Skip to content

Commit d9608d3

Browse files
mscibiliamscibilia
committed
Removed hard-coding of h2 console path and used H2ConsoleProperties instead.
1 parent 77d625e commit d9608d3

File tree

5 files changed

+99
-20
lines changed

5 files changed

+99
-20
lines changed

‎src/main/java/ru/mystamps/web/support/spring/boot/ApplicationBootstrap.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919

2020
import org.springframework.boot.SpringApplication;
2121
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
22+
import org.springframework.boot.autoconfigure.h2.H2ConsoleProperties;
23+
import org.springframework.boot.context.properties.EnableConfigurationProperties;
2224
import org.springframework.context.ConfigurableApplicationContext;
2325
import org.springframework.context.annotation.Import;
2426
import org.togglz.core.context.StaticFeatureManagerProvider;
@@ -30,6 +32,7 @@
3032
// CheckStyle: I cannot declare the constructor as private because app won't start.
3133
@SuppressWarnings({ "PMD.UseUtilityClass", "checkstyle:hideutilityclassconstructor" })
3234
@EnableAutoConfiguration
35+
@EnableConfigurationProperties(H2ConsoleProperties.class)
3336
@Import({
3437
ApplicationContext.class,
3538
DispatcherServletContext.class,

‎src/main/java/ru/mystamps/web/support/spring/security/ContentSecurityPolicyHeaderWriter.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
package ru.mystamps.web.support.spring.security;
1919

2020
import lombok.RequiredArgsConstructor;
21+
import org.springframework.boot.autoconfigure.h2.H2ConsoleProperties;
2122
import org.springframework.security.web.header.HeaderWriter;
2223
import ru.mystamps.web.feature.collection.CollectionUrl;
2324
import ru.mystamps.web.feature.series.SeriesUrl;
@@ -46,9 +47,6 @@ class ContentSecurityPolicyHeaderWriter implements HeaderWriter {
4647

4748
private static final String ADD_IMAGE_PAGE_PATTERN = "/series/(add|\\d+|\\d+/(ask|image))";
4849

49-
// see also spring.h2.console.path in application-test.properties and SecurityConfig
50-
private static final String H2_CONSOLE_PATTERN = "/console/";
51-
5250
// default policy prevents loading resources from any source
5351
private static final String DEFAULT_SRC = "default-src 'none'";
5452

@@ -156,6 +154,8 @@ class ContentSecurityPolicyHeaderWriter implements HeaderWriter {
156154
private final boolean useSingleHost;
157155
private final boolean hasH2Console;
158156
private final String host;
157+
private final H2ConsoleProperties h2ConsoleProperties;
158+
159159

160160
@Override
161161
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
@@ -168,7 +168,7 @@ public void writeHeaders(HttpServletRequest request, HttpServletResponse respons
168168
protected String constructDirectives(String uri) {
169169
boolean onCollectionInfoPage = uri.startsWith(COLLECTION_INFO_PAGE_PATTERN);
170170
boolean onAddSeriesPage = uri.equals(SeriesUrl.ADD_SERIES_PAGE);
171-
boolean onH2ConsolePage = hasH2Console && uri.startsWith(H2_CONSOLE_PATTERN);
171+
boolean onH2ConsolePage = hasH2Console && uri.startsWith(h2ConsoleProperties.getPath());
172172

173173
StringBuilder sb = new StringBuilder();
174174

‎src/main/java/ru/mystamps/web/support/spring/security/SecurityConfig.java

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919

2020
import org.springframework.beans.factory.annotation.Autowired;
2121
import org.springframework.beans.factory.annotation.Qualifier;
22+
import org.springframework.boot.autoconfigure.h2.H2ConsoleProperties;
2223
import org.springframework.boot.web.servlet.FilterRegistrationBean;
2324
import org.springframework.boot.web.servlet.filter.OrderedRequestContextFilter;
2425
import org.springframework.context.ApplicationListener;
@@ -72,6 +73,9 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
7273
@Autowired
7374
private SiteService siteService;
7475

76+
@Autowired
77+
private H2ConsoleProperties h2ConsoleProperties;
78+
7579
@Override
7680
@SuppressWarnings("PMD.SignatureDeclareThrowsException")
7781
public void configure(WebSecurity web) throws Exception {
@@ -90,7 +94,7 @@ protected void configure(HttpSecurity http) throws Exception {
9094
String hostname = usePublicHostname ? SiteUrl.PUBLIC_URL : SiteUrl.SITE;
9195

9296
ContentSecurityPolicyHeaderWriter cspWriter =
93-
new ContentSecurityPolicyHeaderWriter(useCdn, useSingleHost, hasH2Console, hostname);
97+
new ContentSecurityPolicyHeaderWriter(useCdn, useSingleHost, hasH2Console, hostname, h2ConsoleProperties);
9498

