Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2209

deny-uncovered-methods grants access to forbidden methods when default security is blank

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • 2.3.2.Final, 2.2.23.Final
    • 2.3.1.Final, 2.2.22.Final, 2.2.22.SP1
    • None
    • None

      The Undertow upgrade to 2.3.1.Final in WildFly broke the DenyUncoveredHttpMethodsTestCase. The reason is that, because default security config is blank, the match algorithm assumes that deny-uncovered-methods makes any method uncovered from that perspective, even when there are security configs for that particular method.
      Because security matches is merged, if the algorithm finds an allow and a deny, when merging the results the outcome is allow and hence the test fails.

            flaviarnn Flavia Rainone
            flaviarnn Flavia Rainone
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: