Class WebResourcePermission
- java.lang.Object
-
- java.security.Permission
-
- javax.security.jacc.WebResourcePermission
-
- All Implemented Interfaces:
java.io.Serializable
,java.security.Guard
public final class WebResourcePermission extends java.security.Permission implements java.io.Serializable
Class for Servlet web resource permissions. A
WebResourcePermission
is a named permission and has actions.The name of a
WebResourcePermission
(also referred to as the target name) identifies the Web resources to which the permission pertains.Implementations of this class MAY implement
newPermissionCollection
or inherit its implementation from the super class.- See Also:
- Serialized Form
-
-
Field Summary
Fields Modifier and Type Field Description private static java.util.TreeSet<java.lang.String>
ALL_HTTP_METHODS
(package private) static java.lang.String
ENCODED_COLON
private java.util.TreeSet<java.lang.String>
httpExceptionList
private java.lang.String
httpExceptionString
private java.util.TreeSet<java.lang.String>
httpMethods
private java.lang.String
httpMethodsString
private static java.io.ObjectStreamField[]
serialPersistentFields
private static long
serialVersionUID
private URLPatternSpec
urlSpec
-
Constructor Summary
Constructors Constructor Description WebResourcePermission(java.lang.String name, java.lang.String actions)
Creates a new WebResourcePermission with the specified name and actions.WebResourcePermission(java.lang.String urlPatternSpec, java.lang.String[] httpMethods)
Creates a new WebResourcePermission with name corresponding to the URLPatternSpec, and actions composed from the array of HTTP methods.WebResourcePermission(javax.servlet.http.HttpServletRequest request)
Creates a new WebResourcePermission from the HttpServletRequest object.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description (package private) static java.lang.Object[]
canonicalMethods(java.lang.String methods)
(package private) static java.lang.Object[]
canonicalMethods(java.lang.String[] methods)
(package private) static java.lang.Object[]
canonicalMethods(java.util.TreeSet<java.lang.String> actions)
boolean
equals(java.lang.Object p)
Checks two WebResourcePermission objects for equality.java.lang.String
getActions()
Returns a canonical String representation of the actions of this WebResourcePermission.int
hashCode()
Returns the hash code value for this WebResourcePermission.boolean
implies(java.security.Permission permission)
Determines if the argument Permission is "implied by" this WebResourcePermission.(package private) static boolean
matchExceptionList(java.util.TreeSet<java.lang.String> myExceptionList, java.util.TreeSet<java.lang.String> matchingExceptionList)
private void
parseActions(java.lang.String actions)
private void
readObject(java.io.ObjectInputStream ois)
(package private) static java.lang.String
requestURI(javax.servlet.http.HttpServletRequest request)
Build a permission name from the substring of theHttpServletRequest.getRequestURI()
) that begins after the contextPath (HttpServletRequest.getContextPath()
).private void
writeObject(java.io.ObjectOutputStream oos)
-
-
-
Field Detail
-
serialVersionUID
private static final long serialVersionUID
- Since:
- 4.0.2
- See Also:
- Constant Field Values
-
ALL_HTTP_METHODS
private static java.util.TreeSet<java.lang.String> ALL_HTTP_METHODS
-
ENCODED_COLON
static final java.lang.String ENCODED_COLON
- See Also:
- Constant Field Values
-
serialPersistentFields
private static final java.io.ObjectStreamField[] serialPersistentFields
-
urlSpec
private transient URLPatternSpec urlSpec
-
httpMethods
private transient java.util.TreeSet<java.lang.String> httpMethods
-
httpMethodsString
private transient java.lang.String httpMethodsString
-
httpExceptionList
private transient java.util.TreeSet<java.lang.String> httpExceptionList
-
httpExceptionString
private transient java.lang.String httpExceptionString
-
-
Constructor Detail
-
WebResourcePermission
public WebResourcePermission(javax.servlet.http.HttpServletRequest request)
Creates a new WebResourcePermission from the HttpServletRequest object.
- Parameters:
request
- - theHttpServletRequest
object corresponding to the Servlet operation to which the permission pertains. The permission name is the substring of the requestURI (HttpServletRequest.getRequestURI()
) that begins after the contextPath (HttpServletRequest.getContextPath()
). When the substring operation yields the string “/”, the permission is constructed with the empty string as its name. The permission’s actions field is obtained fromHttpServletRequest.getMethod()
. The constructor must transform all colon characters occurring in the name to escaped encoding as defined in RFC 2396.
