Skip to content

Commit 9b4ca6c

Browse files
Brutus5000Brutus5000
committed
Revert "Replace deprecated methods"
This reverts commit d30f4c3.
1 parent d30f4c3 commit 9b4ca6c

2 files changed

Lines changed: 67 additions & 22 deletions

File tree

‎src/main/java/com/faforever/api/config/security/WebSecurityConfig.java‎

Lines changed: 62 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,23 @@
44
import org.springframework.context.annotation.Bean;
55
import org.springframework.context.annotation.Configuration;
66
import org.springframework.http.HttpMethod;
7+
import org.springframework.security.authentication.BadCredentialsException;
8+
import org.springframework.security.authentication.InternalAuthenticationServiceException;
9+
import org.springframework.security.authentication.LockedException;
710
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
811
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
912
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
10-
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
1113
import org.springframework.security.oauth2.server.resource.web.DefaultBearerTokenResolver;
1214
import org.springframework.security.web.SecurityFilterChain;
15+
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
16+
import org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler;
17+
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
18+
import org.springframework.security.web.util.matcher.OrRequestMatcher;
19+
import org.springframework.security.web.util.matcher.RequestMatcher;
20+
21+
import jakarta.servlet.http.HttpServletRequest;
22+
import java.util.Map;
23+
import java.util.regex.Pattern;
1324

1425
@Configuration
1526
@EnableWebSecurity
@@ -20,21 +31,55 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
2031
final var bearerTokenResolver = new DefaultBearerTokenResolver();
2132
bearerTokenResolver.setAllowUriQueryParameter(true);
2233

23-
return http.headers(headersConfig ->
24-
headersConfig.cacheControl(HeadersConfigurer.CacheControlConfig::disable)
25-
)
26-
.formLogin(AbstractHttpConfigurer::disable)
27-
.oauth2ResourceServer(oauth2Config ->
28-
oauth2Config
29-
.bearerTokenResolver(bearerTokenResolver)
30-
.jwt(jwtConfig -> jwtConfig.jwtAuthenticationConverter(new FafAuthenticationConverter()))
31-
)
32-
.authorizeHttpRequests(authorizeConfig ->
33-
authorizeConfig
34-
.requestMatchers(HttpMethod.OPTIONS).permitAll()
35-
// Swagger UI
36-
.requestMatchers("/swagger-ui/**", "/swagger-resources/**", "/v3/api-docs/**", "/").permitAll()
37-
// Webapp folder
38-
.requestMatchers("/css/*", "/favicon.ico", "/robots.txt").permitAll()).build();
34+
// @formatter:off
35+
http.csrf(csrfConfig -> csrfConfig.requireCsrfProtectionMatcher(new RequestMatcher() {
36+
private final Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");
37+
private final RequestMatcher matcher = new OrRequestMatcher(
38+
new AntPathRequestMatcher("/oauth/authorize"),
39+
new AntPathRequestMatcher("/login"));
40+
41+
@Override
42+
public boolean matches(HttpServletRequest request) {
43+
return matcher.matches(request) && !allowedMethods.matcher(request.getMethod()).matches();
44+
}
45+
}));
46+
http.headers(headersConfig -> headersConfig.cacheControl().disable());
47+
http.formLogin(AbstractHttpConfigurer::disable);
48+
http.oauth2ResourceServer(oauth2Config -> {
49+
oauth2Config.bearerTokenResolver(bearerTokenResolver);
50+
oauth2Config.jwt(jwtConfig -> jwtConfig.jwtAuthenticationConverter(new FafAuthenticationConverter()));
51+
});
52+
http.authorizeRequests(authorizeConfig -> {
53+
authorizeConfig.requestMatchers(HttpMethod.OPTIONS).permitAll();
54+
// Swagger UI
55+
authorizeConfig.requestMatchers(
56+
"/swagger-ui/**",
57+
"/swagger-resources/**",
58+
"/v3/api-docs/**",
59+
"/"
60+
).permitAll();
61+
// Webapp folder
62+
authorizeConfig.requestMatchers(
63+
"/css/*",
64+
"/favicon.ico",
65+
"/robots.txt"
66+
).permitAll();
67+
});
68+
// @formatter:on
69+
return http.build();
70+
}
71+
72+
@Bean
73+
public AuthenticationFailureHandler authenticationFailureHandler() {
74+
Map<Object, String> exceptionMappings = Map.of(
75+
InternalAuthenticationServiceException.class.getCanonicalName(), "/login?error=serverError",
76+
BadCredentialsException.class.getCanonicalName(), "/login?error=badCredentials",
77+
LockedException.class.getCanonicalName(), "/login?error=locked"
78+
);
79+
80+
final ExceptionMappingAuthenticationFailureHandler result = new ExceptionMappingAuthenticationFailureHandler();
81+
result.setExceptionMappings(exceptionMappings);
82+
result.setDefaultFailureUrl("/login?error=unknown");
83+
return result;
3984
}
4085
}

