diff --git a/.asf.yaml b/.asf.yaml index 7ad465ec65..36306ad458 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -25,12 +25,12 @@ github: issues: true projects: true enabled_merge_buttons: - squash: false - merge: true - rebase: false + squash: false + merge: true + rebase: false notifications: pullrequests: commits@shiro.apache.org commits: commits@shiro.apache.org - issues: issues@shiro.apache.org + issues: issues@shiro.apache.org jira_options: link label worklog diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 64280a08db..d3180e0408 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -5,36 +5,29 @@ For more details on how to report a vulnerablity see: https://www.apache.org/sec Following this checklist to help us incorporate your contribution quickly and easily: -- [ ] Make sure there is a [GitHub issue](https://github.com/apache/shiro/issues) filed - for the change (usually before you start working on it). Trivial changes like typos do not - require a GitHub issue. Your pull request should address just this issue, without pulling in other changes. -- [ ] Each commit in the pull request should have a meaningful subject line and body. -- [ ] Format the pull request title like `[#XXX] - Fixes bug in SessionManager`, - where you replace `#XXX` with the appropriate GitHub issue. Best practice - is to use the GitHub issue title in the pull request title and in the first line of the commit message. -- [ ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why. -- [ ] add `fixes #XXX` if merging the PR should close a related issue. -- [ ] Run `mvn verify` to make sure basic checks pass. A more thorough check will be performed on your pull request - automatically. -- [ ] If you have a group of commits related to the same change, please squash your commits into one and force push your - branch using `git rebase -i`. -- [ ] Committers: Make sure a milestone is set on the PR - -Trivial changes like typos do not require a GitHub issue (javadoc, comments...). + - [ ] Make sure there is a [GitHub issue](https://github.com/apache/shiro/issues) filed + for the change (usually before you start working on it). Trivial changes like typos do not + require a GitHub issue. Your pull request should address just this issue, without pulling in other changes. + - [ ] Each commit in the pull request should have a meaningful subject line and body. + - [ ] Format the pull request title like `[#XXX] - Fixes bug in SessionManager`, + where you replace `#XXX` with the appropriate GitHub issue. Best practice + is to use the GitHub issue title in the pull request title and in the first line of the commit message. + - [ ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why. + - [ ] add `fixes #XXX` if merging the PR should close a related issue. + - [ ] Run `mvn verify` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically. + - [ ] If you have a group of commits related to the same change, please squash your commits into one and force push your branch using `git rebase -i`. + - [ ] Committers: Make sure a milestone is set on the PR + +Trivial changes like typos do not require a GitHub issue (javadoc, comments...). In this case, just format the pull request title like `[DOC] - Add javadoc in SessionManager`. + +If this is your first contribution, you have to read the [Contribution Guidelines](https://github.com/apache/shiro/blob/master/CONTRIBUTING.md) -If this is your first contribution, you have to read -the [Contribution Guidelines](https://github.com/apache/shiro/blob/master/CONTRIBUTING.md) - -If your pull request is about ~20 lines of code you don't need to sign -an [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf) +If your pull request is about ~20 lines of code you don't need to sign an [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf) if you are unsure please ask on the developers list. -To make clear that you license your contribution under -the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) +To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) you have to acknowledge this by using the following check-box. -- [ ] I hereby declare this contribution to be licenced under - the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) -- [ ] In any other case, please file - an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). + - [ ] I hereby declare this contribution to be licenced under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) + - [ ] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 48bd0cbb88..3953cf37bb 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -3,9 +3,7 @@ Contributing to Apache Shiro Summary ------- -This document covers how to contribute to the Apache Shiro project. These instructions assume you have a GitHub.com -account, so if you don't have one you will have to create one. Your proposed code changes will be published to your own -fork of the Apache Shiro project and you will submit a Pull Request for your changes to be added. +This document covers how to contribute to the Apache Shiro project. These instructions assume you have a GitHub.com account, so if you don't have one you will have to create one. Your proposed code changes will be published to your own fork of the Apache Shiro project and you will submit a Pull Request for your changes to be added. _Lets get started!!!_ @@ -17,8 +15,7 @@ In your browser, navigate to: [https://github.com/apache/shiro](https://github.c Fork the repository by clicking on the 'Fork' button on the top right hand side. The fork will happen and you will be taken to your own fork of the repository. -Copy the Git repository URL by clicking on the clipboard next to the URL on the right hand side of the page under '* -*HTTPS** clone URL'. +Copy the Git repository URL by clicking on the clipboard next to the URL on the right hand side of the page under '**HTTPS** clone URL'. You will paste this URL when doing the following `git clone` command. On your computer, follow these steps to setup a local repository for working on Apache Shiro: @@ -32,18 +29,15 @@ $ git fetch upstream $ git rebase upstream/main ``` + Making changes -------------- -It is important that you create a new branch to make changes on and that you do not change the `main` branch (other than -to rebase in changes from `upstream/main`). -In this example I will assume you will be making your changes to a branch called `feature_x`. This `feature_x` branch -will be created on your local