fix security bug

xlorne · xlorne · commit ee3ddfc4bc36 · 2023-04-23T02:20:39.000+08:00
diff --git a/springboot-starter-security-jwt/src/main/java/com/codingapi/springboot/security/AutoConfiguration.java b/springboot-starter-security-jwt/src/main/java/com/codingapi/springboot/security/AutoConfiguration.java
@@ -82,7 +82,8 @@ public SecurityFilterChain filterChain(HttpSecurity security, Jwt jwt,SecurityLo
                 .and()
                 .authorizeHttpRequests(
                         registry -> {
-                            registry.requestMatchers(properties.getAuthenticatedUrls()).authenticated()
+                            registry.requestMatchers(properties.getIgnoreUrls()).permitAll()
+                                    .requestMatchers(properties.getAuthenticatedUrls()).authenticated()
                                     .anyRequest().permitAll();
                         }
                 )
diff --git a/springboot-starter-security-jwt/src/main/java/com/codingapi/springboot/security/configurer/HttpSecurityConfigurer.java b/springboot-starter-security-jwt/src/main/java/com/codingapi/springboot/security/configurer/HttpSecurityConfigurer.java
@@ -19,9 +19,9 @@ public class HttpSecurityConfigurer extends AbstractHttpConfigurer<HttpSecurityC
     private final SecurityJwtProperties securityJwtProperties;
 
     @Override
-    public void configure(HttpSecurity http) throws Exception {
-        AuthenticationManager manager = http.getSharedObject(AuthenticationManager.class);
-        http.addFilter(new MyLoginFilter(manager, jwt,securityLoginHandler, securityJwtProperties));
-        http.addFilter(new MyAuthenticationFilter(manager, jwt));
+    public void configure(HttpSecurity security) throws Exception {
+        AuthenticationManager manager = security.getSharedObject(AuthenticationManager.class);
+        security.addFilter(new MyLoginFilter(manager, jwt,securityLoginHandler, securityJwtProperties));
+        security.addFilter(new MyAuthenticationFilter(manager,securityJwtProperties,jwt));
     }
 }
diff --git a/springboot-starter-security-jwt/src/main/java/com/codingapi/springboot/security/filter/MyAuthenticationFilter.java b/springboot-starter-security-jwt/src/main/java/com/codingapi/springboot/security/filter/MyAuthenticationFilter.java
@@ -5,23 +5,21 @@
 import com.codingapi.springboot.security.exception.TokenExpiredException;
 import com.codingapi.springboot.security.jwt.Jwt;
 import com.codingapi.springboot.security.jwt.Token;
+import com.codingapi.springboot.security.properties.SecurityJwtProperties;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.io.IOUtils;
-import org.springframework.security.authentication.AuthenticationDetailsSource;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.authentication.www.BasicAuthenticationConverter;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
-import org.springframework.util.Assert;
+import org.springframework.util.AntPathMatcher;
 import org.springframework.util.StringUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
 
 import java.io.IOException;
-import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 
 @Slf4j
@@ -31,54 +29,44 @@ public class MyAuthenticationFilter extends BasicAuthenticationFilter {
 
     private final Jwt jwt;
 
-    private final BasicAuthenticationConverter authenticationConverter = new BasicAuthenticationConverter();
+    private final SecurityJwtProperties securityJwtProperties;
+    private final AntPathMatcher antPathMatcher = new AntPathMatcher();
 
-    public MyAuthenticationFilter(AuthenticationManager authenticationManager, Jwt jwt) {
-        super(authenticationManager);
+    public MyAuthenticationFilter(AuthenticationManager manager, SecurityJwtProperties securityJwtProperties, Jwt jwt) {
+        super(manager);
         this.jwt = jwt;
+        this.securityJwtProperties = securityJwtProperties;
     }
 
-    public void setAuthenticationDetailsSource(AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource) {
-        this.authenticationConverter.setAuthenticationDetailsSource(authenticationDetailsSource);
-    }
-
-    public void setCredentialsCharset(String credentialsCharset) {
-        Assert.hasText(credentialsCharset, "credentialsCharset cannot be null or empty");
-        this.authenticationConverter.setCredentialsCharset(Charset.forName(credentialsCharset));
-    }
 
