[java-identity-provider] 01/01: IDP-2339 - CSRF failure from Edge on iOS
Phil Smart
philip.smart at jisc.ac.uk
Fri Nov 8 14:22:27 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/IDP-2339
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=be3069f8249df73a7d8f0b69163cbf55cdbb0091
commit be3069f8249df73a7d8f0b69163cbf55cdbb0091
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Nov 8 14:19:45 2024 +0000
IDP-2339 - CSRF failure from Edge on iOS
- Add optional per flow token creation
- Add property (idp.csrf.tokenPerFlow) to enable/disable per flow token
creation. Defaults to enabled.
https://shibboleth.atlassian.net/browse/IDP-2339
---
.../net/shibboleth/idp/conf/webflow-config.xml | 1 +
.../net/shibboleth/idp/module/conf/idp.properties | 4 +-
.../csrf/impl/CSRFTokenFlowExecutionListener.java | 57 +++++-
.../impl/CSRFTokenFlowExecutionListenerTest.java | 205 ++++++++++++++-------
4 files changed, 189 insertions(+), 78 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
index 925ddd429..260c83e9d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
@@ -213,6 +213,7 @@
<bean id="csrfTokenFlowExecutionListener" init-method="initialize" destroy-method="destroy"
class="net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListener" p:csrfTokenManager-ref="shibboleth.CSRFTokenManager"
p:enabled="%{idp.csrf.enabled:false}"
+ p:tokenPerFlow="%{idp.csrf.tokenPerFlow:true}"
p:viewRequiresCSRFTokenPredicate-ref="shibboleth.DefaultViewRequiresCSRFTokenPredicate"
p:eventRequiresCSRFTokenValidationPredicate-ref="shibboleth.DefaultEventRequiresCSRFTokenValidationPredicate"/>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
index a01684ae5..84c8be30e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -36,8 +36,10 @@ idp.scope = example.org
#idp.cookie.sameSite = None
#idp.cookie.sameSiteCondition = shibboleth.Conditions.FALSE
-# Enable cross-site request forgery mitigation for views.
+# Enable cross-site request forgery (CSRF) mitigation for views.
idp.csrf.enabled = true
+# If true, a new CSRF token is generated for each flow. Otherwise, it is generated for each view.
+#idp.csrf.tokenPerFlow = true
# Name of the HTTP parameter that stores the CSRF token.
#idp.csrf.token.parameter = csrf_token
diff --git a/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java b/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java
index d8413e281..d0db0829d 100644
--- a/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java
+++ b/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java
@@ -21,10 +21,11 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
+import org.springframework.webflow.core.collection.MutableAttributeMap;
import org.springframework.webflow.definition.StateDefinition;
import org.springframework.webflow.execution.Event;
import org.springframework.webflow.execution.FlowExecutionListener;
+import org.springframework.webflow.execution.FlowSession;
import org.springframework.webflow.execution.RequestContext;
import org.springframework.webflow.execution.View;
@@ -35,14 +36,18 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A flow execution lifecycle listener that, if enabled:
- * <ul>
- * <li>Sets an anti-CSRF token into the view-scope map on rendering of a suitable view-state</li>
+ * <ol>
+ * <li>Sets an anti-CSRF token into the flow-scope map when a flow session starts and a token per-flow is
+ * enabled.</li>
+ * <li>Sets an anti-CSRF token into the view-scope map when rendering a suitable view-state. This token is
+ * either retrieved from the flow-scope, if available from step 1, or generated anew.</li>
* <li>Checks the CSRF token in a HTTP request matches that stored in the view-scope map when a suitable
* view-state event occurs.</li>
- * </ul>
+ * </ol>
*/
public class CSRFTokenFlowExecutionListener extends AbstractInitializableComponent implements FlowExecutionListener {
@@ -60,6 +65,9 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
/** Is this listener enabled? */
private boolean enabled;
+
+ /** Should a new token should be created for each flow session and not for each view? */
+ private boolean tokenPerFlow;
/** The CSRF token manager for getting and validating tokens. */
@NonnullAfterInit private CSRFTokenManager csrfTokenManager;
@@ -68,6 +76,7 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
/** Constructor. */
public CSRFTokenFlowExecutionListener() {
enabled = false;
+ tokenPerFlow = true;
}
/**
@@ -80,6 +89,16 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
enabled = enable;
}
+ /**
+ * Sets whether a new token should be created for each flow session and not for each view.