repository and -will be pushed to your forked repository on GitHub. Once this branch is on your fork you will create a Pull Request for -the changes to be added to the Apache Shiro project. +It is important that you create a new branch to make changes on and that you do not change the `main` branch (other than to rebase in changes from `upstream/main`). +In this example I will assume you will be making your changes to a branch called `feature_x`. This `feature_x` branch will be created on your local repository and +will be pushed to your forked repository on GitHub. Once this branch is on your fork you will create a Pull Request for the changes to be added to the Apache Shiro project. -It is best practice to create a new branch each time you want to contribute to the project and only track the changes -for that pull request in this branch. +It is best practice to create a new branch each time you want to contribute to the project and only track the changes for that pull request in this branch. ``` bash $ git checkout -b feature_x @@ -53,20 +47,16 @@ $ git add . $ git commit -a -m "descriptive commit message for your changes" ``` -> The `-b` specifies that you want to create a new branch called `feature_x`. You only specify `-b` the first time you -> checkout because you are creating a new branch. +> The `-b` specifies that you want to create a new branch called `feature_x`. You only specify `-b` the first time you checkout because you are creating a new branch. > Once the `feature_x` branch exists, you can later switch to it with only `git checkout feature_x`. Rebase `feature_x` to include updates from `upstream/main` ------------------------------------------------------------ -It is important that you maintain an up-to-date `main` branch in your local repository. This is done by rebasing in the -code changes from `upstream/main` -(the official Apache Shiro project repository) into your local repository. You will want to do this before you start -working on a feature as well as right -before you submit your changes as a pull request. I recommend you do this process periodically while you work to make -sure you are working off the most recent project code. +It is important that you maintain an up-to-date `main` branch in your local repository. This is done by rebasing in the code changes from `upstream/main` +(the official Apache Shiro project repository) into your local repository. You will want to do this before you start working on a feature as well as right +before you submit your changes as a pull request. I recommend you do this process periodically while you work to make sure you are working off the most recent project code. This process will do the following: @@ -88,12 +78,10 @@ $ git rebase main Make a GitHub Pull Request to contribute your changes ----------------------------------------------------- -When you are happy with your changes and you are ready to contribute them, you will create a Pull Request on GitHub to -do so. This is done by pushing your local changes +When you are happy with your changes and you are ready to contribute them, you will create a Pull Request on GitHub to do so. This is done by pushing your local changes to your forked repository (default remote name is `origin`) and then initiating a pull request on GitHub. -> **IMPORTANT:** Make sure you have rebased your `feature_x` branch to include the latest code from `upstream/main` -_before_ you do this. +> **IMPORTANT:** Make sure you have rebased your `feature_x` branch to include the latest code from `upstream/main` _before_ you do this. ``` bash $ git push origin main @@ -104,27 +92,22 @@ Now that the `feature_x` branch has been pushed to your GitHub repository, you c To initiate the pull request, do the following: -1. In your browser, navigate to your forked - repository: [https://github.com/YOUR_ACCOUNT/shiro](https://github.com/YOUR_ACCOUNT/shiro) -2. Click the new button called '**Compare & pull request**' that showed up just above the main area in your forked - repository +1. In your browser, navigate to your forked repository: [https://github.com/YOUR_ACCOUNT/shiro](https://github.com/YOUR_ACCOUNT/shiro) +2. Click the new button called '**Compare & pull request**' that showed up just above the main area in your forked repository 3. Validate the pull request will be into the upstream `main` and will be from your `feature_x` branch 4. Enter a detailed description of the work you have done and then click '**Send pull request**' -If you are requested to make modifications to your proposed changes, make the changes locally on your `feature_x` -branch, re-push the `feature_x` branch to your fork. +If you are requested to make modifications to your proposed changes, make the changes locally on your `feature_x` branch, re-push the `feature_x` branch to your fork. The existing pull request should automatically pick up the change and update accordingly. Cleaning up after a successful pull request ------------------------------------------- -Once the `feature_x` branch has been committed into the `upstream/main` branch, your local `feature_x` branch and -the `origin/feature_x` branch are no longer needed. +Once the `feature_x` branch has been committed into the `upstream/main` branch, your local `feature_x` branch and the `origin/feature_x` branch are no longer needed. If you want to make additional changes, restart the process with a new branch. -> **IMPORTANT:** Make sure that your changes are in `upstream/main` before you delete your `feature_x` -> and `origin/feature_x` branches! +> **IMPORTANT:** Make sure that your changes are in `upstream/main` before you delete your `feature_x` and `origin/feature_x` branches! You can delete these deprecated branches with the following: diff --git a/LICENSE b/LICENSE index f49a4e16e6..753842b672 100644 --- a/LICENSE +++ b/LICENSE @@ -1,201 +1,201 @@ - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and limitations under the License. \ No newline at end of file diff --git a/README.md b/README.md index 4d01f468c2..effbff5373 100644 --- a/README.md +++ b/README.md @@ -7,10 +7,7 @@ Apache Shiro ============ -[Apache Shiro](http://shiro.apache.org) is a powerful and easy-to-use Java security framework that performs -authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can -quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise -applications. +[Apache