Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2209

deny-uncovered-methods grants access to forbidden methods when default security is blank

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • 2.3.2.Final, 2.2.23.Final
    • 2.3.1.Final, 2.2.22.Final, 2.2.22.SP1
    • None
    • None

      The Undertow upgrade to 2.3.1.Final in WildFly broke the DenyUncoveredHttpMethodsTestCase. The reason is that, because default security config is blank, the match algorithm assumes that deny-uncovered-methods makes any method uncovered from that perspective, even when there are security configs for that particular method.
      Because security matches is merged, if the algorithm finds an allow and a deny, when merging the results the outcome is allow and hence the test fails.

              flaviarnn Flavia Rainone
              flaviarnn Flavia Rainone
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: