This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit 9f7f6f68530e67180de9d01b2851db1c0e31632a Author: Markus Jung <[email protected]> AuthorDate: Sat Aug 29 16:00:44 2026 +0200 apply the hessian basic auth valve relative to the context path (cherry picked from commit d40dfd631316ee75ecb3fcccde6bf8d6af0d38db) --- .../server/hessian/TomcatHessianRegistry.java | 6 +- .../server/hessian/LimitedBasicValveTest.java | 93 ++++++++++++++++++++++ 2 files changed, 98 insertions(+), 1 deletion(-) diff --git a/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java b/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java index f9de1f75c9..705c718be7 100644 --- a/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java +++ b/server/openejb-hessian/src/main/java/org/apache/openejb/server/hessian/TomcatHessianRegistry.java @@ -282,7 +282,11 @@ public class TomcatHessianRegistry implements HessianRegistry { protected static class LimitedBasicValve extends BasicAuthenticator { @Override public void invoke(final Request request, final Response response) throws IOException, ServletException { - final String requestURI = request.getDecodedRequestURI(); + String requestURI = request.getDecodedRequestURI(); + final String contextPath = request.getContextPath(); + if (contextPath != null && !contextPath.isEmpty() && requestURI.startsWith(contextPath)) { + requestURI = requestURI.substring(contextPath.length()); + } if (requestURI.startsWith(HESSIAN)) { if (!authenticate(request, response)) { return; diff --git a/server/openejb-hessian/src/test/java/org/apache/openejb/server/hessian/LimitedBasicValveTest.java b/server/openejb-hessian/src/test/java/org/apache/openejb/server/hessian/LimitedBasicValveTest.java new file mode 100644 index 0000000000..34a7fd5423 --- /dev/null +++ b/server/openejb-hessian/src/test/java/org/apache/openejb/server/hessian/LimitedBasicValveTest.java @@ -0,0 +1,93 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.openejb.server.hessian; + +import org.apache.catalina.connector.Connector; +import org.apache.catalina.connector.Request; +import org.apache.catalina.connector.Response; +import org.apache.catalina.core.StandardContext; +import org.apache.catalina.core.StandardEngine; +import org.apache.catalina.core.StandardHost; +import org.apache.catalina.core.StandardService; +import org.apache.catalina.valves.ValveBase; +import org.junit.Test; + +import java.io.IOException; +import java.util.concurrent.atomic.AtomicBoolean; + +import jakarta.servlet.ServletException; +import jakarta.servlet.http.HttpServletResponse; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +public class LimitedBasicValveTest { + @Test + public void rootContext() throws Exception { + assertTrue(authenticates("", "/hessian/MyBean")); + assertFalse(authenticates("", "/other")); + } + + @Test + public void nonRootContext() throws Exception { + assertTrue(authenticates("/myapp", "/myapp/hessian/MyBean")); + assertFalse(authenticates("/myapp", "/myapp/other")); + } + + private static boolean authenticates(final String contextPath, final String uri) throws IOException, ServletException { + final AtomicBoolean authenticated = new AtomicBoolean(); + final AtomicBoolean invokedNext = new AtomicBoolean(); + + final TomcatHessianRegistry.LimitedBasicValve valve = new TomcatHessianRegistry.LimitedBasicValve() { + @Override + public boolean authenticate(final Request request, final HttpServletResponse response) { + authenticated.set(true); + return true; + } + }; + valve.setNext(new ValveBase() { + @Override + public void invoke(final Request request, final Response response) { + invokedNext.set(true); + } + }); + + final StandardEngine engine = new StandardEngine(); + engine.setService(new StandardService()); + final StandardHost host = new StandardHost(); + host.setParent(engine); + final StandardContext context = new StandardContext(); + context.setParent(host); + context.setPath(contextPath); + + final Connector connector = new Connector(); + final Request request = new Request(connector); + request.setCoyoteRequest(new org.apache.coyote.Request()); + request.getCoyoteRequest().requestURI().setString(uri); + request.getCoyoteRequest().decodedURI().setString(uri); + request.getMappingData().context = context; + request.getMappingData().contextSlashCount = contextPath.isEmpty() ? 0 : 1; + + final Response response = new Response(); + response.setCoyoteResponse(new org.apache.coyote.Response()); + + valve.invoke(request, response); + + assertTrue(invokedNext.get()); + return authenticated.get(); + } +}
