This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/main by this push:
new d40dfd6313 apply the hessian basic auth valve relative to the context
path
d40dfd6313 is described below
commit d40dfd631316ee75ecb3fcccde6bf8d6af0d38db
Author: Markus Jung <[email protected]>
AuthorDate: Sat Aug 29 16:00:44 2026 +0200
apply the hessian basic auth valve relative to the context path
---
.../server/hessian/TomcatHessianRegistry.java | 6 +-
.../server/hessian/LimitedBasicValveTest.java | 89 ++++++++++++++++++++++
2 files changed, 94 insertions(+), 1 deletion(-)
diff --git
a/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java
b/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java
index f9de1f75c9..705c718be7 100644
---
a/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java
+++
b/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java
@@ -282,7 +282,11 @@ public class TomcatHessianRegistry implements
HessianRegistry {
protected static class LimitedBasicValve extends BasicAuthenticator {
@Override
public void invoke(final Request request, final Response response)
throws IOException, ServletException {
- final String requestURI = request.getDecodedRequestURI();
+ String requestURI = request.getDecodedRequestURI();
+ final String contextPath = request.getContextPath();
+ if (contextPath != null && !contextPath.isEmpty() &&
requestURI.startsWith(contextPath)) {
+ requestURI = requestURI.substring(contextPath.length());
+ }
if (requestURI.startsWith(HESSIAN)) {
if (!authenticate(request, response)) {
return;
diff --git
a/server/openejb-hessian/src/test/java/org/apache/openejb/server/hessian/LimitedBasicValveTest.java
b/server/openejb-hessian/src/test/java/org/apache/openejb/server/hessian/LimitedBasicValveTest.java
new file mode 100644
index 0000000000..f3e93e081d
--- /dev/null
+++
b/server/openejb-hessian/src/test/java/org/apache/openejb/server/hessian/LimitedBasicValveTest.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.openejb.server.hessian;
+
+import org.apache.catalina.connector.Connector;
+import org.apache.catalina.connector.Request;
+import org.apache.catalina.connector.Response;
+import org.apache.catalina.core.StandardContext;
+import org.apache.catalina.core.StandardEngine;
+import org.apache.catalina.core.StandardHost;
+import org.apache.catalina.core.StandardService;
+import org.apache.catalina.valves.ValveBase;
+import org.junit.Test;
+
+import java.io.IOException;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletResponse;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class LimitedBasicValveTest {
+ @Test
+ public void rootContext() throws Exception {
+ assertTrue(authenticates("", "/hessian/MyBean"));
+ assertFalse(authenticates("", "/other"));
+ }
+
+ @Test
+ public void nonRootContext() throws Exception {
+ assertTrue(authenticates("/myapp", "/myapp/hessian/MyBean"));
+ assertFalse(authenticates("/myapp", "/myapp/other"));
+ }
+
+ private static boolean authenticates(final String contextPath, final
String uri) throws IOException, ServletException {
+ final AtomicBoolean authenticated = new AtomicBoolean();
+ final AtomicBoolean invokedNext = new AtomicBoolean();
+
+ final TomcatHessianRegistry.LimitedBasicValve valve = new
TomcatHessianRegistry.LimitedBasicValve() {
+ @Override
+ public boolean authenticate(final Request request, final
HttpServletResponse response) {
+ authenticated.set(true);
+ return true;
+ }
+ };
+ valve.setNext(new ValveBase() {
+ @Override
+ public void invoke(final Request request, final Response response)
{
+ invokedNext.set(true);
+ }
+ });
+
+ final StandardEngine engine = new StandardEngine();
+ engine.setService(new StandardService());
+ final StandardHost host = new StandardHost();
+ host.setParent(engine);
+ final StandardContext context = new StandardContext();
+ context.setParent(host);
+ context.setPath(contextPath);
+
+ final Connector connector = new Connector();
+ final Request request = new Request(connector, new
org.apache.coyote.Request());
+ request.getCoyoteRequest().requestURI().setString(uri);
+ request.getCoyoteRequest().decodedURI().setString(uri);
+ request.getMappingData().context = context;
+ request.getMappingData().contextSlashCount = contextPath.isEmpty() ? 0
: 1;
+
+ valve.invoke(request, new Response(new org.apache.coyote.Response()));
+
+ assertTrue(invokedNext.get());
+ return authenticated.get();
+ }
+}