‎src/test/java/com/faforever/api/mod/ModServiceTest.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
import java.util.zip.ZipOutputStream;
3737

3838
import static com.faforever.api.error.ApiExceptionMatcher.hasErrorCode;
39-
import static org.apache.commons.lang3.RandomStringUtils.insecure;
39+
import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
4040
import static org.hamcrest.CoreMatchers.is;
4141
import static org.hamcrest.CoreMatchers.nullValue;
4242
import static org.hamcrest.MatcherAssert.assertThat;
@@ -120,7 +120,7 @@ public void processUploadedMod() throws Exception {
120120
assertThat(savedMod.getUploader(), is(uploader));
121121
assertThat(savedMod.getRepositoryUrl(), is(repositoryUrl));
122122

123-
ModVersion savedModVersion = savedMod.getVersions().getFirst();
123+
ModVersion savedModVersion = savedMod.getVersions().get(0);
124124

125125
assertThat(savedModVersion.getId(), is(nullValue()));
126126
assertThat(savedModVersion.getIcon(), is("no_friendly_fire.v0003.png"));
@@ -203,14 +203,14 @@ public void testDisplayNameMissing() throws Exception {
203203

204204
@Test
205205
public void testDisplayNameTooLong() throws Exception {
206-
Path uploadFile = prepareModDynamic(luaContent().setName(insecure().nextAlphanumeric(111)));
206+
Path uploadFile = prepareModDynamic(luaContent().setName(randomAlphanumeric(111)));
207207
ApiException result = assertThrows(ApiException.class, () -> instance.processUploadedMod(uploadFile, TEST_MOD_FILENAME, new Player(), null, null));
208208
assertThat(result, hasErrorCode(ErrorCode.MOD_NAME_TOO_LONG));
209209
}
210210

211211
@Test
212212
public void testDisplayNameTooShort() throws Exception {
213-
Path uploadFile = prepareModDynamic(luaContent().setName(insecure().nextAlphanumeric(2)));
213+
Path uploadFile = prepareModDynamic(luaContent().setName(randomAlphanumeric(2)));
214214
ApiException result = assertThrows(ApiException.class, () -> instance.processUploadedMod(uploadFile, TEST_MOD_FILENAME, new Player(), null, null));
215215
assertThat(result, hasErrorCode(ErrorCode.MOD_NAME_TOO_SHORT));
216216
}
@@ -268,7 +268,7 @@ public void testAuthorMissing() throws Exception {
268268
@NotNull
269269
private LuaContent luaContent() {
270270
return new LuaContent()
271-
.setName(insecure().nextAlphanumeric(50))
271+
.setName(randomAlphanumeric(50))
272272
.setVersion("3")
273273
.setAuthor("The Author")
274274
.setCopyright("The Copyright")

0 commit comments

Comments
 (0)