You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by an...@apache.org on 2021/07/23 12:47:41 UTC
[jackrabbit-oak] branch trunk updated: OAK-9512 :
PrefixPattern.matches(String) always returns false OAK-9513 : PrefixPattern
ignores empty namespace perfix
This is an automated email from the ASF dual-hosted git repository.
angela pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git
The following commit(s) were added to refs/heads/trunk by this push:
new eda0234 OAK-9512 : PrefixPattern.matches(String) always returns false OAK-9513 : PrefixPattern ignores empty namespace perfix
eda0234 is described below
commit eda02347fc238a48b044766a3407d7ec1e2a5154
Author: angela <an...@adobe.com>
AuthorDate: Fri Jul 23 14:47:28 2021 +0200
OAK-9512 : PrefixPattern.matches(String) always returns false
OAK-9513 : PrefixPattern ignores empty namespace perfix
---
.../authorization/restriction/PrefixPattern.java | 37 +++++++++++-----------
.../restriction/PrefixPatternTest.java | 28 ++++++++++++++--
2 files changed, 45 insertions(+), 20 deletions(-)
diff --git a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPattern.java b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPattern.java
index e5927b3..9194646 100644
--- a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPattern.java
+++ b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPattern.java
@@ -20,23 +20,28 @@ import java.util.Set;
import com.google.common.collect.ImmutableSet;
import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.commons.PathUtils;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionPattern;
import org.apache.jackrabbit.util.Text;
import org.jetbrains.annotations.NotNull;
import org.jetbrains.annotations.Nullable;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
- * Implementation of the
+ * <p>Implementation of the
* {@link org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionPattern}
* interface that returns {@code true} if the name of the target property or tree
* starts with any of the configured namespace prefixes.
+ * </p>s
+ * Note: an empty string prefix will match qualified item names defined with the
+ * {@link javax.jcr.NamespaceRegistry#NAMESPACE_EMPTY empty namespace}.
+ * See also sections
+ * <a href="https://docs.adobe.com/content/docs/en/spec/jcr/2.0/3_Repository_Model.html#3.2.5.2%20Qualified%20Form">3.2.5.2 Qualified Form</a>
+ * and
+ * <a href="https://docs.adobe.com/content/docs/en/spec/jcr/2.0/3_Repository_Model.html#3.2.5.3%20Qualified%20Form%20with%20the%20Empty%20Namespace">3.2.5.3 Qualified Form with the Empty Namespace</a>
+ * of the JCR v2.0 specification.
*/
class PrefixPattern implements RestrictionPattern {
-
- private static final Logger log = LoggerFactory.getLogger(PrefixPattern.class);
-
+
private final Set<String> prefixes;
PrefixPattern(@NotNull Iterable<String> prefixes) {
@@ -46,26 +51,22 @@ class PrefixPattern implements RestrictionPattern {
@Override
public boolean matches(@NotNull Tree tree, @Nullable PropertyState property) {
String name = (property != null) ? property.getName() : tree.getName();
- String prefix = Text.getNamespacePrefix(name);
- if (!prefix.isEmpty()) {
- for (String p : prefixes) {
- if (prefix.equals(p)) {
- return true;
- }
- }
- }
- return false;
+ return matchesPrefix(name);
}
@Override
public boolean matches(@NotNull String path) {
- log.debug("Unable to validate node type restriction.");
- return false;
+ return matchesPrefix(PathUtils.getName(path));
+ }
+
+ private boolean matchesPrefix(String name) {
+ String prefix = Text.getNamespacePrefix(name);
+ return prefixes.contains(prefix);
}
@Override
public boolean matches() {
- // node type pattern never matches for repository level permissions
+ // prefix pattern never matches for repository level permissions
return false;
}
diff --git a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPatternTest.java b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPatternTest.java
index 7e5f279..e59fe90 100644
--- a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPatternTest.java
+++ b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrefixPatternTest.java
@@ -22,6 +22,7 @@ import javax.jcr.NamespaceRegistry;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableSet;
+import org.apache.jackrabbit.JcrConstants;
import org.apache.jackrabbit.oak.AbstractSecurityTest;
import org.apache.jackrabbit.oak.api.Tree;
import org.apache.jackrabbit.oak.plugins.memory.PropertyStates;
@@ -71,10 +72,33 @@ public class PrefixPatternTest extends AbstractSecurityTest {
@Test
public void testMatchesPath() {
- List<String> notMatching = ImmutableList.of("/", "/a", "/jcr:b", "/d/jcr:e/a", "/a/b/c/d/jcr:b");
+ List<String> notMatching = ImmutableList.of("/", "/a", "/d/jcr:e/a");
for (String p : notMatching) {
- assertFalse(pattern.matches(p));
+ assertFalse(p, pattern.matches(p));
}
+ assertTrue(pattern.matches("/jcr:b"));
+ assertTrue(pattern.matches("/a/b/c/d/jcr:b"));
+ }
+
+ @Test
+ public void testEmptyPrefix() throws Exception {
+ PrefixPattern pp = new PrefixPattern(ImmutableSet.of("", "prefix"));
+ assertTrue(pp.matches("/"));
+ assertTrue(pp.matches("/noprefix"));
+ assertTrue(pp.matches("/prefix:noprefix"));
+ assertFalse(pp.matches("/jcr:namewithnonmatchingprefix"));
+
+ Tree rootTree = root.getTree("/");
+ assertTrue(pp.matches(rootTree, null));
+ assertFalse(pp.matches(rootTree, rootTree.getProperty(JcrConstants.JCR_PRIMARYTYPE)));
+
+ Tree testTree = TreeUtil.addChild(rootTree, "name", NodeTypeConstants.NT_OAK_UNSTRUCTURED);
+ testTree.setProperty("prefix:prop", "value");
+ testTree.setProperty("prop", "value");
+ assertTrue(pp.matches(testTree, null));
+ assertTrue(pp.matches(testTree, testTree.getProperty("prefix:prop")));
+ assertTrue(pp.matches(testTree, testTree.getProperty("prop")));
+ assertFalse(pp.matches(testTree, rootTree.getProperty(JcrConstants.JCR_PRIMARYTYPE)));
}
@Test