[JBoss JIRA] (AS7-3415) security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee parameter
7:32 a.m.
Peter Skopek created AS7-3415:
---------------------------------
Summary: security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:46 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Remy Maucherat commented on AS7-3415:
-------------------------------------
Please provide a test WAR.
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:09 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Peter Skopek commented on AS7-3415:
-----------------------------------
Check https://github.com/jbossas/jboss-as/pull/1187
org.jboss.as.test.integration.web.security.tg.TransportGuaranteeTestCase
The test is marked with @Ignore("AS7-3415")
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:33 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Remy Maucherat resolved AS7-3415.
---------------------------------
Resolution: Rejected
Ok, so it's invalid then. A servlet security does not apply to paths that have any
static constraint, but your constaint from web.xml is not the exact match, so it's
just there doing nothing.
You probably shouldn't be writing tests that duplicate tests in the TCK IMO.
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:11 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Peter Skopek commented on AS7-3415:
-----------------------------------
I have added one commit to the pull request above.
Security constraint url-pattern in web.xml contains /tg_mixed_override/* and servlet is
mapped on /tg_mixed_override/srv/*
Test is failing because access on non confidential transport is possible and IMO it should
not be.
The truth is that if one changes security constraint url-pattern to
/tg_mixed_override/srv/* test passes.
I cannot see any part of spec. which say that in case of static constraint is used
constraint from web.xml has to be exact match.
The same case works for test set up with non-annotated servlet and web.xml DD.
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:11 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Peter Skopek reopened AS7-3415:
-------------------------------
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:27 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Remy Maucherat resolved AS7-3415.
---------------------------------
Resolution: Rejected
Please do not reopen the jira. Yes, your test is invalid, the url-pattern must be the
exact match for overriding.
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:12 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Peter Skopek commented on AS7-3415:
-----------------------------------
Well, let be little bit more specific why it has to be the exact match.
Chapter 13.8.3 Processing Requests of the Java Servlet Specification v.3.0 says:
When a Servlet container receives a request, it shall use the algorithm described in
“Use of URL Paths” on page 95 to select the constraints (if any) defined on the url-
pattern that is *the best match* to the request URI.
I still don't see any mention of exact match to url pattern, so I think the test is
valid and the problem has to be fixed.
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:36 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Remy Maucherat commented on AS7-3415:
-------------------------------------
One of the things that I hate most are bogus bug reports, where something wrong is
presented in a "logical" and "reasonable" way, and could prompt making
"fixes" that are actual regressions - and a regression here is automatically a
security issue. Please read the chapter on @ServletSecurity, it explains how it is
processed.
You don't have to write spec tests like they are in the TCK (with plenty of
@ServletSecurity tests already for the quite complicated processing of @ServletSecurity),
but rather AS specific ones, like using jboss-web.xml to make configuration changes
maybe.
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:22 a.m.
[
https://issues.jboss.org/browse/AS7-3415?page=com.atlassian.jira.plugin.s...
]
Peter Skopek commented on AS7-3415:
-----------------------------------
Remy, I am sorry my fault.
I had "proposed final draft" of spec where this chapter was completely missing.
Tests are fixed.
security-constraint/user-data-constraint/transport-guarantee in
web.xml file doesn't override setting from servlet @ServletSecurity transportGuarantee
parameter
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Key: AS7-3415
URL: https://issues.jboss.org/browse/AS7-3415
Project: Application Server 7
Issue Type: Bug
Components: Web
Affects Versions: 7.1.0.CR1b
Reporter: Peter Skopek
Assignee: Remy Maucherat
security-constraint/user-data-constraint/transport-guarantee in web.xml file doesn't
override setting from servlet @ServletSecurity transportGuarantee parameter
{noformat}
My settings:
@ServletSecurity(@HttpConstraint(rolesAllowed = { "gooduser" },
transportGuarantee = TransportGuarantee.CONFIDENTIAL) )
web.xml excerpt:
<security-constraint>
<web-resource-collection>
<web-resource-name>sec</web-resource-name>
<url-pattern>/tgmixed/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>gooduser</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
{noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4640
days inactive
4641
days old
9 comments
2 participants
participants (2)
-
Peter Skopek (JIRA) -
Remy Maucherat (JIRA)