Shiro](http://shiro.apache.org) is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications. Documentation and Examples -------------------------- @@ -18,9 +15,8 @@ http://shiro.apache.org Tutorials --------- - * [10 Minute Tutorial](http://shiro.apache.org/10-minute-tutorial.html) -* [Web Application](http://shiro.apache.org/webapp-tutorial.html) +* [Web Application](http://shiro.apache.org/webapp-tutorial.html) License ------- diff --git a/RELEASE-NOTES b/RELEASE-NOTES index 2be485aecd..58e3501db0 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -1,572 +1,572 @@ -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. - -This is not an official release notes document. It exists for Shiro developers -to jot down their notes while working in the source code. These notes will be -combined with Jira’s auto-generated release notes during a release for the -total set. - -########################################################### -# 2.0.0 -########################################################### - -Improvement - - [SHIRO-290] Implement bcrypt and argon2 KDF algorithms - -Backwards Incompatible Changes --------------------------------- - -* Changed default DefaultPasswordService.java algorithm to "Argon2id". -* PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. - It was never specified how this method would behave. -* Made salt non-nullable. -* Removed methods in PasswordMatcher. - - -########################################################### -# 1.7.1 -########################################################### - -Bug - - [SHIRO-797] - Shiro 1.7.0 is lower than using springboot version 2.0.7 dependency error - - -########################################################### -# 1.7.0 -########################################################### - -Bug - - [SHIRO-767] - org.apache.shiro.util.ClassUtil cannot load the array of Primitive DataType when use undertow as web container - [SHIRO-792] - ShiroWebFilterConfiguration seems to conflict with other FilterRegistrationBean - -New Feature - - [SHIRO-789] - Also add cookie SameSite option to Spring - -Improvement - - [SHIRO-740] - SslFilter with HTTP Strict Transport Security (HSTS) - [SHIRO-794] - Add system property to enable backslash path normalization - [SHIRO-795] - Disable session path rewriting by default - -Task - - [SHIRO-793] - deleteMe cookie should use the defined "sameSite" - - -########################################################### -# 1.6.0 -########################################################### - -Bug - - [SHIRO-610] - Incorrect filterchainResolver in 1.4.0-RC2 - [SHIRO-762] - SecurityUtils.securityManager should be volatile - [SHIRO-766] - ArrayIndexOutOfBoundsException in Base64#decode - -New Feature - - [SHIRO-788] - Add support for Global Filters - -Wish - - [SHIRO-780] - NOTICE files of shiro components don't match NOTICE in source code repository - - -########################################################### -# 1.5.3 -########################################################### - -Bug - - [SHIRO-530] - INI parser does not properly handled backslashes at end of values - [SHIRO-751] - SimplePrincipalMap and SimplePrincipalCollection throw different exceptions for the same problem - [SHIRO-753] - Regression in URI parsing in Shiro 1.5.2 - -Dependency upgrade - - [SHIRO-754] - Upgrade to Apache Commons Codec 1.14 - [SHIRO-755] - Upgrade to Hazelcast 3.12.6 - [SHIRO-756] - Upgrade to Spring 5.2.5.RELEASE and Spring boot 2.2.6.RELEASE - [SHIRO-757] - Upgrade to Htmlunit 2.39.0 - [SHIRO-758] - Upgrade to Jetty 9.4.27.v20200227 - [SHIRO-759] - Upgrade to Karaf 4.2.8 - - -########################################################### -# 1.5.2 -########################################################### - -Bug - - [SHIRO-747] - FirstSuccessfulStrategy doesn't properly short circuit - [SHIRO-749] - shiro-all jar is missing cache package - -Improvement - - [SHIRO-748] - Update Commons Configuration to 2.7 - - -########################################################### -# 1.5.1 -########################################################### - -Bug - - [SHIRO-736] - DefaultCipherInstance is an alias which is not available in every JVM or JCA Provider - [SHIRO-739] - Bean reflection property failed with Enum values - [SHIRO-741] - Matching of / (root) is broken - [SHIRO-742] - fix throw exception when request uri is / - -Dependency upgrade - - [SHIRO-738] - Upgrade to Spring 5.2.3.RELEASE and Spring boot 2.2.4.RELEASE - - -########################################################### -# 1.5.0 -########################################################### - -Notes: this release require a JRE 8 minimum. - -Bug - - [SHIRO-458] - Possible leaked timing information from DefaultPasswordService - [SHIRO-469] - Wrong description of JdbcRealm#setPermissionsQuery - [SHIRO-552] - JdbcRealm in SaltStyle.COLUMN assumes that password column is Base64 but salt column is utf8 bytes - [SHIRO-661] - Add check for the principal of subject whether is null - [SHIRO-682] - fix the potential threat when use "uri = uri + '/' " to bypassed shiro protect - [SHIRO-684] - INI parser keeps escape characters in keys and values - [SHIRO-685] - Potential NullPointerException if PermissionResolver return null/empty string - [SHIRO-687] - Additional Servlet Filters are not available to ShiroFilterFactorBean (unless using XML based beans) - -New Feature - - [SHIRO-694] - Adds BearerToken support - [SHIRO-722] - Add SameSite option to cookies - -Improvement - - [SHIRO-668] - Catch unexpected errors which can lead to oom - [SHIRO-669] - Included a boolean flag in FirstSuccessfulStrategy to break after first successful authentication - [SHIRO-670] - ByteSource Serializable - [SHIRO-681] - Upgrade to compiler Java 8 - [SHIRO-693] - Update plugins - [SHIRO-700] - Minor spring updates - [SHIRO-706] - Switch to Guice4 by default in the build - [SHIRO-709] - Fix Shiro Spring feature - [SHIRO-710] - Update Commons Lang3 + remove older Commons Lang - [SHIRO-711] - Deprecate JavaEnvironment - [SHIRO-712] - Add BasicIniEnvironment - [SHIRO-715] - Remove old JSTL jars - [SHIRO-720] - Update Commons BeanUtils - [SHIRO-724] - Update Jetty, Spring, Spring Boot, Htmlunit dependencies - [SHIRO-726] - Add dynamic import package - [SHIRO-728] - Update Spring Boot to 2.1.10 - [SHIRO-729] - Update Quartz - [SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService - [SHIRO-731] - Use OWasp Java Encoder to escape user supplied content to the logs - -Test - - [SHIRO-697] - Reduce