[java-opensaml2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/DefaultBootstrap.java sr...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Sep 14 18:32:58 2012
New Revision: 1590

URL: http://svn.shibboleth.net/view/java-opensaml2?rev=1590&view=rev
Log:
JOST-195: Use system property-based override for our custom ESAPI config rather than ESAPI locator class call 

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java
    branches/REL_2/src/test/java/org/opensaml/ESAPITest.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=1590&r1=1589&r2=1590&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Fri Sep 14 18:32:58 2012
@@ -8,6 +8,7 @@
 [JOST-191] - Further Bugfixes to XACML\policy
 [JOST-193] - Make the implementation of custom bootstrap code easier, without relying on private data from DefaultBootstrap
 [JOST-194] - org.opensaml.ESAPISecurityConfig should use singleton pattern like the default ESAPI reference class
+[JOST-195] - Use system property-based override for our custom ESAPI config rather than ESAPI locator class call 
 
 Changes in Release 2.5.3
 =============================================

Modified: branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java?rev=1590&r1=1589&r2=1590&view=diff
==============================================================================
--- branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java (original)
+++ branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java Fri Sep 14 18:32:58 2012
@@ -101,7 +101,23 @@
      * Initializes the OWASPI ESAPI library.
      */
     protected static void initializeESAPI() {
-        ESAPI.initialize("org.opensaml.ESAPISecurityConfig");
+        Logger log = getLogger();
+        String systemPropertyKey = "org.owasp.esapi.SecurityConfiguration";
+        String opensamlConfigImpl = ESAPISecurityConfig.class.getName();
+        
+        String currentValue = System.getProperty(systemPropertyKey);
+        if (currentValue == null || currentValue.isEmpty()) {
+            log.debug("Setting ESAPI SecurityConfiguration impl to OpenSAML internal class: {}", opensamlConfigImpl);
+            System.setProperty(systemPropertyKey, opensamlConfigImpl);
+            // We still need to call ESAPI.initialize() despite setting the system property, b/c within the ESAPI class
+            // the property is only evaluated once in a static initializer and stored. The initialize method however
+            // does overwrite the statically-set value from the system property. But still set the system property for 
+            // consistency, so other callers can see what has been set.
+            ESAPI.initialize(opensamlConfigImpl);
+        } else {
+            log.debug("ESAPI SecurityConfiguration impl was already set non-null and non-empty via system property, leaving existing value in place: {}",
+                    currentValue);
+        }
     }
 
     /**

Modified: branches/REL_2/src/test/java/org/opensaml/ESAPITest.java
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/test/java/org/opensaml/ESAPITest.java?rev=1590&r1=1589&r2=1590&view=diff
==============================================================================
--- branches/REL_2/src/test/java/org/opensaml/ESAPITest.java (original)
+++ branches/REL_2/src/test/java/org/opensaml/ESAPITest.java Fri Sep 14 18:32:58 2012
@@ -27,6 +27,9 @@
  * Test that OWASPI ESAPI is initialized properly by the default bootstrap process.
  */
 public class ESAPITest extends TestCase {
+    
+    private String systemPropertyKey = "org.owasp.esapi.SecurityConfiguration";
+    private String opensamlConfigImpl = ESAPISecurityConfig.class.getName();
 
     /** {@inheritDoc} */
     protected void setUp() throws Exception {
@@ -38,8 +41,12 @@
      *  Tests that basic initialization has happened.
      */
     public void testInit() {
+        assertEquals(opensamlConfigImpl, System.getProperty(systemPropertyKey));
+        
         SecurityConfiguration sc = ESAPI.securityConfiguration();
         assertNotNull("ESAPI SecurityConfiguration was null", sc);
+        
+        assertTrue(sc instanceof ESAPISecurityConfig);
         
         Encoder encoder = ESAPI.encoder();
         assertNotNull("ESAPI Encoder was null", encoder);