+ *
+ * @param flag enable or disable the token per flow pattern
+ */
+ public void setTokenPerFlow(final boolean flag) {
+ checkSetterPreconditions();
+ tokenPerFlow = flag;
+ }
+
/**
* Sets the request context condition to determine if a CSRF token should be added to the view-scope.
*
@@ -101,8 +120,7 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
checkSetterPreconditions();
eventRequiresCSRFTokenValidationPredicate = Constraint.isNotNull(condition,
"Validate CSRF token condition cannot be null");
- }
-
+ }
/**
* Sets the CSRF token manager.
@@ -113,8 +131,22 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
checkSetterPreconditions();
csrfTokenManager = Constraint.isNotNull(tokenManager, "CSRF Token manager can not be null");
}
-
-
+
+ /**
+ * {@inheritDoc}
+ *
+ * <p>If per flow-session tokens are enabled, creates a CSRF token and adds it to the request context flow scope
+ * for extraction into the view scope later on.</p>
+ */
+ @Override
+ public void sessionStarting(final RequestContext context, final FlowSession session,
+ final MutableAttributeMap<?> input) {
+
+ if (enabled && tokenPerFlow) {
+ context.getFlowScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, csrfTokenManager.generateCSRFToken());
+ }
+ }
+
/**
* Generates a CSRF token and adds it to the request context view scope, overwriting any existing token.
*
@@ -126,7 +158,13 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
//state here should always be a view-state, but guard anyway.
if (enabled && viewState.isViewState() && viewRequiresCSRFTokenPredicate.test(context)) {
- context.getViewScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, csrfTokenManager.generateCSRFToken());
+ final Object flowScopedCsrfTokenObject = context.getFlowScope().get(CSRF_TOKEN_VIEWSCOPE_NAME);
+ if (flowScopedCsrfTokenObject instanceof final CSRFToken token) {
+ context.getViewScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, token);
+ } else {
+ context.getViewScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, csrfTokenManager.generateCSRFToken());
+ }
+
}
}
@@ -192,6 +230,7 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
/** {@inheritDoc} */
+ @Override
public void doInitialize() throws ComponentInitializationException {
super.doInitialize();
diff --git a/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java b/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java
index 95f785306..b0dce5f21 100644
--- a/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java
+++ b/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java
@@ -58,7 +58,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@BeforeMethod public void setup() throws ComponentInitializationException {
- CSRFTokenManager manager = new CSRFTokenManager();
+ final CSRFTokenManager manager = new CSRFTokenManager();
manager.setCsrfParameterName(CSRF_PARAM_NAME);
manager.initialize();
listener = new CSRFTokenFlowExecutionListener();
@@ -66,6 +66,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
listener.setEnabled(true);
listener.setViewRequiresCSRFTokenPredicate(new DefaultViewRequiresCSRFTokenPredicate());
listener.setEventRequiresCSRFTokenValidationPredicate(new DefaultEventRequiresCSRFTokenValidationPredicate());
+ listener.setTokenPerFlow(false);
//specifically do not init here, so things can be changed, test init later on.
//listener.initialize();
}
@@ -78,20 +79,82 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testAddingCsrfTokenToViewScopeOnRendering() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.viewRendering(src, new MockView("login",src), currentState);
- Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ final Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
Assert.assertNotNull(csrfTokenValueObject);
Assert.assertTrue(csrfTokenValueObject instanceof CSRFToken);
Assert.assertFalse(((CSRFToken) csrfTokenValueObject).getToken().isEmpty());
}
+ @Test public void testAddingCsrfTokenToViewScopeOnRendering_NewTokenOnEachRequest()
+ throws ComponentInitializationException {
+
+ listener.initialize();
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ flowSession.setState(currentState);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
+
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ Assert.assertNotNull(csrfTokenValueObject);
+ Assert.assertTrue(csrfTokenValueObject instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObject).getToken().isEmpty());
+
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObjectSecond =
+ src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+
+ Assert.assertNotNull(csrfTokenValueObjectSecond);
+ Assert.assertTrue(csrfTokenValueObjectSecond instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObjectSecond).getToken().isEmpty());
+
+ Assert.assertNotEquals(((CSRFToken)csrfTokenValueObject).getToken(),
+ ((CSRFToken)csrfTokenValueObjectSecond).getToken());
+
+ }
+
+ @Test public void testAddingCsrfTokenToFlowScope_SameTokenForEachRequest()
+ throws ComponentInitializationException {
+ listener.setTokenPerFlow(true);
+ listener.initialize();
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ flowSession.setState(currentState);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
+
+ listener.sessionStarting(src, flowSession, null);
+
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObject =
+ src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ Assert.assertNotNull(csrfTokenValueObject);
+ Assert.assertTrue(csrfTokenValueObject instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObject).getToken().isEmpty());
+
+ // Now try the listener again, it should give the same token value
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObjectSecond =
+ src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+
+ Assert.assertNotNull(csrfTokenValueObjectSecond);
+ Assert.assertTrue(csrfTokenValueObjectSecond instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObjectSecond).getToken().isEmpty());
+
+ Assert.assertEquals(((CSRFToken)csrfTokenValueObject).getToken(),
+ ((CSRFToken)csrfTokenValueObjectSecond).getToken());
+
+ }
+
/**
* Test the listener throws an {@link InvalidCSRFTokenException} if the viewScope and request token do not match.
