<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en"><head><meta http-equiv="Content-Type" content="text/html;charset=UTF-8"/><link rel="stylesheet" href="../jacoco-resources/report.css" type="text/css"/><link rel="shortcut icon" href="../jacoco-resources/report.gif" type="image/gif"/><title>SecureRemoteInvocationFactory.java</title><link rel="stylesheet" href="../jacoco-resources/prettify.css" type="text/css"/><script type="text/javascript" src="../jacoco-resources/prettify.js"></script></head><body onload="window['PR_TAB_WIDTH']=4;prettyPrint()"><div class="breadcrumb" id="breadcrumb"><span class="info"><a href="../jacoco-sessions.html" class="el_session">Sessions</a></span><a href="../index.html" class="el_report">Apache Shiro :: Support :: Spring</a> &gt; <a href="index.source.html" class="el_package">org.apache.shiro.spring.remoting</a> &gt; <span class="el_source">SecureRemoteInvocationFactory.java</span></div><h1>SecureRemoteInvocationFactory.java</h1><pre class="source lang-java linenums">/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * &quot;License&quot;); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * &quot;AS IS&quot; BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.shiro.spring.remoting;

import org.aopalliance.intercept.MethodInvocation;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.NativeSessionManager;
import org.apache.shiro.session.mgt.SessionKey;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.subject.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.remoting.support.DefaultRemoteInvocationFactory;
import org.springframework.remoting.support.RemoteInvocation;
import org.springframework.remoting.support.RemoteInvocationFactory;

import java.io.Serializable;

/**
 * A {@link RemoteInvocationFactory} that passes the session ID to the server via a
 * {@link RemoteInvocation} {@link RemoteInvocation#getAttribute(String) attribute}.
 * This factory is the client-side part of
 * the Shiro Spring remoting invocation.  A {@link SecureRemoteInvocationExecutor} should
 * be used to export the server-side remote services to ensure that the appropriate
 * Subject and Session are bound to the remote thread during execution.
 *
 * @since 0.1
 */
public class SecureRemoteInvocationFactory extends DefaultRemoteInvocationFactory {

<span class="fc" id="L48">    private static final Logger log = LoggerFactory.getLogger(SecureRemoteInvocationFactory.class);</span>

<span class="fc" id="L50">    public static final String SESSION_ID_KEY = SecureRemoteInvocationFactory.class.getName() + &quot;.SESSION_ID_KEY&quot;;</span>
<span class="fc" id="L51">    public static final String HOST_KEY = SecureRemoteInvocationFactory.class.getName() + &quot;.HOST_KEY&quot;;</span>

    private static final String SESSION_ID_SYSTEM_PROPERTY_NAME = &quot;shiro.session.id&quot;;

    private String sessionId;

<span class="fc" id="L57">    public SecureRemoteInvocationFactory() {</span>
<span class="fc" id="L58">    }</span>

    public SecureRemoteInvocationFactory(String sessionId) {
<span class="nc" id="L61">        this();</span>
<span class="nc" id="L62">        this.sessionId = sessionId;</span>
<span class="nc" id="L63">    }</span>

    /**
     * Creates a {@link RemoteInvocation} with the current session ID as an
     * {@link RemoteInvocation#getAttribute(String) attribute}.
     *
     * @param mi the method invocation that the remote invocation should be based on.
     * @return a remote invocation object containing the current session ID as an attribute.
     */
    public RemoteInvocation createRemoteInvocation(MethodInvocation mi) {

<span class="fc" id="L74">        Serializable sessionId = null;</span>
<span class="fc" id="L75">        String host = null;</span>
<span class="fc" id="L76">        boolean sessionManagerMethodInvocation = false;</span>

