You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by an...@apache.org on 2015/11/05 12:23:41 UTC
svn commit: r1712745 - in /jackrabbit/oak/trunk:
oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/
oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/
oak-doc/src/site/markdown/securit...
Author: angela
Date: Thu Nov 5 11:23:40 2015
New Revision: 1712745
URL: http://svn.apache.org/viewvc?rev=1712745&view=rev
Log:
OAK-3590 : Incomplete doc of GlobPattern
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPattern.java
jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPatternTest.java
jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/accesscontrol/restriction.md
Modified: jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPattern.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPattern.java?rev=1712745&r1=1712744&r2=1712745&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPattern.java (original)
+++ jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPattern.java Thu Nov 5 11:23:40 2015
@@ -48,12 +48,25 @@ import static com.google.common.base.Pre
* </p>
*
* <p>
+ * Examples without wildcard char:
+ * <pre>
+ * NodePath = "/foo"
+ * Restriction | Matches
+ * -----------------------------------------------------------------------------
+ * /cat | the node /foo/cat and all it's children
+ * /cat/ | the descendants of the node /foo/cat
+ * cat | the node /foocat and all it's children
+ * cat/ | all descendants of the node /foocat
+ * </pre>
+ * </p>
+ *
+ * <p>
* Examples including wildcard char:
* <pre>
* NodePath = "/foo"
* Restriction | Matches
* -----------------------------------------------------------------------------
- * * | all siblings of foo and foo's and the siblings' descendants
+ * * | foo, all siblings of foo and their descendants
* /*cat | all children of /foo whose path ends with "cat"
* /*/cat | all non-direct descendants of /foo named "cat"
* /cat* | all descendant path of /foo that have the direct foo-descendant segment starting with "cat"
@@ -61,7 +74,8 @@ import static com.google.common.base.Pre
* */cat | all descendants of /foo and foo's siblings that have a name segment "cat"
* cat/* | all descendants of '/foocat'
* /cat/* | all descendants of '/foo/cat'
- * *cat/* | all descendants of /foo that have an intermediate segment ending with 'cat'
+ * *cat/* | all siblings and descendants of foo that have an intermediate segment ending with 'cat'
+ * /*cat/* | all descendants of /foo that have an intermediate segment ending with 'cat'
* </pre>
* </p>
*/
@@ -79,7 +93,7 @@ final class GlobPattern implements Restr
this.path = checkNotNull(path);
this.restriction = restriction;
- if (restriction.length() > 0) {
+ if (!restriction.isEmpty()) {
StringBuilder b = new StringBuilder(path);
b.append(restriction);
Modified: jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPatternTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPatternTest.java?rev=1712745&r1=1712744&r2=1712745&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPatternTest.java (original)
+++ jackrabbit/oak/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/GlobPatternTest.java Thu Nov 5 11:23:40 2015
@@ -201,7 +201,7 @@ public class GlobPatternTest {
assertMatch(gp, testPath, tests.get(testPath));
}
- // restriction "*e/*" matches all descendants of /foo that have an intermediate segment ending with 'e'
+ // restriction "*cat/*" matches all siblings and descendants of /foo that have an intermediate segment ending with 'cat'
gp = GlobPattern.create("/a/b/c", "*e/*");
tests = new HashMap<String,Boolean>();
// matching
@@ -210,6 +210,7 @@ public class GlobPatternTest {
tests.put("/a/b/c/d/e/f", true);
tests.put("/a/b/ced/d/e/f", true);
// not-matching
+ tests.put("/a/b/cde", false); // sibling ending with e
tests.put("/a/b/ce/", false); // ignore trailing / in test path
tests.put("/a/b/c/d/e/", false); // ignore trailing / in test path
tests.put("/a/b/c/d", false); // missing *e/*
@@ -221,6 +222,28 @@ public class GlobPatternTest {
assertMatch(gp, testPath, tests.get(testPath));
}
+ // restriction /*cat/* matches all descendants of /foo that have an intermediate segment ending with 'cat'
+ gp = GlobPattern.create("/a/b/c", "/*e/*");
+ tests = new HashMap<String,Boolean>();
+ // matching
+ tests.put("/a/b/c/d/e/f", true);