9599
http
96100
.authorizeRequests()
@@ -141,7 +145,7 @@ protected void configure(HttpSecurity http) throws Exception {
141145
// Allow unsecured requests to H2 consoles.
142146
// See also spring.h2.console.path in application-test.properties and
143147
// ContentSecurityPolicyHeaderWriter.H2_CONSOLE_PATTERN
144-
.ignoringAntMatchers("/console/**", SiteUrl.CSP_REPORTS_HANDLER)
148+
.ignoringAntMatchers(h2ConsoleProperties.getPath() + "/**", SiteUrl.CSP_REPORTS_HANDLER)
145149
.and()
146150
.rememberMe()
147151
// FIXME: GH #27

‎src/main/resources/application-test.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ spring.datasource.driver-class-name: org.h2.Driver
77
spring.datasource.initialization-mode: NEVER
88

99
spring.h2.console.enabled: true
10-
# see also SecurityConfig and ContentSecurityPolicyHeaderWriter.H2_CONSOLE_PATTERN
10+
# see also SecurityConfig
1111
spring.h2.console.path: /console
1212

1313
# required for using /console with CSP because we have many hashes as a workaround

‎src/test/java/ru/mystamps/web/support/spring/security/ContentSecurityPolicyHeaderWriterTest.java

Lines changed: 85 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@
1818
package ru.mystamps.web.support.spring.security;
1919

2020
import org.assertj.core.api.WithAssertions;
21+
import org.junit.BeforeClass;
2122
import org.junit.Rule;
2223
import org.junit.Test;
24+
import org.springframework.boot.autoconfigure.h2.H2ConsoleProperties;
2325
import org.springframework.mock.web.MockHttpServletRequest;
2426
import org.springframework.mock.web.MockHttpServletResponse;
2527
import org.togglz.junit.TogglzRule;
@@ -38,10 +40,16 @@ public class ContentSecurityPolicyHeaderWriterTest implements WithAssertions {
3840
private static final int NUMBER_OF_DIRECTIVES_ON_ADD_SERIES_PAGE = 7;
3941
private static final int NUMBER_OF_DIRECTIVES_ON_INFO_SERIES_PAGE = 7;
4042
private static final int NUMBER_OF_DIRECTIVES_ON_H2_CONSOLE_PAGE = 7;
41-
43+
private static final H2ConsoleProperties H2_CONSOLE_PROPERTIES = new H2ConsoleProperties();
44+
4245
@Rule
4346
public TogglzRule togglz = TogglzRule.allEnabled(Features.class);
4447

48+
@BeforeClass
49+
public static void setupClass() {
50+
H2_CONSOLE_PROPERTIES.setPath("/console/");
51+
}
52+
4553
//
4654
// Tests for writeHeaders()
4755
//
@@ -50,7 +58,13 @@ public class ContentSecurityPolicyHeaderWriterTest implements WithAssertions {
5058
public void writeContentSecurityPolicyHeader() {
5159
// given
5260
ContentSecurityPolicyHeaderWriter writer =
53-
new ContentSecurityPolicyHeaderWriter(bool(), bool(), bool(), Random.host());
61+
new ContentSecurityPolicyHeaderWriter(
62+
bool(),
63+
bool(),
64+
bool(),
65+
Random.host(),
66+
H2_CONSOLE_PROPERTIES
67+
);
5468
HttpServletRequest request = new MockHttpServletRequest();
5569
HttpServletResponse response = new MockHttpServletResponse();
5670

@@ -77,7 +91,12 @@ public void writeContentSecurityPolicyHeader() {
7791
@Test
7892
public void onIndexPageWithLocalResources() {
7993
ContentSecurityPolicyHeaderWriter writer =
80-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), SiteUrl.SITE);
94+
new ContentSecurityPolicyHeaderWriter(
95+
false,
96+
true,
97+
bool(),
98+
SiteUrl.SITE, H2_CONSOLE_PROPERTIES
99+
);
81100
String[] directives = writer.constructDirectives("/").split(";");
82101

83102
assertThat(directives)
@@ -91,11 +110,16 @@ public void onIndexPageWithLocalResources() {
91110
)
92111
.hasSize(NUMBER_OF_DIRECTIVES_ON_STANDARD_PAGES);
93112
}
94-
113+
95114
@Test
96115
public void onIndexPageWithResourcesFromCdn() {
97116
ContentSecurityPolicyHeaderWriter writer
98-
= new ContentSecurityPolicyHeaderWriter(true, false, bool(), SiteUrl.PUBLIC_URL);
117+
= new ContentSecurityPolicyHeaderWriter(
118+
true,
119+
false,
120+
bool(),
121+
SiteUrl.PUBLIC_URL, H2_CONSOLE_PROPERTIES
122+
);
99123
String[] directives = writer.constructDirectives("/").split(";");
100124

101125
assertThat(directives)
@@ -126,7 +150,13 @@ public void onIndexPageWithResourcesFromCdn() {
126150
@Test
127151
public void onCollectionInfoPageWithLocalResources() {
128152
ContentSecurityPolicyHeaderWriter writer =
129-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), Random.host());
153+
new ContentSecurityPolicyHeaderWriter(
154+
false,
155+
true,
156+
bool(),
157+
Random.host(),
158+
H2_CONSOLE_PROPERTIES
159+
);
130160
String[] directives = writer.constructDirectives("/collection/user").split(";");
131161

