[java-opensaml] 01/02: IDP-1793 Use Suppliers for HttpRequest/Response

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch dev/4/IDP-1793
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=181573636fe4b4a80fafc5e67e1d28810c60b72f

commit 181573636fe4b4a80fafc5e67e1d28810c60b72f
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Jul 28 19:38:57 2022 +0100

    IDP-1793  Use Suppliers for HttpRequest/Response
    
    https://shibboleth.atlassian.net/browse/IDP-1793
    
    AbstractProfileAction now has a setter for Suppliers
    for HttpServletRequest and Response.
    The non-supplier is deprecated.
---
 .../profile/action/AbstractProfileAction.java      | 97 +++++++++++++++++++---
 1 file changed, 86 insertions(+), 11 deletions(-)

diff --git a/opensaml-profile-api/src/main/java/org/opensaml/profile/action/AbstractProfileAction.java b/opensaml-profile-api/src/main/java/org/opensaml/profile/action/AbstractProfileAction.java
index 889fe5a71..5efc1c916 100644
--- a/opensaml-profile-api/src/main/java/org/opensaml/profile/action/AbstractProfileAction.java
+++ b/opensaml-profile-api/src/main/java/org/opensaml/profile/action/AbstractProfileAction.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.profile.action;
 
+import java.util.function.Supplier;
+
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.servlet.http.HttpServletRequest;
@@ -26,11 +28,16 @@ import net.shibboleth.utilities.java.support.annotation.Prototype;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletRequestProxy;
+import net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletResponseProxy;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
 
 import org.opensaml.profile.context.EventContext;
 import org.opensaml.profile.context.MetricContext;
 import org.opensaml.profile.context.PreviousEventContext;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
@@ -41,14 +48,17 @@ import org.slf4j.LoggerFactory;
 @Prototype
 public abstract class AbstractProfileAction extends AbstractInitializableComponent implements ProfileAction {
 
+    /** Logger. */
+    private final Logger log = LoggerFactory.getLogger(AbstractProfileAction.class);
+
     /** Cached log prefix. */
     @Nullable private String logPrefix;
     
     /** Current HTTP request, if available. */
-    @Nullable private HttpServletRequest httpServletRequest;
+    @Nullable private Supplier<HttpServletRequest> httpServletRequestSupplier;
 
     /** Current HTTP response, if available. */
-    @Nullable private HttpServletResponse httpServletResponse;
+    @Nullable private  Supplier<HttpServletResponse> httpServletResponseSupplier;
 
     /**
      * Get the current HTTP request if available.
@@ -56,38 +66,103 @@ public abstract class AbstractProfileAction extends AbstractInitializableCompone
      * @return current HTTP request
      */
     @Nullable public HttpServletRequest getHttpServletRequest() {
-        return httpServletRequest;
+        if (httpServletRequestSupplier == null) {
+            return null;
+        }
+        return httpServletRequestSupplier.get();
+    }
+
+    /**
+     * Get the supplier for  HTTP request if available.
+     *
+     * @return current HTTP request
+     */
+    @Nullable public Supplier<HttpServletRequest> getHttpServletRequestSupplier() {
+        return httpServletRequestSupplier;
     }
 
     /**
      * Set the current HTTP request.
-     * 
+     *
      * @param request current HTTP request
      */
+    @Deprecated(since = "4.3", forRemoval = true)
     public void setHttpServletRequest(@Nullable final HttpServletRequest request) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        DeprecationSupport.warnOnce(ObjectType.METHOD, "setHttpServletReqest",
+                getLogPrefix(), "setHttpServletRequestSupplier");
+        if (request != null && !(request instanceof ThreadLocalHttpServletRequestProxy)) {
+            log.warn("Unsafe HttpServletRequest injected");
+        }
+        httpServletRequestSupplier = new Supplier<>() {
+            public HttpServletRequest get() {
+                return request;
+            };
+        };
+    }
+
+    /**
+     * Set the current HTTP request Supplier.
+     *
+     * @param requestSupplier Supplier for the current HTTP request
+     */
+    public void setHttpServletRequestSupplier(@Nullable final Supplier<HttpServletRequest> requestSupplier) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
 
-        httpServletRequest = request;
+        httpServletRequestSupplier = requestSupplier;
     }
 
     /**
-     * Get the current HTTP response.
-     * 
-     * @return current HTTP response
+     * Get the current HTTP response if available.
+     *
+     * @return current HTTP response or null
      */
     @Nullable public HttpServletResponse getHttpServletResponse() {
-        return httpServletResponse;
+        if (httpServletResponseSupplier == null) {
+            return null;
+        }
+        return httpServletResponseSupplier.get();
+    }
+
+    /**
+     * Get the current HTTP response if available.
+     *
+     * @return current HTTP response or null
+     */
+    @Nullable public Supplier<HttpServletResponse> getHttpServletResponseSupplier() {
+        return httpServletResponseSupplier;
     }
 
     /**
      * Set the current HTTP response.
-     * 
+     *
      * @param response current HTTP response
      */
+    @Deprecated(since = "4.3", forRemoval = true)
     public void setHttpServletResponse(@Nullable final HttpServletResponse response) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
 
-        httpServletResponse = response;
+        DeprecationSupport.warnOnce(ObjectType.METHOD, "setHttpServletResponse",
+                getLogPrefix(), "setHttpServletResponseSupplier");
+        if (response != null && !(response instanceof ThreadLocalHttpServletResponseProxy)) {
+            log.warn("Unsafe HttpServletRequest injected");
+        }
+        httpServletResponseSupplier = new Supplier<>() {
+            public HttpServletResponse get() {
+                return response;
+            };
+        };
+    }
+
+    /**
+     * Set the supplier of the current HTTP response.
+     *
+     * @param supplier what to set
+     */
+    public void setHttpServletResponseSupplier(@Nullable final Supplier<HttpServletResponse> supplier) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        httpServletResponseSupplier = supplier;
     }
 
     /** {@inheritDoc} */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.