.apache.catalina.startup.TomcatBaseTest;
+import org.apache.tomcat.util.buf.ByteChunk;
+
+public class TestServletSecurity extends TomcatBaseTest {
+
+    @Test
+    public void testFooThenFooBar() throws Exception {
+        doTestFooAndFooBar(true);
+    }
+
+
+    @Test
+    public void testFooBarThenFoo() throws Exception {
+        doTestFooAndFooBar(false);
+    }
+
+
+    public void doTestFooAndFooBar(boolean fooFirst) throws Exception {
+        // Setup Tomcat instance
+        Tomcat tomcat = getTomcatInstance();
+
+        // No file system docBase required
+        Context ctx = tomcat.addContext("", null);
+
+        Tomcat.addServlet(ctx, "Foo", Foo.class.getName());
+        ctx.addServletMappingDecoded("/foo/*", "Foo");
+
+        Tomcat.addServlet(ctx, "FooBar", FooBar.class.getName());
+        ctx.addServletMappingDecoded("/foo/bar/*", "FooBar");
+
+        tomcat.start();
+
+        ByteChunk bc = new ByteChunk();
+        int rc;
+
+        if (fooFirst) {
+            rc = getUrl("http://localhost:" + getPort() + "/foo", bc, null, null);
+        } else {
+            rc = getUrl("http://localhost:" + getPort() + "/foo/bar", bc, null, null);
+        }
+
+        bc.recycle();
+        Assert.assertEquals(403, rc);
+
+        if (fooFirst) {
+            rc = getUrl("http://localhost:" + getPort() + "/foo/bar", bc, null, null);
+        } else {
+            rc = getUrl("http://localhost:" + getPort() + "/foo", bc, null, null);
+        }
+
+        Assert.assertEquals(403, rc);
+    }
+
+
+    @ServletSecurity(@HttpConstraint(ServletSecurity.EmptyRoleSemantic.DENY))
+    public static class Foo extends HttpServlet {
+
+        private static final long serialVersionUID = 1L;
+
+        @Override
+        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+                throws ServletException, IOException {
+            resp.getWriter().print("OK: Foo");
+        }
+    }
+
+
+    public static class FooBar extends HttpServlet {
+
+        private static final long serialVersionUID = 1L;
+
+        @Override
+        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+                throws ServletException, IOException {
+            resp.getWriter().print("OK: FooBar");
+        }
+    }
+}