This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 49506f6d5a Separate the Context role mapping from security-role-ref
49506f6d5a is described below
commit 49506f6d5ad7cdef211ce1a4026a29183b3df5c7
Author: remm <[email protected]>
AuthorDate: Fri Jul 24 21:05:00 2026 +0200
Separate the Context role mapping from security-role-ref
---
java/org/apache/catalina/connector/Request.java | 11 ++++++++++-
java/org/apache/catalina/core/StandardWrapper.java | 10 ----------
java/org/apache/catalina/realm/RealmBase.java | 10 +++++++---
test/org/apache/catalina/core/TestStandardWrapper.java | 12 ++++++++++++
webapps/docs/changelog.xml | 4 ++++
5 files changed, 33 insertions(+), 14 deletions(-)
diff --git a/java/org/apache/catalina/connector/Request.java
b/java/org/apache/catalina/connector/Request.java
index e3b855456f..a54fea1bbf 100644
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -2438,8 +2438,17 @@ public class Request implements HttpServletRequest {
return false;
}
+ // Check for a role alias defined in a <security-role-ref> element
+ Wrapper wrapper = getWrapper();
+ if (wrapper != null) {
+ String realRole = wrapper.findSecurityReference(role);
+ if (realRole != null) {
+ return realm.hasRole(wrapper, userPrincipal, realRole);
+ }
+ }
+
// Check for a role defined directly as a <security-role>
- return realm.hasRole(getWrapper(), userPrincipal, role);
+ return realm.hasRole(wrapper, userPrincipal, role);
}
diff --git a/java/org/apache/catalina/core/StandardWrapper.java
b/java/org/apache/catalina/core/StandardWrapper.java
index fb517bf716..cd705c6067 100644
--- a/java/org/apache/catalina/core/StandardWrapper.java
+++ b/java/org/apache/catalina/core/StandardWrapper.java
@@ -674,16 +674,6 @@ public class StandardWrapper extends ContainerBase
implements ServletConfig, Wra
referencesLock.readLock().unlock();
}
- // If not specified on the Wrapper, check the Context
- if (getParent() instanceof Context) {
- Context context = (Context) getParent();
- if (reference != null) {
- reference = context.findRoleMapping(reference);
- } else {
- reference = context.findRoleMapping(name);
- }
- }
-
return reference;
}
diff --git a/java/org/apache/catalina/realm/RealmBase.java
b/java/org/apache/catalina/realm/RealmBase.java
index 80bf05d362..e57de2ecd1 100644
--- a/java/org/apache/catalina/realm/RealmBase.java
+++ b/java/org/apache/catalina/realm/RealmBase.java
@@ -910,9 +910,13 @@ public abstract class RealmBase extends LifecycleMBeanBase
implements Realm {
public boolean hasRole(Wrapper wrapper, Principal principal, String role) {
// Check for a role alias
if (wrapper != null) {
- String realRole = wrapper.findSecurityReference(role);
- if (realRole != null) {
- role = realRole;
+ Container parent = wrapper.getParent();
+ if (parent instanceof Context) {
+ Context context = (Context) parent;
+ String realRole = context.findRoleMapping(role);
+ if (realRole != null) {
+ role = realRole;
+ }
}
}
diff --git a/test/org/apache/catalina/core/TestStandardWrapper.java
b/test/org/apache/catalina/core/TestStandardWrapper.java
index 1c30e1600c..79a201f020 100644
--- a/test/org/apache/catalina/core/TestStandardWrapper.java
+++ b/test/org/apache/catalina/core/TestStandardWrapper.java
@@ -248,6 +248,8 @@ public class TestStandardWrapper extends TomcatBaseTest {
ctx.addRoleMapping("testRole", "very-complex-role-name");
Wrapper wrapper = Tomcat.addServlet(ctx, "servlet",
RoleAllowServlet.class.getName());
+ wrapper.addSecurityReference("testSecurityRoleRef",
"very-complex-role-name");
+ wrapper.addSecurityReference("testSecurityRoleRef2", "testRole");
ctx.addServletMappingDecoded("/", "servlet");
ctx.setLoginConfig(new LoginConfig("BASIC", null, null, null));
@@ -351,6 +353,8 @@ public class TestStandardWrapper extends TomcatBaseTest {
TesterMapRealm realm = new TesterMapRealm();
realm.addUser("testUser", "testPwd");
realm.addUserRole("testUser", "testRole");
+ realm.addUserRole("testUser", "testSecurityRoleRef");
+ realm.addUserRole("testUser", "testSecurityRoleRef2");
ctx.setRealm(realm);
ctx.setLoginConfig(new LoginConfig("BASIC", null, null, null));
@@ -429,6 +433,14 @@ public class TestStandardWrapper extends TomcatBaseTest {
@ServletSecurity(@HttpConstraint(rolesAllowed = "testRole"))
public static class RoleAllowServlet extends TestServlet {
private static final long serialVersionUID = 1L;
+
+ @Override
+ protected void doGet(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
+ if (!req.isUserInRole("testSecurityRoleRef") ||
!req.isUserInRole("testSecurityRoleRef2")) {
+ throw new ServletException("Non functional security-role-ref");
+ }
+ super.doGet(req, resp);
+ }
}
@ServletSecurity(@HttpConstraint(rolesAllowed = "otherRole"))
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index abc18f432d..b0ae84dff2 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -157,6 +157,10 @@
the client provided nonce count is at the upper boundary of the window
(markt).
</fix>
+ <update>
+ Separate the <code>Context</code> role mapping from the Servlet
+ specification <code>security-role-ref</code>. (remm)
+ </update>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