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
         log.debug("token authentication ~");
-
-        UsernamePasswordAuthenticationToken authRequest = authenticationConverter.convert(request);
-        if (authRequest == null) {
-            this.logger.trace("Did not process authentication request since failed to find username and password in Basic Authorization header");
-            chain.doFilter(request, response);
-            return;
+        for (String antUrl : securityJwtProperties.getAuthenticatedUrls()) {
+            if(antPathMatcher.match(antUrl,request.getRequestURI())) {
+
+                String sign = request.getHeader(TOKEN_KEY);
+                if (!StringUtils.hasLength(sign)) {
+                    writeResponse(response, Response.buildFailure("token.error", "token must not null."));
+                    return;
+                }
+
+                Token token = jwt.parser(sign);
+                if (token.canRestToken()) {
+                    Token newSign = jwt.create(token.getUsername(), token.decodeIv(), token.getAuthorities(), token.getExtra());
+                    log.info("reset token ");
+                    response.setHeader(TOKEN_KEY, newSign.getToken());
+                }
+                try {
+                    token.verify();
+                } catch (TokenExpiredException e) {
+                    writeResponse(response, Response.buildFailure("token.expire", "token expire."));
+                    return;
+                }
+
+                SecurityContextHolder.getContext().setAuthentication(token.getAuthenticationToken());
+            }
         }
-
-        String sign = request.getHeader(TOKEN_KEY);
-        if (!StringUtils.hasLength(sign)) {
-            writeResponse(response, Response.buildFailure("token.error", "token must not null."));
-            return;
-        }
-
-        Token token = jwt.parser(sign);
-        if (token.canRestToken()) {
-            Token newSign = jwt.create(token.getUsername(), token.decodeIv(), token.getAuthorities(),token.getExtra());
-            log.info("reset token ");
-            response.setHeader(TOKEN_KEY, newSign.getToken());
-        }
-        try {
-            token.verify();
-        } catch (TokenExpiredException e) {
-            writeResponse(response, Response.buildFailure("token.expire", "token expire."));
-            return;
-        }
-
-        SecurityContextHolder.getContext().setAuthentication(token.getAuthenticationToken());
-
         chain.doFilter(request, response);
 
     }
@@ -87,4 +75,6 @@ private void writeResponse(HttpServletResponse servletResponse, Response returnR
         String content = JSONObject.toJSONString(returnResponse);
         IOUtils.write(content, servletResponse.getOutputStream(), StandardCharsets.UTF_8);
     }
+
+
 }
diff --git a/springboot-starter-security-jwt/src/test/java/com/codingapi/springboot/security/SecurityJwtApplicationTest.java b/springboot-starter-security-jwt/src/test/java/com/codingapi/springboot/security/SecurityJwtApplicationTest.java
@@ -32,26 +32,40 @@ void login() throws Exception {
         JSONObject json = new JSONObject();
         json.put("username","admin");
         json.put("password","123456");
-        mockMvc.perform(post("/user/login").content(json.toJSONString().getBytes(StandardCharsets.UTF_8)).contentType(MediaType.APPLICATION_JSON)).andExpect(status().isOk());
+        mockMvc.perform(post("/user/login")
+                .content(json.toJSONString().getBytes(StandardCharsets.UTF_8))
+                .contentType(MediaType.APPLICATION_JSON)).andExpect(status().isOk());
     }
 
     @Test
     void noToken() throws Exception {
-        mockMvc.perform(get("/api/hello").contentType(MediaType.APPLICATION_JSON)).andExpect(result -> {
+        mockMvc.perform(get("/api/hello")
+                .contentType(MediaType.APPLICATION_JSON)).andExpect(result -> {
             String body = result.getResponse().getContentAsString();
             JSONObject jsonObject = JSONObject.parseObject(body);
             log.info("body:{}",jsonObject);
             assertEquals(jsonObject.getString("errCode"),"token.error","token authentication error");
         });
     }
 
+    @Test
+    void random() throws Exception {
+        mockMvc.perform(get("/xxx/hello")
+                .contentType(MediaType.APPLICATION_JSON))
+                .andExpect(result -> {
+            assertEquals(404,result.getResponse().getStatus());
+        });
+    }
+
     @Test
     void haveToken() throws Exception {
 
         JSONObject json = new JSONObject();
         json.put("username","admin");
         json.put("password","123456");
-        MvcResult mvcResult =  mockMvc.perform(post("/user/login").content(json.toJSONString().getBytes(StandardCharsets.UTF_8)).contentType(MediaType.APPLICATION_JSON)).andReturn();
+        MvcResult mvcResult =  mockMvc.perform(post("/user/login")
+                .content(json.toJSONString().getBytes(StandardCharsets.UTF_8))
+                .contentType(MediaType.APPLICATION_JSON)).andReturn();
         JSONObject loginData = JSONObject.parseObject(mvcResult.getResponse().getContentAsString());
 