shiro test logging level to INFO - -Task - - [SHIRO-690] - Validate JDK11 compatibility - [SHIRO-692] - Upgrade and enforce min build maven version to 3.5.0 - [SHIRO-698] - Improve build with maven profile - [SHIRO-734] - Remove Spring-client sample - [SHIRO-735] - Shiro does not support servlet-3.1 void method(@Suspended AsyncResponse) - -Dependency upgrade - - [SHIRO-688] - Upgrade to commons-cli 1.4 - [SHIRO-689] - Upgrade to commons-codec 1.12 - [SHIRO-691] - Upgrade to maven-jar-plugin 3.1.1 - [SHIRO-695] - Update Hazelcast - [SHIRO-696] - Update Jetty - [SHIRO-699] - Fix maven warning for exec-maven-plugin and upgrade to 1.6.0 - [SHIRO-701] - Update logback - [SHIRO-702] - Upgrade to jacoco-maven-plugin 0.8.4 - [SHIRO-703] - Update HSQL - [SHIRO-704] - Update Spring, Spring Boot, Hibernate - [SHIRO-705] - Update Easymock + Powermock - [SHIRO-707] - Misc dependency updates - [SHIRO-716] - Upgrade to commons-codec 1.13 - [SHIRO-717] - Upgrade to maven-pmd-plugin 3.12.0 - [SHIRO-718] - Upgrade to xmlsec 2.1.4 - [SHIRO-719] - Upgrade to Karaf 4.2.6 - -Request - - [SHIRO-723] - Provide Minor Shiro Release that includes CVE-2019-10086 Fix - - -########################################################### -# 1.4.2 -########################################################### - -Bug - - [SHIRO-721] - RememberMe Padding Oracle Vulnerability - -Improvement - - [SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService - - -########################################################### -# 1.4.1 -########################################################### - -Bug - - [SHIRO-457] - Login without static VM security manager cause exception in debug - [SHIRO-563] - shiro-aspectj karaf feature can't be installed - [SHIRO-624] - OSGI: commons configuration import should be optional - [SHIRO-626] - Bundle symbolic name conflict - [SHIRO-637] - Refresh cached session in HTTP request after user logs out - [SHIRO-650] - Shiro JAX-RS is not an OSGi bundle - [SHIRO-653] - Spring-boot registers shiro filter only on REQUEST dispatcher - [SHIRO-655] - shiro-core has an undesirable runtime OSGi dependency to spring-beans - [SHIRO-658] - Problems building shiro on openjdk-8 on current debian stable (9.6 "stretch") - [SHIRO-660] - Bug in FirstSuccessfulStrategy - [SHIRO-680] - Duplicate Bundle-SymbolicName for Different Shiro Modules - -New Feature - - [SHIRO-638] - Update osgi bundle manifest to support Spring 4.x - -Improvement - - [SHIRO-560] - Shiro-web feature can't be installed in karaf 4.0.4 - [SHIRO-652] - Upgrade Shiro Feature to Karaf 4.x - [SHIRO-664] - Upgrade to Apache pom parent 21 - [SHIRO-665] - Upgrade to maven-bundle-plugin 4.1.0 - [SHIRO-667] - Upgrade to Spring 4.3.22-RELEASE - [SHIRO-672] - Upgrade to jacoco-maven-plugin 0.8.3 - [SHIRO-673] - Upgrade to maven-compiler-plugin 3.8.0 - [SHIRO-674] - Upgrade to maven-dependency-plugin to 3.1.1 - [SHIRO-675] - Upgrade to maven-surefire-plugins 3.0.0-M3 - [SHIRO-676] - Upgrade to maven-jar-plugin 3.1.0 - [SHIRO-677] - Upgrade to versions-maven-plugin 2.7 - [SHIRO-683] - Upgrade to spring-boot 1.5.19.RELEASE - -Task - - [SHIRO-662] - Constant Name Change in AuthenticationRealm - [SHIRO-663] - Clean up pom parent relative path - -Dependency upgrade - - [SHIRO-659] - Upgrade to OWASP dependency-check-maven plugin 4.0.0 - - -########################################################### -# 1.4.0 -########################################################### - -Bug - - [SHIRO-559] - shiro-guice violates the JEE specification - [SHIRO-579] - Permission filter is validating last matched path - [SHIRO-603] - Endless recursion in ShiroSecurityContext.getUserPrincipal() - [SHIRO-605] - ShiroWebModule creates out of order filter chain. - [SHIRO-607] - AuthorizationAttributeSourceAdvisor ignores type-annotations - [SHIRO-608] - Use a ServiceLoader to discover WebEnvironments - [SHIRO-611] - Spring web module does not load correct SessionStorageEvaluator - -Improvement - - [SHIRO-596] - shiro-tools-hasher needs private salt option - [SHIRO-618] - Spring Boot Web Starter- Autoconfiguration for Realm and ShiroFilterChainDefinition - - -########################################################### -# 1.4.0-RC2 -########################################################### - -Bug - - [SHIRO-493] - shiro-guice not working with the guice 4.x - [SHIRO-576] - Commons-beanutils dependency is not security compliant - [SHIRO-586] - Can't Search For Groups In Active Directory Without A System User - [SHIRO-587] - Can't Access Groups If userPrincipalName Doesn't Exist - [SHIRO-591] - Basic Auth Filter permissive mode does NOT work - [SHIRO-592] - ModularRealmAuthenticator causes log spam when one realm throws exception - [SHIRO-593] - Allow for IniWebEnvironment subclasses to specify defaults objects to ReflectionBuilder - [SHIRO-594] - Update Hazelcast version to latest supported version (3.7.2) - [SHIRO-595] - Allow for POST only logout requests - [SHIRO-612] - Need to upgrade BeanUtils to avoid vulnerability - -New Feature - - [SHIRO-501] - Add ability to set system properties in shiro.ini - [SHIRO-589] - Add Servlet 3.x fragment - [SHIRO-590] - Add Spring Boot support / starters - -Improvement - - [SHIRO-296] - Typo fixes - [SHIRO-301] - Call permissionResolver directly in AuthorizingRealm - [SHIRO-392] - Shiro Extension for JAX-RS - [SHIRO-599] - Fix file encoding warnings during maven build and reporting - - -########################################################### -# 1.3.2 -########################################################### - -Bug - - [SHIRO-584] - URL Path matching issue with WebUtils.getPathWithinApplication - - -########################################################### -# 1.3.1 -########################################################### - -Bug - - [SHIRO-577] - Regression - Unable to set custom SessionValidationScheduler - [SHIRO-581] - Improve log message when remember me cipher has changed - - -########################################################### -# 1.3.0 -########################################################### - -Bug - - [SHIRO-373] - Complete CAS remember-me support - [SHIRO-397] - SingleArgumentMethodEventListenerTest fails - [SHIRO-421] - Unable to set long timeouts on HttpServletSession - [SHIRO-435] - SecurityManager is not a singleton in ShiroWebModule - [SHIRO-473] - DefaultAnnotationResolver.getAnnotation throws NullPointerException - [SHIRO-480] - setTarget method in