This is an automated email from the ASF dual-hosted git repository. fpapon pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro.git
commit 27b0597170bbf903d9a48ed086dd028f6f9f22f4 Author: lprimak <[email protected]> AuthorDate: Tue Oct 20 21:31:07 2026 -0500 bugfix: restore deny access control in NoAccessFilter and add unit tests --- .../shiro/web/filter/authc/NoAccessFilter.java | 5 ++ .../shiro/web/filter/authc/NoAccessFilterTest.java | 57 ++++++++++++++++++++++ 2 files changed, 62 insertions(+) diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/NoAccessFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/NoAccessFilter.java index e3380164f..53df561f6 100644 --- a/web/src/main/java/org/apache/shiro/web/filter/authc/NoAccessFilter.java +++ b/web/src/main/java/org/apache/shiro/web/filter/authc/NoAccessFilter.java @@ -40,6 +40,11 @@ public class NoAccessFilter extends AuthenticatingFilter { return false; } + @Override + protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { + return false; + } + @Override protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception { return null; diff --git a/web/src/test/java/org/apache/shiro/web/filter/authc/NoAccessFilterTest.java b/web/src/test/java/org/apache/shiro/web/filter/authc/NoAccessFilterTest.java new file mode 100644 index 000000000..f17c5f72a --- /dev/null +++ b/web/src/test/java/org/apache/shiro/web/filter/authc/NoAccessFilterTest.java @@ -0,0 +1,57 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.shiro.web.filter.authc; + +import jakarta.servlet.ServletRequest; +import jakarta.servlet.ServletResponse; +import org.apache.shiro.subject.Subject; +import org.junit.jupiter.api.Test; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.easymock.EasyMock.createNiceMock; +import static org.easymock.EasyMock.expect; +import static org.easymock.EasyMock.replay; + +/** + * Test for {@link NoAccessFilter}. + */ +public class NoAccessFilterTest { + + @Test + void authenticatedSubjectIsDenied() { + Subject subject = createNiceMock(Subject.class); + expect(subject.isAuthenticated()).andReturn(true).anyTimes(); + expect(subject.getPrincipal()).andReturn("user").anyTimes(); + replay(subject); + + NoAccessFilter filter = new NoAccessFilter() { + @Override + protected Subject getSubject(ServletRequest request, ServletResponse response) { + return subject; + } + }; + + assertThat(filter.isAccessAllowed(null, null, null)).isFalse(); + } + + @Test + void anonymousSubjectIsDenied() { + assertThat(new NoAccessFilter().isAccessAllowed(null, null, null)).isFalse(); + } +}
