Author: angela
Date: Wed Jun 5 12:07:07 2019
New Revision: 1860653
URL: http://svn.apache.org/viewvc?rev=1860653&view=rev
Log:
OAK-8383 : AccessControlValidator: check for duplicate ACE ignores allow/deny
status
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidator.java
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidatorTest.java
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidator.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidator.java?rev=1860653&r1=1860652&r2=1860653&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidator.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidator.java
Wed Jun 5 12:07:07 2019
@@ -302,11 +302,13 @@ class AccessControlValidator extends Def
private final class Entry {
+ private final boolean isAllow;
private final String principalName;
private final PrivilegeBits privilegeBits;
private final Set<Restriction> restrictions;
private Entry(String path, Tree aceTree) {
+ isAllow =
NT_REP_GRANT_ACE.equals(TreeUtil.getPrimaryTypeName(aceTree));
principalName =
aceTree.getProperty(REP_PRINCIPAL_NAME).getValue(Type.STRING);
privilegeBits =
privilegeBitsProvider.getBits(aceTree.getProperty(REP_PRIVILEGES).getValue(Type.NAMES));
restrictions = restrictionProvider.readRestrictions(path, aceTree);
@@ -314,7 +316,7 @@ class AccessControlValidator extends Def
@Override
public int hashCode() {
- return Objects.hashCode(principalName, privilegeBits,
restrictions);
+ return Objects.hashCode(principalName, privilegeBits,
restrictions, isAllow);
}
@Override
@@ -324,7 +326,8 @@ class AccessControlValidator extends Def
}
if (o instanceof Entry) {
Entry other = (Entry) o;
- return Objects.equal(principalName, other.principalName)
+ return isAllow == other.isAllow
+ && Objects.equal(principalName, other.principalName)
&& privilegeBits.equals(other.privilegeBits)
&& restrictions.equals(other.restrictions);
}
Modified:
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidatorTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidatorTest.java?rev=1860653&r1=1860652&r2=1860653&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidatorTest.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/AccessControlValidatorTest.java
Wed Jun 5 12:07:07 2019
@@ -16,17 +16,6 @@
*/
package org.apache.jackrabbit.oak.security.authorization.accesscontrol;
-import java.security.Principal;
-import java.util.List;
-import java.util.Set;
-import javax.jcr.AccessDeniedException;
-import javax.jcr.PropertyType;
-import javax.jcr.Value;
-import javax.jcr.ValueFactory;
-import javax.jcr.ValueFormatException;
-import javax.jcr.security.AccessControlManager;
-
-import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import org.apache.jackrabbit.JcrConstants;
@@ -35,45 +24,39 @@ import org.apache.jackrabbit.api.securit
import
org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils;
import org.apache.jackrabbit.oak.AbstractSecurityTest;
import org.apache.jackrabbit.oak.api.CommitFailedException;
-import org.apache.jackrabbit.oak.api.Root;
import org.apache.jackrabbit.oak.api.Tree;
import org.apache.jackrabbit.oak.commons.PathUtils;
-import org.apache.jackrabbit.oak.namepath.NamePathMapper;
import org.apache.jackrabbit.oak.plugins.memory.MemoryNodeStore;
import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
import
org.apache.jackrabbit.oak.security.authorization.AuthorizationConfigurationImpl;
import
org.apache.jackrabbit.oak.security.authorization.composite.CompositeAuthorizationConfiguration;
import
org.apache.jackrabbit.oak.security.authorization.restriction.RestrictionProviderImpl;
-import org.apache.jackrabbit.oak.security.internal.SecurityProviderBuilder;
import org.apache.jackrabbit.oak.security.internal.SecurityProviderHelper;
-import org.apache.jackrabbit.oak.spi.commit.CommitHook;
import org.apache.jackrabbit.oak.spi.commit.CommitInfo;
-import org.apache.jackrabbit.oak.spi.commit.MoveTracker;
-import org.apache.jackrabbit.oak.spi.commit.ThreeWayConflictHandler;
import org.apache.jackrabbit.oak.spi.commit.Validator;
-import org.apache.jackrabbit.oak.spi.commit.ValidatorProvider;
-import org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer;
-import org.apache.jackrabbit.oak.spi.lifecycle.WorkspaceInitializer;
import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants;
import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
import org.apache.jackrabbit.oak.spi.security.Context;
-import org.apache.jackrabbit.oak.spi.security.SecurityConfiguration;
import
org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration;
import
org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
-import
org.apache.jackrabbit.oak.spi.security.authorization.permission.OpenPermissionProvider;
-import
org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider;
import
org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction;
import
org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
import org.apache.jackrabbit.oak.spi.state.NodeBuilder;
import org.apache.jackrabbit.oak.spi.state.NodeState;
-import org.apache.jackrabbit.oak.spi.xml.ProtectedItemImporter;
import org.apache.jackrabbit.oak.util.NodeUtil;
import org.jetbrains.annotations.NotNull;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
+import javax.jcr.AccessDeniedException;
+import javax.jcr.PropertyType;
+import javax.jcr.Value;
+import javax.jcr.ValueFactory;
+import javax.jcr.security.AccessControlManager;
+import java.security.Principal;
+
import static org.hamcrest.CoreMatchers.containsString;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
@@ -421,6 +404,18 @@ public class AccessControlValidatorTest
}
@Test
+ public void testAceDifferentByAllowStatus() throws Exception {
+ Tree policy = createAcl().getTree();
+ policy.setOrderableChildren(true);
+ Tree entry = policy.getChild(aceName);
+ Tree entry2 = TreeUtil.addChild(policy, "second", NT_REP_DENY_ACE);
+ entry2.setProperty(entry.getProperty(REP_PRINCIPAL_NAME));
+ entry2.setProperty(entry.getProperty(REP_PRIVILEGES));
+
+ root.commit();
+ }
+
+ @Test
public void testAceDifferentByRestrictionValue() throws Exception {
ValueFactory vf = getValueFactory(root);