DomainPermission does not set targets - [SHIRO-483] - passwordsMatch() returns false with right plain password-encrypted password in JVM with default locale tr_TR - [SHIRO-502] - OSGi import of com.google.inject in shiro-guice has incorrect version range - [SHIRO-513] - Misleading error message when using custom WebEnvironment - [SHIRO-515] - ExecutorServiceSessionValidationScheduler leaks resources due to improper synchronization - [SHIRO-547] - Use MessageDigest#isEqual() instead of Arrays#equals() for comparing digests - [SHIRO-568] - hash iterations is calculated wrongly in SimpleHash - [SHIRO-570] - SimpleCookie should check the path of the cookie - -New Feature - - [SHIRO-200] - Add ability to configure basic authentication for specific HTTP methods - [SHIRO-395] - Add an Event Bus for event publishing and low-coupling for custom components/plugins. - [SHIRO-412] - Hazelcast-based caching and session clustering - [SHIRO-436] - Add EnvironmentLoader finalizeEnvironment method - -Improvement - - [SHIRO-278] - Rename JndiLdapRealm to DefaultLdapRealm - [SHIRO-300] - WildcardPermission: change visibility of field 'parts' to protected - [SHIRO-361] - HttpServletResponse.encodeURL: only append JSESSIONID when necessary - [SHIRO-428] - AuthorizingRealm "no cache" logging should be at DEBUG level, not INFO, OR is should log only once - [SHIRO-437] - WildcardPermission: conformed toString - [SHIRO-514] - ExecutorServiceSessionValidationScheduler should create threads with a configurable name - [SHIRO-564] - WildcardPermission case-insensitive makes parts collections twice - [SHIRO-566] - CollectionUtils should use Collections wrappers of arrays if possible - -Task - - [SHIRO-208] - Correct JDK 1.5 / 1.6 incompatibilities - [SHIRO-320] - Add an example for using Guice integration. - [SHIRO-571] - Mark shiro-cas deprecated (replaced with buji-pac4j) - - -########################################################### -# 1.2.6 -########################################################### - -Bug - - [SHIRO-545] - JavaEnvironment version getter - [SHIRO-567] - shiro-root-1.2.5.pom uses invalid encoding, fails to parse with Gradle 2.14 - - -########################################################### -# 1.2.5 -########################################################### - -Bug - - [SHIRO-443] - SessionValidationScheduler created multiple times, enabling it is not thread safe - [SHIRO-462] - Authentication exceptions are swallowed - [SHIRO-467] - Authentication exception gets swallowed - [SHIRO-550] - Randomize default remember me cipher - -Improvement - - [SHIRO-504] - Java 8 support - [SHIRO-516] - Explicitly specify the version of aspectjtools to avoid build warning - [SHIRO-562] - WildcardPermission calls String.trim() twice in setParts() - - -########################################################### -# 1.2.4 -########################################################### - -Bug - - [SHIRO-517] - Caused by: java.lang.NoClassDefFoundError: Lcom/google/inject/internal/util/$ImmutableList; - [SHIRO-518] - Shiro-CAS: Security Problem in cas-client-core versions older than 3.3.2 - [SHIRO-556] - https://shiro.apache.org/realm.html appears to link to the javadoc under static/current/apidocs not static/latest - -Improvement - - [SHIRO-332] - Change access level of method 'isPermitted' in org.apache.shiro.realm.AuthorizingRealm (line 461) from private to protected - [SHIRO-496] - Update shiro.guice dependency - [SHIRO-498] - ThreadLocal should not be created when not necessary - - -########################################################### -# 1.2.2 -########################################################### - -Bug: - - [SHIRO-316] - Annotations in samples-aspectj Project Does not Work - [SHIRO-351] - Shiro Native Session implementation cannot extract JSESSIONID From URL if JSESSIONID is URL parameter (not HTTP parameter) - [SHIRO-379] - SimpleAccountRealm concurrency access to roles and users - [SHIRO-380] - runAs feature (still) doesn't work - [SHIRO-387] - EnvironmentLoader destroys wrong environment - [SHIRO-388] - Stackoverflow org.apache.shiro.session.SessionListener.onStop() - [SHIRO-389] - Fix OSGI Exports for shiro-ehcache - [SHIRO-390] - OSGi Import for JSP (javax.servlet.jsp) should be declared optional - [SHIRO-394] - PropertiesRealm reloading not working when loading from file - [SHIRO-399] - Memory leak for invalid sessions - [SHIRO-403] - Trunk will not build under JDK 1.7 due to webstart plugin - [SHIRO-413] - init() method is not called on class that implements org.apache.shiro.util.Initializable - [SHIRO-415] - isLoginAttempt method in BasicHttpAuthenticationFilter class fails if used in any locale other than English - [SHIRO-418] - Javadoc typo in JdbcRealm.SaltStyle - [SHIRO-423] - INI ReflectionBuilder should not wrap reference values - [SHIRO-429] - perms filter parsing is too sensitive to a trailing space - [SHIRO-431] - please use git ignore - [SHIRO-447] - Broken Javadoc links - - -########################################################### -# 1.2.1 -########################################################### - -Bug: - - [SHIRO-341] - ReflectionBuilder has invalid log message format - [SHIRO-342] - Running the example as described at http://shiro.apache.org/10-minute-tutorial.html fails - [SHIRO-344] - runAs feature doesn't work - [SHIRO-350] - Creating a subject should not create a session - [SHIRO-353] - DefaultSecurityManager has invalid SLF4J log instruction - [SHIRO-354] - Authentication cache - [SHIRO-358] - Source Tarball doesn't Build - [SHIRO-363] - PasswordMatcher should support character arrays - [SHIRO-368] - DomainPermission(string, string) constructor sets targets to the same value as actions - [SHIRO-375] - Basic authentication issue when using COLON character - [SHIRO-376] - shiro-cas feature should not depend on shiro-cas - [SHIRO-377] - PropertiesRealm unable to reload Properties - - -########################################################### -# 1.2.0 -########################################################### - -Backwards Incompatible Changes --------------------------------- -- The following org.apache.shiro.mgt.DefaultSecurityManager methods have been removed: - bindPrincipalsToSession(principals, context) - - This logic has been moved into a SubjectDAO concept to allow end-users to control - exactly how the Session may be used for subject state persistence. This allows a - single point of control rather