-
WebResourcePermission
public WebResourcePermission(java.lang.String name, java.lang.String actions)
Creates a new WebResourcePermission with the specified name and actions.
The name contains a URLPatternSpec that identifies the web resources to which the permissions applies. The syntax of a URLPatternSpec is as follows:
URLPatternList ::= URLPattern | URLPatternList colon URLPattern URLPatternSpec ::= null | URLPattern | URLPattern colon URLPatternList
A null URLPatternSpec is translated to the default URLPattern, "/", by the permission constructor. The empty string is an exact URLPattern, and may occur anywhere in a URLPatternSpec that an exact URLPattern may occur. The first URLPattern in a URLPatternSpec may be any of the pattern types, exact, path-prefix, extension, or default as defined in the Java Servlet Specification). When a URLPatternSpec includes a URLPatternList, the patterns of the URLPatternList identify the resources to which the permission does NOT apply and depend on the pattern type and value of the first pattern as follows:
- No pattern may exist in the URLPatternList that matches the first pattern.
- If the first pattern is a path-prefix pattern, only exact patterns matched by the first pattern and path-prefix patterns matched by, but different from, the first pattern may occur in the URLPatternList.
- If the first pattern is an extension pattern, only exact patterns that are matched by the first pattern and path-prefix patterns may occur in the URLPatternList.
- If the first pattern is the default pattern, "/", any pattern except the default pattern may occur in the URLPatternList.
- If the first pattern is an exact pattern a URLPatternList must not be present in the URLPatternSpec.
The actions parameter contains a comma separated list of HTTP methods. The syntax of the actions parameter is defined as follows:
ExtensionMethod ::= any token as defined by RFC 2616 (that is, 1*[any CHAR except CTLs or separators]) HTTPMethod ::= "GET" | "POST" | "PUT" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE | ExtensionMethod" HTTPMethodList ::= HTTPMethod | HTTPMethodList comma HTTPMethod HTTPMethodExceptionList ::= exclaimationPoint HTTPMethodList HTTPMethodSpec ::= null | HTTPMethodExceptionList | HTTPMethodList
If duplicates occur in the HTTPMethodSpec they must be eliminated by the permission constructor.
A null or empty string HTTPMethodSpec indicates that the permission applies to all HTTP methods at the resources identified by the URL pattern.
If the HTTPMethodSpec contains an HTTPMethodExceptionList (i.e., it begins with an exclamation- Point), the permission pertains to all methods except those occurring in the exception list.
- Parameters:
name
- - the URLPatternSpec that identifies the application specific web resources to which the permission pertains. All URLPatterns in the URLPatternSpec are relative to the context path of the deployed web application module, and the same URLPattern must not occur more than once in a URLPatternSpec. A null URLPatternSpec is translated to the default URLPattern, “/”, by the permission constructor. All colons occurring within the URLPattern elements of the URLPatternSpec must be represented in escaped encoding as defined in RFC 2396.actions
- - identifies the HTTP methods to which the permission pertains. If the value passed through this parameter is null or the empty string, then the permission is constructed with actions corresponding to all the possible HTTP methods.
-
WebResourcePermission
public WebResourcePermission(java.lang.String urlPatternSpec, java.lang.String[] httpMethods)
Creates a new WebResourcePermission with name corresponding to the URLPatternSpec, and actions composed from the array of HTTP methods.
- Parameters:
urlPatternSpec
- - the URLPatternSpec that identifies the application specific web resources to which the permission pertains. All URLPatterns in the URLPatternSpec are relative to the context path of the deployed web application module, and the same URLPattern must not occur more than once in a URLPatternSpec. A null URLPatternSpec is translated to the default URLPattern, “/”, by the permission constructor. All colons occurring within the URLPattern elements of the URLPatternSpec must be represented in escaped encoding as defined in RFC 2396.httpMethods
- - an array of strings each element of which contains the value of an HTTP method. If the value passed through this parameter is null or is an array with no elements, then the permission is constructed with actions corresponding to all the possible HTTP methods.
-
-
Method Detail
-
equals
public boolean equals(java.lang.Object p)
Checks two WebResourcePermission objects for equality. WebResourcePermission objects are equivalent if their URLPatternSpec and (canonicalized) actions values are equivalent. The URLPatternSpec of a refer- ence permission is equivalent to that of an argument permission if their first patterns are equivalent, and the patterns of the URLPatternList of the reference permission collectively match exactly the same set of pat- terns as are matched by the patterns of the URLPatternList of the argument permission.