         mockMvc.perform(get("/api/hello").header("Authorization",loginData.getJSONObject("data").getString("token")).contentType(MediaType.APPLICATION_JSON)).andExpect(result -> {
@@ -67,12 +81,16 @@ void resetToken() throws Exception {
         JSONObject json = new JSONObject();
         json.put("username","admin");
         json.put("password","123456");
-        MvcResult mvcResult =  mockMvc.perform(post("/user/login").content(json.toJSONString().getBytes(StandardCharsets.UTF_8)).contentType(MediaType.APPLICATION_JSON)).andReturn();
+        MvcResult mvcResult =  mockMvc.perform(post("/user/login")
+                .content(json.toJSONString().getBytes(StandardCharsets.UTF_8))
+                .contentType(MediaType.APPLICATION_JSON)).andReturn();
         JSONObject loginData = JSONObject.parseObject(mvcResult.getResponse().getContentAsString());
 
         Thread.sleep(1000*5);
 
-        mockMvc.perform(get("/api/hello").header("Authorization",loginData.getJSONObject("data").getString("token")).contentType(MediaType.APPLICATION_JSON)).andExpect(result -> {
+        mockMvc.perform(get("/api/hello")
+                .header("Authorization",loginData.getJSONObject("data").getString("token"))
+                .contentType(MediaType.APPLICATION_JSON)).andExpect(result -> {
             String body = result.getResponse().getContentAsString();
             String newToken = result.getResponse().getHeader("Authorization");
 
@@ -87,12 +105,16 @@ void expireToken() throws Exception {
         JSONObject json = new JSONObject();
         json.put("username","admin");
         json.put("password","123456");
-        MvcResult mvcResult =  mockMvc.perform(post("/user/login").content(json.toJSONString().getBytes(StandardCharsets.UTF_8)).contentType(MediaType.APPLICATION_JSON)).andReturn();
+        MvcResult mvcResult =  mockMvc.perform(post("/user/login")
+                .content(json.toJSONString().getBytes(StandardCharsets.UTF_8))
+                .contentType(MediaType.APPLICATION_JSON)).andReturn();
         JSONObject loginData = JSONObject.parseObject(mvcResult.getResponse().getContentAsString());
 
         Thread.sleep(1000*10);
 
-        mockMvc.perform(get("/api/hello").header("Authorization",loginData.getJSONObject("data").getString("token")).contentType(MediaType.APPLICATION_JSON)).andExpect(result -> {
+        mockMvc.perform(get("/api/hello")
+                .header("Authorization",loginData.getJSONObject("data").getString("token"))
+                .contentType(MediaType.APPLICATION_JSON)).andExpect(result -> {
             String body = result.getResponse().getContentAsString();
             JSONObject data = JSONObject.parseObject(body);
             assertEquals(data.getString("errCode"),"token.expire","token authentication error");

Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,8 @@ public SecurityFilterChain filterChain(HttpSecurity security, Jwt jwt,SecurityLo`
`82`	`82`	`.and()`
`83`	`83`	`.authorizeHttpRequests(`
`84`	`84`	`registry -> {`
`85`		`- registry.requestMatchers(properties.getAuthenticatedUrls()).authenticated()`
	`85`	`+ registry.requestMatchers(properties.getIgnoreUrls()).permitAll()`
	`86`	`+ .requestMatchers(properties.getAuthenticatedUrls()).authenticated()`
`86`	`87`	`.anyRequest().permitAll();`
`87`	`88`	`}`
`88`	`89`	`)`
Original file line number	Diff line number	Diff line change
`@@ -19,9 +19,9 @@ public class HttpSecurityConfigurer extends AbstractHttpConfigurer<HttpSecurityC`
`19`	`19`	`private final SecurityJwtProperties securityJwtProperties;`
`20`	`20`
`21`	`21`	`@Override`
`22`		`- public void configure(HttpSecurity http) throws Exception {`
`23`		`- AuthenticationManager manager = http.getSharedObject(AuthenticationManager.class);`
`24`		`- http.addFilter(new MyLoginFilter(manager, jwt,securityLoginHandler, securityJwtProperties));`
`25`		`- http.addFilter(new MyAuthenticationFilter(manager, jwt));`
	`22`	`+ public void configure(HttpSecurity security) throws Exception {`
	`23`	`+ AuthenticationManager manager = security.getSharedObject(AuthenticationManager.class);`
	`24`	`+ security.addFilter(new MyLoginFilter(manager, jwt,securityLoginHandler, securityJwtProperties));`
	`25`	`+ security.addFilter(new MyAuthenticationFilter(manager,securityJwtProperties,jwt));`
`26`	`26`	`}`
`27`	`27`	`}`