        //If the calling MI is for a remoting SessionManager delegate, we need to acquire the session ID from the method
        //argument and NOT interact with SecurityUtils/subject.getSession to avoid a stack overflow
<span class="fc" id="L80">        Class miDeclaringClass = mi.getMethod().getDeclaringClass();</span>
<span class="pc bpc" id="L81" title="3 of 4 branches missed.">        if (SessionManager.class.equals(miDeclaringClass) || NativeSessionManager.class.equals(miDeclaringClass)) {</span>
<span class="fc" id="L82">            sessionManagerMethodInvocation = true;</span>
            //for SessionManager calls, all method calls except the 'start' methods require a SessionKey
            // as the first argument, so just get it from there:
<span class="fc bfc" id="L85" title="All 2 branches covered.">            if (!mi.getMethod().getName().equals(&quot;start&quot;)) {</span>
<span class="fc" id="L86">                SessionKey key = (SessionKey) mi.getArguments()[0];</span>
<span class="fc" id="L87">                sessionId = key.getSessionId();</span>
            }
        }

        //tried the delegate. Use the injected session id if given
<span class="fc bfc" id="L92" title="All 2 branches covered.">        if (sessionId == null) sessionId = this.sessionId;</span>

        // If sessionId is null, only then try the Subject:
<span class="fc bfc" id="L95" title="All 2 branches covered.">        if (sessionId == null) {</span>
            try {
                // HACK Check if can get the securityManager - this'll cause an exception if it's not set 
<span class="nc" id="L98">                SecurityUtils.getSecurityManager();</span>
<span class="nc bnc" id="L99" title="All 2 branches missed.">                if (!sessionManagerMethodInvocation) {</span>
<span class="nc" id="L100">                    Subject subject = SecurityUtils.getSubject();</span>
<span class="nc" id="L101">                    Session session = subject.getSession(false);</span>
<span class="nc bnc" id="L102" title="All 2 branches missed.">                    if (session != null) {</span>
<span class="nc" id="L103">                        sessionId = session.getId();</span>
<span class="nc" id="L104">                        host = session.getHost();</span>
                    }
                }
            }
<span class="fc" id="L108">            catch (Exception e) {</span>
<span class="fc" id="L109">                log.trace(&quot;No security manager set. Trying next to get session id from system property&quot;);</span>
<span class="nc" id="L110">            }</span>
        }
        //No call to the sessionManager, and the Subject doesn't have a session.  Try a system property
        //as a last result:
<span class="fc bfc" id="L114" title="All 2 branches covered.">        if (sessionId == null) {</span>
<span class="pc bpc" id="L115" title="1 of 2 branches missed.">            if (log.isTraceEnabled()) {</span>
<span class="nc" id="L116">                log.trace(&quot;No Session found for the currently executing subject via subject.getSession(false).  &quot; +</span>
                        &quot;Attempting to revert back to the 'shiro.session.id' system property...&quot;);
            }
<span class="fc" id="L119">            sessionId = System.getProperty(SESSION_ID_SYSTEM_PROPERTY_NAME);</span>
<span class="pc bpc" id="L120" title="2 of 4 branches missed.">            if (sessionId == null &amp;&amp; log.isTraceEnabled()) {</span>
<span class="nc" id="L121">                log.trace(&quot;No 'shiro.session.id' system property found.  Heuristics have been exhausted; &quot; +</span>
                        &quot;RemoteInvocation will not contain a sessionId.&quot;);
            }
        }

<span class="fc" id="L126">        RemoteInvocation ri = new RemoteInvocation(mi);</span>
<span class="fc bfc" id="L127" title="All 2 branches covered.">        if (sessionId != null) {</span>
<span class="fc" id="L128">            ri.addAttribute(SESSION_ID_KEY, sessionId);</span>
        }
<span class="pc bpc" id="L130" title="1 of 2 branches missed.">        if (host != null) {</span>
<span class="nc" id="L131">            ri.addAttribute(HOST_KEY, host);</span>
        }

<span class="fc" id="L134">        return ri;</span>
    }
}
</pre><div class="footer"><span class="right">Created with <a href="http://www.eclemma.org/jacoco">JaCoCo</a> 0.7.7.201606060606</span></div></body></html>