Two Permission objects, P1 and P2, are equivalent if and only if P1.implies(P2) && P2.implies(P1).
- Specified by:
equals
in classjava.security.Permission
- Parameters:
p
- - the WebResourcePermission object being tested for equality with this WebResourcePermission.- Returns:
- true if the argument WebResourcePermission object is equivalent to this WebResourcePermission.
-
getActions
public java.lang.String getActions()
Returns a canonical String representation of the actions of this WebResourcePermission. WebResourcePermission actions are canonicalized by sorting the HTTP methods into ascending lexical order. There may be no duplicate HTTP methods in the canonical form, and the canonical form of the set of all HTTP methods is the value null.
- Specified by:
getActions
in classjava.security.Permission
- Returns:
- a String containing the canonicalized actions of this WebResourcePermission (or the null value).
-
hashCode
public int hashCode()
Returns the hash code value for this WebResourcePermission. The properties of the returned hash code must be as follows:
- During the lifetime of a Java application, the hashCode method must return the same integer value, every time it is called on a WebResourcePermission object. The value returned by hashCode for a particular WebResourcePermission need not remain consistent from one execution of an application to another.
- If two WebResourcePermission objects are equal according to the equals method, then calling the hashCode method on each of the two Permission objects must produce the same integer result (within an application).
- Specified by:
hashCode
in classjava.security.Permission
- Returns:
- the integer hash code value for this object.
-
implies
public boolean implies(java.security.Permission permission)
Determines if the argument Permission is "implied by" this WebResourcePermission. For this to be the case, all of the following must be true:
- The argument is an instance of WebResourcePermission
- The first URLPattern in the name of the argument permission is matched by the first URLPattern in the name of this permission.
- The first URLPattern in the name of the argument permission is NOT matched by any URLPattern in the URLPatternList of the URLPatternSpec of this permission.
- If the first URLPattern in the name of the argument permission matches the first URLPattern in the URLPatternSpec of this permission, then every URLPattern in the URLPatternList of the URLPatternSpec of this permission is matched by a URLPattern in the URLPatternList of the argument permission.
- The HTTP methods in the actions of the argument permission are a subset of the HTTP methods in the actions of this permission.
URLPattern matching is performed using the Servlet matching rules where two URL patterns match if they are related as follows:
- their pattern values are String equivalent, or
- this pattern is the path-prefix pattern "/*", or
- this pattern is a path-prefix pattern (that is, it starts with "/" and ends with "/*") and the argument pattern starts with the substring of this pattern, minus its last 2 characters, and the next character of the argument pattern, if there is one, is "/", or
- this pattern is an extension pattern (that is, it starts with "*.") and the argument pattern ends with this pattern, or - the reference pattern is the special default pattern, "/", which matches all argument patterns.
All of the comparisons described above are case sensitive.
- Specified by:
implies
in classjava.security.Permission
- Parameters:
permission
- - “this” WebResourcePermission is checked to see if it implies the argument permission.- Returns:
- true if the specified permission is implied by this object, false if not.
-
requestURI
static java.lang.String requestURI(javax.servlet.http.HttpServletRequest request)
Build a permission name from the substring of the
HttpServletRequest.getRequestURI()
) that begins after the contextPath (HttpServletRequest.getContextPath()
). When the substring operation yields the string "/", the permission is constructed with the empty string as its name.- Parameters:
request
- - the Servlet request object.- Returns:
- the resource permission name.
-
canonicalMethods
static java.lang.Object[] canonicalMethods(java.lang.String methods)
-
canonicalMethods
static java.lang.Object[] canonicalMethods(java.lang.String[] methods)
-
canonicalMethods
static java.lang.Object[] canonicalMethods(java.util.TreeSet<java.lang.String> actions)
-
parseActions
private void parseActions(java.lang.String actions)
-
matchExceptionList
static boolean matchExceptionList(java.util.TreeSet<java.lang.String> myExceptionList, java.util.TreeSet<java.lang.String> matchingExceptionList)
-
readObject
private void readObject(java.io.ObjectInputStream ois) throws java.lang.ClassNotFoundException, java.io.IOException
- Throws:
java.lang.ClassNotFoundException
java.io.IOException
-
writeObject
private void writeObject(java.io.ObjectOutputStream oos) throws java.io.IOException
- Throws:
java.io.IOException
-
-