+ tests.put("/a/b/c/de/f", true);
+ // not-matching
+ tests.put("/a/b/cde", false); // sibling ending with e
+ tests.put("/a/b/ced/d/e/f", false);// sibling containing intermediate segment
+ tests.put("/a/b/cde/d/e/f", false);// sibling containing intermediate segment
+ tests.put("/a/b/ce/", false); // ignore trailing / in test path
+ tests.put("/a/b/c/d/e/", false); // ignore trailing / in test path
+ tests.put("/a/b/c/d/e", false); // no intermediate segment
+ tests.put("/a/b/c/d", false); // missing *e/*
+ tests.put("/a/b/c/d/e", false); // missing /*
+ tests.put("/a/b/c/d/f/f", false); // missing *e
+ tests.put("/a/b/c/ed/f/f", false); // missing e/
+
+ for (String testPath : tests.keySet()) {
+ assertMatch(gp, testPath, tests.get(testPath));
+ }
+
// restriction /*cat matches all children of /a/b/c whose path ends with "cat"
gp = GlobPattern.create("/a/b/c", "/*cat");
tests = new HashMap<String,Boolean>();
@@ -327,6 +350,42 @@ public class GlobPatternTest {
tests.put("/a/b/cde", false);
for (String toTest : tests.keySet()) {
+ assertTrue(gp + " : " + toTest, tests.get(toTest) == gp.matches(toTest));
+ }
+ }
+
+ @Test
+ public void testPathRestriction() {
+ GlobPattern gp = GlobPattern.create("/a/b/c", "d");
+ Map<String,Boolean> tests = new HashMap<String,Boolean>();
+ tests.put("/", false);
+ tests.put("/a", false);
+ tests.put("/a/b/c", false);
+ tests.put("/a/b/c/d", false);
+ tests.put("/a/b/c/d/e/f", false);
+ tests.put("/a/b/cd", true);
+ tests.put("/a/b/cd/e", true);
+ tests.put("/a/b/cd/e/f", true);
+ tests.put("/a/b/cde", false);
+
+ for (String toTest : tests.keySet()) {
+ assertTrue(gp + " : " + toTest, tests.get(toTest) == gp.matches(toTest));
+ }
+
+ gp = GlobPattern.create("/a/b/c", "/d");
+
+ tests = new HashMap<String,Boolean>();
+ tests.put("/", false);
+ tests.put("/a", false);
+ tests.put("/a/b/c", false);
+ tests.put("/a/b/c/d", true);
+ tests.put("/a/b/c/d/e/f", true);
+ tests.put("/a/b/cd", false);
+ tests.put("/a/b/cd/e", false);
+ tests.put("/a/b/cd/e/f", false);
+ tests.put("/a/b/cde", false);
+
+ for (String toTest : tests.keySet()) {
assertTrue(gp + " : " + toTest, tests.get(toTest) == gp.matches(toTest));
}
}
Modified: jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/accesscontrol/restriction.md
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/accesscontrol/restriction.md?rev=1712745&r1=1712744&r2=1712745&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/accesscontrol/restriction.md (original)
+++ jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/accesscontrol/restriction.md Thu Nov 5 11:23:40 2015
@@ -102,11 +102,35 @@ as follows:
The default implementations of the `Restriction` interface are present with
Oak 1.0 access control management:
-* `rep:glob`: single name or path pattern with '*' wildcard(s).
+* `rep:glob`: single name, path or path pattern with '*' wildcard(s).
* `rep:ntNames`: multivalued restriction for primary node type names (no inheritence, since Oak 1.0)
* `rep:prefixes`: multivalued restriction for namespace prefixes (session level remapping not respected, since Oak 1.0)
* `rep:itemNames`: multivalued restriction for property or node names (since Oak 1.3.8)
+##### Examples
+
+###### Using rep:glob
+
+For a nodePath `/foo` the following results can be expected for the different
+values of `rep:glob`.
+
+| rep:glob | Result |
+|-------------------|----------------------------------------------------------|
+| "" | matches node /foo only |
+| /cat | the node /foo/cat and all it's children |
+| /cat/ | the descendants of the node /foo/cat |
+| cat | the node /foocat and all it's children |
+| cat/ | all descendants of the node /foocat |
+| \* | foo, siblings of foo and their descendants |
+| /\*cat | all children of /foo whose path ends with 'cat' |
+| /\*/cat | all non-direct descendants of /foo named 'cat' |
+| /cat\* | all descendant path of /foo that have the direct foo-descendant segment starting with 'cat' |
+| \*cat | all siblings and descendants of foo that have a name ending with 'cat' |
+| \*/cat | all descendants of /foo and foo's siblings that have a name segment 'cat' |
+| cat/\* | all descendants of '/foocat' |
+| /cat/\* | all descendants of '/foo/cat' |
+| \*cat/\* | all descendants of /foo that have an intermediate segment ending with 'cat' |
+
### Pluggability