From 797450d6b8a67f72f855e655bb6965889884473d Mon Sep 17 00:00:00 2001 From: Nicolas Grekas Date: Thu, 14 Nov 2019 23:50:50 +0100 Subject: [PATCH 1/2] [Security] always check the token on non-lazy firewalls --- .../Component/Security/Http/Firewall/AccessListener.php | 7 ++++++- .../Security/Http/Tests/Firewall/AccessListenerTest.php | 3 ++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/Symfony/Component/Security/Http/Firewall/AccessListener.php b/src/Symfony/Component/Security/Http/Firewall/AccessListener.php index cecb18568b300..6164adde5db02 100644 --- a/src/Symfony/Component/Security/Http/Firewall/AccessListener.php +++ b/src/Symfony/Component/Security/Http/Firewall/AccessListener.php @@ -18,6 +18,7 @@ use Symfony\Component\Security\Core\Exception\AccessDeniedException; use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException; use Symfony\Component\Security\Http\AccessMapInterface; +use Symfony\Component\Security\Http\Event\LazyResponseEvent; /** * AccessListener enforces access control rules. @@ -51,6 +52,10 @@ public function __construct(TokenStorageInterface $tokenStorage, AccessDecisionM */ public function __invoke(RequestEvent $event) { + if (!$event instanceof LazyResponseEvent && null === $token = $this->tokenStorage->getToken()) { + throw new AuthenticationCredentialsNotFoundException('A Token was not found in the TokenStorage.'); + } + $request = $event->getRequest(); list($attributes) = $this->map->getPatterns($request); @@ -59,7 +64,7 @@ public function __invoke(RequestEvent $event) return; } - if (null === $token = $this->tokenStorage->getToken()) { + if ($event instanceof LazyResponseEvent && null === $token = $this->tokenStorage->getToken()) { throw new AuthenticationCredentialsNotFoundException('A Token was not found in the TokenStorage.'); } diff --git a/src/Symfony/Component/Security/Http/Tests/Firewall/AccessListenerTest.php b/src/Symfony/Component/Security/Http/Tests/Firewall/AccessListenerTest.php index 08515164971c3..1dff48dfda84f 100644 --- a/src/Symfony/Component/Security/Http/Tests/Firewall/AccessListenerTest.php +++ b/src/Symfony/Component/Security/Http/Tests/Firewall/AccessListenerTest.php @@ -18,6 +18,7 @@ use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface; use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface; use Symfony\Component\Security\Http\AccessMapInterface; +use Symfony\Component\Security\Http\Event\LazyResponseEvent; use Symfony\Component\Security\Http\Firewall\AccessListener; class AccessListenerTest extends TestCase @@ -219,7 +220,7 @@ public function testHandleWhenAccessMapReturnsEmptyAttributes() ->willReturn($request) ; - $listener($event); + $listener(new LazyResponseEvent($event)); } public function testHandleWhenTheSecurityTokenStorageHasNoToken() From 2c2632a04cd0913aadcabb7a3070f681b13496f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Pineau?= Date: Thu, 14 Nov 2019 23:35:53 +0100 Subject: [PATCH 2/2] [SecurityBundle] add tests with empty authenticator --- .../Tests/Functional/AnonymousTest.php | 24 ++++++++ .../AppCustomAuthenticator.php | 57 +++++++++++++++++++ .../Functional/app/Anonymous/bundles.php | 15 +++++ .../Tests/Functional/app/Anonymous/config.yml | 24 ++++++++ .../Functional/app/Anonymous/routing.yml | 5 ++ 5 files changed, 125 insertions(+) create mode 100644 src/Symfony/Bundle/SecurityBundle/Tests/Functional/AnonymousTest.php create mode 100644 src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/AnonymousBundle/AppCustomAuthenticator.php create mode 100644 src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/bundles.php create mode 100644 src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/config.yml create mode 100644 src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/routing.yml diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/AnonymousTest.php b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/AnonymousTest.php new file mode 100644 index 0000000000000..fdee9bce9b06a --- /dev/null +++ b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/AnonymousTest.php @@ -0,0 +1,24 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Bundle\SecurityBundle\Tests\Functional; + +class AnonymousTest extends AbstractWebTestCase +{ + public function testAnonymous() + { + $client = $this->createClient(['test_case' => 'Anonymous', 'root_config' => 'config.yml']); + + $client->request('GET', '/'); + + $this->assertSame(401, $client->getResponse()->getStatusCode()); + } +} diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/AnonymousBundle/AppCustomAuthenticator.php b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/AnonymousBundle/AppCustomAuthenticator.php new file mode 100644 index 0000000000000..5069fa9cc7fa9 --- /dev/null +++ b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/Bundle/AnonymousBundle/AppCustomAuthenticator.php @@ -0,0 +1,57 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +namespace Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\AnonymousBundle; + +use Symfony\Component\HttpFoundation\Request; +use Symfony\Component\HttpFoundation\Response; +use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; +use Symfony\Component\Security\Core\Exception\AuthenticationException; +use Symfony\Component\Security\Core\User\UserInterface; +use Symfony\Component\Security\Core\User\UserProviderInterface; +use Symfony\Component\Security\Guard\AbstractGuardAuthenticator; + +class AppCustomAuthenticator extends AbstractGuardAuthenticator +{ + public function supports(Request $request) + { + return false; + } + + public function getCredentials(Request $request) + { + } + + public function getUser($credentials, UserProviderInterface $userProvider) + { + } + + public function checkCredentials($credentials, UserInterface $user) + { + } + + public function onAuthenticationFailure(Request $request, AuthenticationException $exception) + { + } + + public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey) + { + } + + public function start(Request $request, AuthenticationException $authException = null) + { + return new Response($authException->getMessage(), Response::HTTP_UNAUTHORIZED); + } + + public function supportsRememberMe() + { + } +} diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/bundles.php b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/bundles.php new file mode 100644 index 0000000000000..d1e9eb7e0d36a --- /dev/null +++ b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/bundles.php @@ -0,0 +1,15 @@ + + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ + +return [ + new Symfony\Bundle\FrameworkBundle\FrameworkBundle(), + new Symfony\Bundle\SecurityBundle\SecurityBundle(), +]; diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/config.yml b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/config.yml new file mode 100644 index 0000000000000..8ee417ab3a17d --- /dev/null +++ b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/config.yml @@ -0,0 +1,24 @@ +framework: + secret: test + router: { resource: "%kernel.project_dir%/%kernel.test_case%/routing.yml" } + validation: { enabled: true, enable_annotations: true } + csrf_protection: true + form: true + test: ~ + default_locale: en + session: + storage_id: session.storage.mock_file + profiler: { only_exceptions: false } + +services: + Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\AnonymousBundle\AppCustomAuthenticator: ~ + +security: + firewalls: + secure: + pattern: ^/ + anonymous: false + stateless: true + guard: + authenticators: + - Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\AnonymousBundle\AppCustomAuthenticator diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/routing.yml b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/routing.yml new file mode 100644 index 0000000000000..4d11154375219 --- /dev/null +++ b/src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Anonymous/routing.yml @@ -0,0 +1,5 @@ +main: + path: / + defaults: + _controller: Symfony\Bundle\FrameworkBundle\Controller\RedirectController::urlRedirectAction + path: /app