Package org.eclipse.jetty.ee10.servlet.security

Class ConstraintSecurityHandler

java.lang.Object
org.eclipse.jetty.util.component.AbstractLifeCycle
org.eclipse.jetty.util.component.ContainerLifeCycle
org.eclipse.jetty.server.Handler.Abstract
org.eclipse.jetty.server.Handler.AbstractContainer
org.eclipse.jetty.server.Handler.Wrapper
org.eclipse.jetty.security.SecurityHandler
org.eclipse.jetty.ee10.servlet.security.ConstraintSecurityHandler
All Implemented Interfaces:
ConstraintAware, Authenticator.Configuration, Handler, Handler.Container, Handler.Singleton, Request.Handler, Container, Destroyable, Dumpable, Dumpable.DumpableContainer, LifeCycle, Invocable
public class ConstraintSecurityHandler extends SecurityHandler implements ConstraintAware
ConstraintSecurityHandler

Handler to enforce SecurityConstraints. This implementation is servlet spec 3.1 compliant and pre-computes the constraint combinations for runtime efficiency.

  • Field Details

  • Constructor Details

    • ConstraintSecurityHandler

      public ConstraintSecurityHandler()

  • Method Details

    • getConstraint

      protected Constraint getConstraint(String pathInContext, Request request)
      Specified by:
      getConstraint in class SecurityHandler

    • createConstraint

      public static Constraint createConstraint(String name, jakarta.servlet.HttpConstraintElement element)
      Create a Constraint
      Parameters:
      name - the name
      element - the http constraint element
      Returns:
      the created constraint

    • createConstraint

      public static Constraint createConstraint(String name, String[] rolesAllowed, jakarta.servlet.annotation.ServletSecurity.EmptyRoleSemantic permitOrDeny, jakarta.servlet.annotation.ServletSecurity.TransportGuarantee transport)
      Create Constraint
      Parameters:
      name - the name
      rolesAllowed - the list of allowed roles
      permitOrDeny - the permission semantic
      transport - the transport guarantee
      Returns:
      the created constraint

    • removeConstraintMappingsForPath

      public static List<ConstraintMapping> removeConstraintMappingsForPath(String pathSpec, List<ConstraintMapping> constraintMappings)
      Take out of the constraint mappings those that match the given path.
      Parameters:
      pathSpec - the path spec
      constraintMappings - a new list minus the matching constraints
      Returns:
      the list of constraint mappings

    • createConstraintsWithMappingsForPath

      public static List<ConstraintMapping> createConstraintsWithMappingsForPath(String name, String pathSpec, jakarta.servlet.ServletSecurityElement securityElement)
      Generate Constraints and ConstraintMappings for the given url pattern and ServletSecurityElement
      Parameters:
      name - the name
      pathSpec - the path spec
      securityElement - the servlet security element
      Returns:
      the list of constraint mappings

    • getConstraintMappings

      public List<ConstraintMapping> getConstraintMappings()
      Specified by:
      getConstraintMappings in interface ConstraintAware

    • getKnownRoles

      public Set<String> getKnownRoles()
      Specified by:
      getKnownRoles in interface ConstraintAware
      Overrides:
      getKnownRoles in class SecurityHandler

    • setConstraintMappings

      public void setConstraintMappings(List<ConstraintMapping> constraintMappings)
      Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the Constraint class.
      Parameters:
      constraintMappings - The constraintMappings to set, from which the set of known roles is determined.

    • setConstraintMappings

      public void setConstraintMappings(ConstraintMapping[] constraintMappings)
      Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the Constraint class.
      Parameters:
      constraintMappings - The constraintMappings to set as array, from which the set of known roles is determined. Needed to retain API compatibility for 7.x

    • setConstraintMappings

      public void setConstraintMappings(List<ConstraintMapping> constraintMappings, Set<String> roles)
      Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the Constraint class.
      Specified by:
      setConstraintMappings in interface ConstraintAware
      Parameters:
      constraintMappings - The constraintMappings to set.
      roles - The known roles (or null to determine them from the mappings)

    • setRoles

      public void setRoles(Set<String> roles)
      Set the known roles. This may be overridden by a subsequent call to setConstraintMappings(ConstraintMapping[]) or setConstraintMappings(List, Set).
      Parameters:
      roles - The known roles (or null to determine them from the mappings)

    • addConstraintMapping

      public void addConstraintMapping(ConstraintMapping mapping)
      Description copied from interface: ConstraintAware
      Add a Constraint Mapping. May be called for running webapplication as an annotated servlet is instantiated.
      Specified by:
      addConstraintMapping in interface ConstraintAware
      Parameters:
      mapping - the mapping

