Add spring security to mitigate cve-2017-4995
[vfc/nfvo/driver/vnfm/svnfm.git] / nokiav2 / driver / src / test / java / org / onap / vfc / nfvo / driver / vnfm / svnfm / nokia / spring / TestSecurityConfig.java
1 /*
2  * Copyright 2016-2017, Nokia Corporation
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *     http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16
17 package org.onap.vfc.nfvo.driver.vnfm.svnfm.nokia.spring;
18
19 import org.junit.Test;
20 import org.mockito.Mockito;
21 import org.springframework.security.config.annotation.ObjectPostProcessor;
22 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
23 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
24 import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
25 import org.springframework.security.web.util.matcher.AnyRequestMatcher;
26 import org.springframework.security.web.util.matcher.RequestMatcher;
27 import org.springframework.test.util.ReflectionTestUtils;
28
29 import java.util.HashMap;
30 import java.util.List;
31
32 import static junit.framework.TestCase.assertTrue;
33
34 public class TestSecurityConfig {
35
36     /**
37      * verify that not authentication is performed
38      * this can only fully be tested from CT by starting the web service
39      */
40     @Test
41     public void testSpringBootApplicationInit() throws Exception {
42         HttpSecurity http = new HttpSecurity(Mockito.mock(ObjectPostProcessor.class), Mockito.mock(AuthenticationManagerBuilder.class), new HashMap<>());
43         //when
44         new SecurityConfig().configure(http);
45         //verify
46         ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl authorizedUrl = http.authorizeRequests().anyRequest();
47         List<? extends RequestMatcher> requestMatchers = (List<? extends RequestMatcher>) ReflectionTestUtils.getField(authorizedUrl, "requestMatchers");
48         assertTrue(AnyRequestMatcher.class.isAssignableFrom(requestMatchers.get(0).getClass()));
49     }
50
51 }