* View is not excluded.
@@ -101,20 +164,21 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=InvalidCSRFTokenException.class) public void testInvalidToken() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "will-fail");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"proceed"));
@@ -129,20 +193,21 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testValidToken() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, viewScopeToken.getToken());
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"proceed"));
@@ -159,21 +224,22 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testViewExcluded() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
currentState.getAttributes().put(BaseCSRFTokenPredicate.CSRF_EXCLUDED_ATTRIBUTE_NAME, true);
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "would-fail-but-is-excluded");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"proceed"));
@@ -192,20 +258,21 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
//set enabled to false.
listener.setEnabled(false);
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "should-fail-but-disabled");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"proceed"));
@@ -221,11 +288,11 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testDoesNotAddTokenToNonViewState() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.viewRendering(src, new MockView("login",src), currentState);
}
@@ -240,11 +307,11 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testDoesNotTestTokenInNonViewState() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -260,16 +327,17 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), "csrf_token");
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.eventSignaled(src, new Event(this,"proceed"));
@@ -286,7 +354,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
listener.setEventRequiresCSRFTokenValidationPredicate(new BiPredicate<RequestContext, Event>() {
- public boolean test(RequestContext context, Event event) {
+ public boolean test(final RequestContext context, final Event event) {
if (event.getId().equals("new-event-id")) {
return true;
}
@@ -295,20 +363,21 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
});
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "should-fail");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"new-event-id"));
@@ -324,11 +393,11 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -347,7 +416,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testSetEnabled() {
//create a new instance to test default enabled = false.
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
// test default is false.
Object enabledObject = ReflectionTestUtils.getField(theListener, "enabled");
assert enabledObject != null;
@@ -372,14 +441,14 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
//set enabled to false.
listener.setEnabled(false);
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.viewRendering(src, new MockView("login",src), currentState);
- Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ final Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
Assert.assertNull(csrfTokenValueObject);
@@ -415,19 +484,19 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, "string-token");
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "string-token");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"proceed"));
@@ -441,7 +510,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=ComponentInitializationException.class) void testUnsetCsrfTokenManager()
throws ComponentInitializationException{
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
theListener.setViewRequiresCSRFTokenPredicate(new DefaultViewRequiresCSRFTokenPredicate());
theListener.setEventRequiresCSRFTokenValidationPredicate(new DefaultEventRequiresCSRFTokenValidationPredicate());
theListener.initialize();
@@ -455,7 +524,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=ComponentInitializationException.class) void testUnsetEventRequiresCSRFValidationPredicate()
throws ComponentInitializationException{
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
theListener.setCsrfTokenManager(new CSRFTokenManager());
theListener.setViewRequiresCSRFTokenPredicate(new DefaultViewRequiresCSRFTokenPredicate());
theListener.initialize();
@@ -469,7 +538,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=ComponentInitializationException.class) void testUnsetViewRequiresCSRFTokenPredicate()
throws ComponentInitializationException{
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
theListener.setCsrfTokenManager(new CSRFTokenManager());
theListener.setEventRequiresCSRFTokenValidationPredicate(new DefaultEventRequiresCSRFTokenValidationPredicate());
theListener.initialize();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list