    • addKnownRole

      public void addKnownRole(String role)
      Description copied from interface: ConstraintAware
      Add a Role definition. May be called on running webapplication as an annotated servlet is instantiated.
      Specified by:
      addKnownRole in interface ConstraintAware
      Parameters:
      role - the role

    • doStart

      protected void doStart() throws Exception
      Description copied from class: ContainerLifeCycle
      Starts the managed lifecycle beans in the order they were added.
      Overrides:
      doStart in class SecurityHandler
      Throws:
      AbstractLifeCycle.StopException - If thrown, the lifecycle will immediately be stopped.
      Exception - If there was a problem starting. Will cause a transition to FAILED state

    • doStop

      protected void doStop() throws Exception
      Description copied from class: ContainerLifeCycle
      Stops the managed lifecycle beans in the reverse order they were added.
      Overrides:
      doStop in class SecurityHandler
      Throws:
      Exception - If there was a problem stopping. Will cause a transition to FAILED state

    • combineServletConstraints

      protected Constraint combineServletConstraints(Constraint constraintA, Constraint constraintB)

      Combine constrains as per the servlet specification. This is NOT equivalent to Constraint.combine(Constraint, Constraint), which implements a more secure combination.

      Parameters:
      constraintA - A constraint
      constraintB - B constraint
      Returns:
      The combination as per the servlet specification.

    • processConstraintMapping

      protected void processConstraintMapping(ConstraintMapping mapping)
      Create and combine the constraint with the existing processed constraints.
      Parameters:
      mapping - the constraint mapping

    • processConstraintMappingWithMethodOmissions

      protected void processConstraintMappingWithMethodOmissions(ConstraintMapping mapping, Map<String,Constraint> mappings)
      Constraints that name method omissions are dealt with differently. We create an entry in the mappings with key "<method>.omission". This entry is only ever combined with other omissions for the same method to produce a consolidated Constraint. Then, when we wish to find the relevant constraints for a given Request (in prepareConstraintInfo()), we consult 3 types of entries in the mappings: an entry that names the method of the Request specifically, an entry that names constraints that apply to all methods, entries of the form <method>.omission, where the method of the Request is not named in the omission.
      Parameters:
      mapping - the constraint mapping
      mappings - the mappings of roles

    • dump

      public void dump(Appendable out, String indent) throws IOException
      Description copied from interface: Dumpable
      Dump this object (and children) into an Appendable using the provided indent after any new lines. The indent should not be applied to the first object dumped.
      Specified by:
      dump in interface Dumpable
      Overrides:
      dump in class ContainerLifeCycle
      Parameters:
      out - The appendable to dump to
      indent - The indent to apply after any new lines.
      Throws:
      IOException - if unable to write to Appendable

    • setDenyUncoveredHttpMethods

      public void setDenyUncoveredHttpMethods(boolean deny)
      Description copied from interface: ConstraintAware
      See Servlet Spec 31, sec 13.8.4, pg 145 When true, requests with http methods not explicitly covered either by inclusion or omissions in constraints, will have access denied.
      Specified by:
      setDenyUncoveredHttpMethods in interface ConstraintAware
      Parameters:
      deny - true for denied method access

    • isDenyUncoveredHttpMethods

      public boolean isDenyUncoveredHttpMethods()
      Specified by:
      isDenyUncoveredHttpMethods in interface ConstraintAware

    • checkPathsWithUncoveredHttpMethods

      public boolean checkPathsWithUncoveredHttpMethods()
      Servlet spec 3.1 pg. 147.
      Specified by:
      checkPathsWithUncoveredHttpMethods in interface ConstraintAware
      Returns:
      true if urls with uncovered http methods

    • getPathsWithUncoveredHttpMethods

      public Set<String> getPathsWithUncoveredHttpMethods()
      Servlet spec 3.1 pg. 147. The container must check all the combined security constraint information and log any methods that are not protected and the urls at which they are not protected
      Returns:
      Set of paths for which there are uncovered methods

    • omissionsExist

      protected boolean omissionsExist(Map<String,Constraint> methodMappings)
      Check if any http method omissions exist in the list of method to auth info mappings.
      Parameters:
      methodMappings - the method mappings
      Returns:
      true if omission exist

    • getOmittedMethods

      protected Set<String> getOmittedMethods(String omission)
      Given a string of the form <method>.<method>.omission split out the individual method names.
      Parameters:
      omission - the method
      Returns:
      the set of strings