132162
// test only the directives that differ from the index page
@@ -153,7 +183,13 @@ public void onCollectionInfoPageWithLocalResources() {
153183
@Test
154184
public void onCollectionInfoPageWithResourcesFromCdn() {
155185
ContentSecurityPolicyHeaderWriter writer =
156-
new ContentSecurityPolicyHeaderWriter(true, false, bool(), Random.host());
186+
new ContentSecurityPolicyHeaderWriter(
187+
true,
188+
false,
189+
bool(),
190+
Random.host(),
191+
H2_CONSOLE_PROPERTIES
192+
);
157193
String[] directives = writer.constructDirectives("/collection/user").split(";");
158194

159195
// test only the directives that differ from the index page
@@ -183,7 +219,13 @@ public void onCollectionInfoPageWithResourcesFromCdn() {
183219
@Test
184220
public void onSeriesAddImagePageWithLocalResources() {
185221
ContentSecurityPolicyHeaderWriter writer =
186-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), Random.host());
222+
new ContentSecurityPolicyHeaderWriter(
223+
false,
224+
true,
225+
bool(),
226+
Random.host(),
227+
H2_CONSOLE_PROPERTIES
228+
);
187229

188230
for (String page : new String[]{"/series/11", "/series/12/ask", "/series/13/image"}) {
189231
String[] directives = writer.constructDirectives(page).split(";");
@@ -206,7 +248,13 @@ public void onSeriesAddImagePageWithLocalResources() {
206248
@Test
207249
public void onSeriesAddImagePageWithResourcesFromCdn() {
208250
ContentSecurityPolicyHeaderWriter writer =
209-
new ContentSecurityPolicyHeaderWriter(true, false, bool(), Random.host());
251+
new ContentSecurityPolicyHeaderWriter(
252+
true,
253+
false,
254+
bool(),
255+
Random.host(),
256+
H2_CONSOLE_PROPERTIES
257+
);
210258

211259
for (String page : new String[]{"/series/11", "/series/12/ask", "/series/13/image"}) {
212260
String[] directives = writer.constructDirectives(page).split(";");
@@ -239,7 +287,13 @@ public void onSeriesAddImagePageWithResourcesFromCdn() {
239287
@Test
240288
public void onSeriesAddPageWithLocalResources() {
241289
ContentSecurityPolicyHeaderWriter writer =
242-
new ContentSecurityPolicyHeaderWriter(false, true, bool(), Random.host());
290+
new ContentSecurityPolicyHeaderWriter(
291+
false,
292+
true,
293+
bool(),
294+
Random.host(),
295+
H2_CONSOLE_PROPERTIES
296+
);
243297
String[] directives = writer.constructDirectives("/series/add").split(";");
244298

245299
// test only the directives that differ from the index page
@@ -267,7 +321,13 @@ public void onSeriesAddPageWithLocalResources() {
267321
@Test
268322
public void onSeriesAddPageWithResourcesFromCdn() {
269323
ContentSecurityPolicyHeaderWriter writer =
270-
new ContentSecurityPolicyHeaderWriter(true, false, bool(), Random.host());
324+
new ContentSecurityPolicyHeaderWriter(
325+
true,
326+
false,
327+
bool(),
328+
Random.host(),
329+
H2_CONSOLE_PROPERTIES
330+
);
271331
String[] directives = writer.constructDirectives("/series/add").split(";");
272332

273333
// test only the directives that differ from the index page
@@ -298,7 +358,13 @@ public void onSeriesAddPageWithResourcesFromCdn() {
298358
@Test
299359
public void onH2ConsoleWithLocalResources() {
300360
ContentSecurityPolicyHeaderWriter writer =
301-
new ContentSecurityPolicyHeaderWriter(false, true, true, Random.host());
361+
new ContentSecurityPolicyHeaderWriter(
362+
false,
363+
true,
364+
true,
365+
Random.host(),
366+
H2_CONSOLE_PROPERTIES
367+
);
302368
String[] directives = writer.constructDirectives("/console/").split(";");
303369

304370
// test only the directives that are differ from the index page
@@ -326,7 +392,13 @@ public void onH2ConsoleWithLocalResources() {
326392
@Test
327393
public void onH2ConsoleWithResourcesFromCdn() {
328394
ContentSecurityPolicyHeaderWriter writer =
329-
new ContentSecurityPolicyHeaderWriter(true, false, false, Random.host());
395+
new ContentSecurityPolicyHeaderWriter(
396+
true,
397+
false,
398+
false,
399+
Random.host(),
400+
H2_CONSOLE_PROPERTIES
401+
);
330402
String[] directives = writer.constructDirectives("/console/").split(";");
331403

332404
assertThat(directives)

0 commit comments

Comments
 (0)