coheigea opened a new pull request, #3627:
URL: https://github.com/apache/cxf/pull/3627
The problem: OAuthScopesFilter stored each method’s @Scopes rule by method
name only. Methods sharing a name (overloads, or a subclass method and the
superclass or interface method it overrides) ended up with one shared rule, and
whichever was scanned last won. A method marked @Scopes("admin") could end up
requiring only "read", so a token with the weaker scope could call it.
The fix:
- One rule per method: each method’s rule is stored under its full
signature, so overloads no longer share a rule.
- The closest declaration wins: a rule on the class’s own method beats one
from a superclass or interface. A rule on a method beats a class-wide rule,
including one inherited from a parent class.
- Fail closed: if the exact method can’t be matched (this happens with
generic interfaces), every rule recorded for that method name must be met.
- Both config styles enforced: scopes set in code with setScopesMap or
setScopesStringMap are checked in addition to annotations, not instead of them.
- Crash fixed: scopes set with setScopesStringMap no longer throw a
NullPointerException.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