than needing to configure Shiro in multiple places. - - If you overrode this method in Shiro 1.0 or 1.1, please look at the new - org.apache.shiro.mgt.DefaultSubjectDAO implementation, which performs compatible logic. - Documentation for this is covered here: - http://shiro.apache.org/session-management.html#SessionManagement-SessionsandSubjectState - -- The org.apache.shiro.web.session.mgt.ServletContainerSessionManager implementation - (enabled by default for all web applications) no longer subclasses - org.apache.shiro.session.mgt.AbstractSessionManager. AbstractSessionManager existed - originally to consolidate a 'globalSessionTimeout' configuration property for - subclasses. However, the ServletContainerSessionManager has been changed to always - reflect the session configuration from web.xml (per its namesake). Because web.xml - is the definitive source for session timeout configuration, the 'extends' clause - was removed to avoid configuration confusion: if someone attempted to configure - 'globalSessionTimeout' on a ServletContainerSessionManager instance, it would never - be honored. It was better to remove the extends clause to ensure that any - such configuration would fail fast when Shiro starts up to reflect the invalid config. - - -Potential Breaking Changes --------------------------------- -- The org.apache.shiro.web.filter.mgt.FilterChainManager class's - addFilter(String name, Filter filter) semantics have changed. It now no longer - attempts to initialize a filter by default before adding the filter to the chain. - If you ever called this method, you can call the - addFilter(name, filter, true) method to achieve the <= 1.1 behavior. - -- The org.apache.shiro.crypto.SecureRandomNumberGenerator previously defaulted to generating - 128 random _bytes_ each time the nextBytes() method was called. This is too large for most purposes, so the - default has been changed to 16 _bytes_ (which equals 128 bits - what was originally intended). If for some reason - you need more than 16 bytes (128 bits) of randomly generated bits, you will need to configure the - 'defaultNextByteSize' property to match your desired size (in bytes, NOT bits). - -- Shiro's Block Cipher Services (AesCipherService, BlowfishCipherService) have had the following changes: - - 1) The internal Cipher Mode and Streaming Cipher Mode have been changed from CFB to the new default of CBC. - CBC is more commonly used for block ciphers today (e.g. SSL). - If you were using an AES or Blowfish CipherService you will want to revert to the previous defaults in your config - to ensure you can still decrypt previously encrypted data. For example, in code: - - blockCipherService.setMode(OperationMode.CFB); - blockCipherService.setStreamingMode(OperationMode.CFB); - - or, in shiro.ini: - - blockCipherService.modeName = CFB - blockCipherService.streamingModeName = CFB - - 2) The internal Streaming Padding Scheme has been changed from NONE to PKCS5 as PKCS5 is more commonly used. - If you were using an AES or Blowfish CipherService for streaming operations, you will want to revert to the - previous padding scheme default to ensure you can still decrypt previously encrypted data. For example, in code: - - blockCipherService.setStreamingPaddingScheme(PaddingScheme.NONE); - - or, in shiro.ini: - - blockCipherService.streamingPaddingSchemeName = NoPadding - - Note the difference in code vs shiro.ini in this last example: 'NoPadding' is the correct text value, 'NONE' is - the correct Enum value. - -########################################################### -# 1.1.0 -########################################################### - -Backwards Incompatible Changes --------------------------------- -- The org.apache.shiro.web.util.RedirectView class's - appendQueryProperties(StringBuffer targetUrl, Map model, String encodingScheme) - method has been changed to accept a StringBuilder argument instead of a - StringBuffer per SHIRO-191. RedirectView is considered an internal - implementation support class and Shiro end-users should not be affected by this. +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +This is not an official release notes document. It exists for Shiro developers +to jot down their notes while working in the source code. These notes will be +combined with Jira’s auto-generated release notes during a release for the +total set. + +########################################################### +# 2.0.0 +########################################################### + +Improvement + + [SHIRO-290] Implement bcrypt and argon2 KDF algorithms + +Backwards Incompatible Changes +-------------------------------- + +* Changed default DefaultPasswordService.java algorithm to "Argon2id". +* PasswordService.encryptPassword(Object plaintext) will now throw a NullPointerException on null parameter. + It was never specified how this method would behave. +* Made salt non-nullable. +* Removed methods in PasswordMatcher. + + +########################################################### +# 1.7.1 +########################################################### + +Bug + + [SHIRO-797] - Shiro 1.7.0 is lower than using springboot version 2.0.7 dependency error + + +########################################################### +# 1.7.0 +########################################################### + +Bug + + [SHIRO-767] - org.apache.shiro.util.ClassUtil cannot load the array of Primitive DataType when use undertow as web container + [SHIRO-792] - ShiroWebFilterConfiguration seems to conflict with other FilterRegistrationBean + +New Feature + + [SHIRO-789] - Also add cookie SameSite option to Spring + +Improvement + + [SHIRO-740] - SslFilter with HTTP Strict Transport Security (HSTS) + [SHIRO-794] - Add system property to enable backslash path normalization + [SHIRO-795] - Disable session path rewriting by default + +Task + + [SHIRO-793] - deleteMe cookie should use the defined "sameSite" + + +########################################################### +# 1.6.0 +########################################################### + +Bug + + [SHIRO-610] - Incorrect filterchainResolver in 1.4.0-RC2 + [SHIRO-762] - SecurityUtils.securityManager should be volatile + [SHIRO-766] - ArrayIndexOutOfBoundsException in Base64#decode + +New Feature + + [SHIRO-788] - Add support for Global Filters + +Wish + + [SHIRO-780] - NOTICE files of shiro components don't match NOTICE in source code repository + + +########################################################### +# 1.5.3 +########################################################### + +Bug + + [SHIRO-530] - INI parser does not properly handled backslashes at end of values + [SHIRO-751] - SimplePrincipalMap and SimplePrincipalCollection throw different exceptions for the same problem + [SHIRO-753] - Regression in URI parsing in Shiro 1.5.2 + +Dependency upgrade + + [SHIRO-754] - Upgrade to Apache Commons Codec 1.14 + [SHIRO-755] - Upgrade to Hazelcast 3.12.6 + [SHIRO-756] - Upgrade to Spring 5.2.5.RELEASE and Spring boot 2.2.6.RELEASE + [SHIRO-757] - Upgrade to Htmlunit 2.39.0 + [SHIRO-758] - Upgrade to Jetty 9.4.27.v20200227 + [SHIRO-759] - Upgrade to Karaf 4.2.8 + + +########################################################### +# 1.5.2 +########################################################### + +Bug + + [SHIRO-747] - FirstSuccessfulStrategy doesn't properly short circuit + [SHIRO-749] - shiro-all jar is missing cache package + +Improvement + + [SHIRO-748] - Update Commons Configuration to 2.7 + + +########################################################### +# 1.5.1 +########################################################### + +Bug + + [SHIRO-736] - DefaultCipherInstance is an alias which is not available in every JVM or JCA Provider + [SHIRO-739] - Bean reflection property failed with Enum values + [SHIRO-741] - Matching of / (root) is broken + [SHIRO-742] - fix throw exception when request uri is / + +Dependency upgrade + + [SHIRO-738] - Upgrade to Spring 5.2.3.RELEASE and Spring boot 2.2.4.RELEASE + + +########################################################### +# 1.5.0 +########################################################### + +Notes: this release require a JRE 8 minimum. + +Bug + + [SHIRO-458] - Possible leaked timing information from DefaultPasswordService + [SHIRO-469] - Wrong description of JdbcRealm#setPermissionsQuery + [SHIRO-552] - JdbcRealm in SaltStyle.COLUMN assumes that password column is Base64 but salt column is utf8 bytes + [SHIRO-661] - Add check for the principal of subject whether is null + [SHIRO-682] - fix the potential threat when use "uri = uri + '/' " to bypassed shiro protect + [SHIRO-684] - INI parser keeps escape characters in keys and values + [SHIRO-685] - Potential NullPointerException if PermissionResolver return null/empty string + [SHIRO-687] - Additional Servlet Filters are not available to ShiroFilterFactorBean (unless using XML based beans) + +New Feature + + [SHIRO-694] - Adds BearerToken support + [SHIRO-722] - Add SameSite option to cookies + +Improvement + + [SHIRO-668] - Catch unexpected errors which can lead to oom + [SHIRO-669] - Included a boolean flag in FirstSuccessfulStrategy to break after first successful authentication + [SHIRO-670] - ByteSource Serializable + [SHIRO-681] - Upgrade to compiler Java 8 + [SHIRO-693] - Update plugins + [SHIRO-700] - Minor spring updates + [SHIRO-706] - Switch to Guice4 by default in the build + [SHIRO-709] - Fix Shiro Spring feature + [SHIRO-710] - Update Commons Lang3 + remove older Commons Lang + [SHIRO-711] - Deprecate JavaEnvironment + [SHIRO-712] - Add BasicIniEnvironment + [SHIRO-715] - Remove old JSTL jars + [SHIRO-720] - Update Commons BeanUtils + [SHIRO-724] - Update Jetty, Spring, Spring Boot, Htmlunit dependencies + [SHIRO-726] - Add dynamic import package + [SHIRO-728] - Update Spring Boot to 2.1.10 + [SHIRO-729] - Update Quartz + [SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService + [SHIRO-731] - Use OWasp Java Encoder to escape user supplied content to the logs + +Test + + [SHIRO-697] - Reduce shiro test logging level to INFO + +Task + + [SHIRO-690] - Validate JDK11 compatibility + [SHIRO-692] - Upgrade and enforce min build maven version to 3.5.0 + [SHIRO-698] - Improve build with maven profile + [SHIRO-734] - Remove Spring-client sample + [SHIRO-735] - Shiro does not support servlet-3.1 void method(@Suspended AsyncResponse) + +Dependency upgrade + + [SHIRO-688] - Upgrade to commons-cli 1.4 + [SHIRO-689] - Upgrade to commons-codec 1.12 + [SHIRO-691] - Upgrade to maven-jar-plugin 3.1.1 + [SHIRO-695] - Update Hazelcast + [SHIRO-696] - Update Jetty + [SHIRO-699] - Fix maven warning for exec-maven-plugin and upgrade to 1.6.0 + [SHIRO-701] - Update logback + [SHIRO-702] - Upgrade to jacoco-maven-plugin 0.8.4 + [SHIRO-703] - Update HSQL + [SHIRO-704] - Update Spring, Spring Boot, Hibernate + [SHIRO-705] - Update Easymock + Powermock + [SHIRO-707] - Misc dependency updates + [SHIRO-716] - Upgrade to commons-codec 1.13 + [SHIRO-717] - Upgrade to maven-pmd-plugin 3.12.0 + [SHIRO-718] - Upgrade to xmlsec 2.1.4 + [SHIRO-719] - Upgrade to Karaf 4.2.6 + +Request + + [SHIRO-723] - Provide Minor Shiro Release that includes CVE-2019-10086 Fix + + +########################################################### +# 1.4.2 +########################################################### + +Bug + + [SHIRO-721] - RememberMe Padding Oracle Vulnerability + +Improvement + + [SHIRO-730] - Updates the default Cipher mode to GCM in AesCipherService + + +########################################################### +# 1.4.1 +########################################################### + +Bug + + [SHIRO-457] - Login without static VM security manager cause exception in debug + [SHIRO-563] - shiro-aspectj karaf feature can't be installed + [SHIRO-624] - OSGI: commons configuration import should be optional + [SHIRO-626] - Bundle symbolic name conflict + [SHIRO-637] - Refresh cached session in HTTP request after user logs out + [SHIRO-650] - Shiro JAX-RS is not an OSGi bundle + [SHIRO-653] - Spring-boot registers shiro filter only on REQUEST dispatcher + [SHIRO-655] - shiro-core has an undesirable runtime OSGi dependency to spring-beans + [SHIRO-658] - Problems building shiro on openjdk-8 on current debian stable (9.6 "stretch") + [SHIRO-660] - Bug in FirstSuccessfulStrategy + [SHIRO-680] - Duplicate Bundle-SymbolicName for Different Shiro Modules + +New Feature + + [SHIRO-638] - Update osgi bundle manifest to support Spring 4.x + +Improvement + + [SHIRO-560] - Shiro-web feature can't be installed in karaf 4.0.4 + [SHIRO-652] - Upgrade Shiro Feature to Karaf 4.x + [SHIRO-664] - Upgrade to Apache pom parent 21 + [SHIRO-665] - Upgrade to maven-bundle-plugin 4.1.0 + [SHIRO-667] - Upgrade to Spring 4.3.22-RELEASE + [SHIRO-672] - Upgrade to jacoco-maven-plugin 0.8.3 + [SHIRO-673] - Upgrade to maven-compiler-plugin 3.8.0 + [SHIRO-674] - Upgrade to maven-dependency-plugin to 3.1.1 + [SHIRO-675] - Upgrade to maven-surefire-plugins 3.0.0-M3 + [SHIRO-676] - Upgrade to maven-jar-plugin 3.1.0 + [SHIRO-677] - Upgrade to versions-maven-plugin 2.7 + [SHIRO-683] - Upgrade to spring-boot 1.5.19.RELEASE + +Task + + [SHIRO-662] - Constant Name Change in AuthenticationRealm + [SHIRO-663] - Clean up pom parent relative path + +Dependency upgrade + + [SHIRO-659] - Upgrade to OWASP dependency-check-maven plugin 4.0.0 + + +########################################################### +# 1.4.0 +########################################################### + +Bug + + [SHIRO-559] - shiro-guice violates the JEE specification + [SHIRO-579] - Permission filter is validating last matched path + [SHIRO-603] - Endless recursion in ShiroSecurityContext.getUserPrincipal() + [SHIRO-605] - ShiroWebModule creates out of order filter chain. + [SHIRO-607] - AuthorizationAttributeSourceAdvisor ignores type-annotations + [SHIRO-608] - Use a ServiceLoader to discover WebEnvironments + [SHIRO-611] - Spring web module does not load correct SessionStorageEvaluator + +Improvement + + [SHIRO-596] - shiro-tools-hasher needs private salt option + [SHIRO-618] - Spring Boot Web Starter- Autoconfiguration for Realm and ShiroFilterChainDefinition + + +########################################################### +# 1.4.0-RC2 +########################################################### + +Bug + + [SHIRO-493] - shiro-guice not working with the guice 4.x + [SHIRO-576] - Commons-beanutils dependency is not security compliant + [SHIRO-586] - Can't Search For Groups In Active Directory Without A System User + [SHIRO-587] - Can't Access Groups If userPrincipalName Doesn't Exist + [SHIRO-591] - Basic Auth Filter permissive mode does NOT work + [SHIRO-592] - ModularRealmAuthenticator causes log spam when one realm throws exception + [SHIRO-593] - Allow for IniWebEnvironment subclasses to specify defaults objects to ReflectionBuilder + [SHIRO-594] - Update Hazelcast version to latest supported version (3.7.2) + [SHIRO-595] - Allow for POST only logout requests + [SHIRO-612] - Need to upgrade BeanUtils to avoid vulnerability + +New Feature + + [SHIRO-501] - Add ability to set system properties in shiro.ini + [SHIRO-589] - Add Servlet 3.x fragment + [SHIRO-590] - Add Spring Boot support / starters + +Improvement + + [SHIRO-296] - Typo fixes + [SHIRO-301] - Call permissionResolver directly in AuthorizingRealm + [SHIRO-392] - Shiro Extension for JAX-RS + [SHIRO-599] - Fix file encoding warnings during maven build and reporting + + +########################################################### +# 1.3.2 +########################################################### + +Bug + + [SHIRO-584] - URL Path matching issue with WebUtils.getPathWithinApplication + + +########################################################### +# 1.3.1 +########################################################### + +Bug + + [SHIRO-577] - Regression - Unable to set custom SessionValidationScheduler + [SHIRO-581] - Improve log message when remember me cipher has changed + + +########################################################### +# 1.3.0 +########################################################### + +Bug + + [SHIRO-373] - Complete CAS remember-me support + [SHIRO-397] - SingleArgumentMethodEventListenerTest fails + [SHIRO-421] - Unable to set long timeouts on HttpServletSession + [SHIRO-435] - SecurityManager is not a singleton in ShiroWebModule + [SHIRO-473] - DefaultAnnotationResolver.getAnnotation throws NullPointerException + [SHIRO-480] - setTarget method in DomainPermission does not set targets + [SHIRO-483] - passwordsMatch() returns false with right plain password-encrypted password in JVM with default locale tr_TR + [SHIRO-502] - OSGi import of com.google.inject in shiro-guice has incorrect version range + [SHIRO-513] - Misleading error message when using custom WebEnvironment + [SHIRO-515] - ExecutorServiceSessionValidationScheduler leaks resources due to improper synchronization + [SHIRO-547] - Use MessageDigest#isEqual() instead of Arrays#equals() for comparing digests + [SHIRO-568] - hash iterations is calculated wrongly in SimpleHash + [SHIRO-570] - SimpleCookie should check the path of the cookie + +New Feature + + [SHIRO-200] - Add ability to configure basic authentication for specific HTTP methods + [SHIRO-395] - Add an Event Bus for event publishing and low-coupling for custom components/plugins. + [SHIRO-412] - Hazelcast-based caching and session clustering + [SHIRO-436] - Add EnvironmentLoader finalizeEnvironment method + +Improvement + + [SHIRO-278] - Rename JndiLdapRealm to DefaultLdapRealm + [SHIRO-300] - WildcardPermission: change visibility of field 'parts' to protected + [SHIRO-361] - HttpServletResponse.encodeURL: only append JSESSIONID when necessary + [SHIRO-428] - AuthorizingRealm "no cache" logging should be at DEBUG level, not INFO, OR is should log only once + [SHIRO-437] - WildcardPermission: conformed toString + [SHIRO-514] - ExecutorServiceSessionValidationScheduler should create threads with a configurable name + [SHIRO-564] - WildcardPermission case-insensitive makes parts collections twice + [SHIRO-566] - CollectionUtils should use Collections wrappers of arrays if possible + +Task + + [SHIRO-208] - Correct JDK 1.5 / 1.6 incompatibilities + [SHIRO-320] - Add an example for using Guice integration. + [SHIRO-571] - Mark shiro-cas deprecated (replaced with buji-pac4j) + + +########################################################### +# 1.2.6 +########################################################### + +Bug + + [SHIRO-545] - JavaEnvironment version getter + [SHIRO-567] - shiro-root-1.2.5.pom uses invalid encoding, fails to parse with Gradle 2.14 + + +########################################################### +# 1.2.5 +########################################################### + +Bug + + [SHIRO-443] - SessionValidationScheduler created multiple times, enabling it is not thread safe + [SHIRO-462] - Authentication exceptions are swallowed + [SHIRO-467] - Authentication exception gets swallowed + [SHIRO-550] - Randomize default remember me cipher + +Improvement + + [SHIRO-504] - Java 8 support + [SHIRO-516] - Explicitly specify the version of aspectjtools to avoid build warning + [SHIRO-562] - WildcardPermission calls String.trim() twice in setParts() + + +########################################################### +# 1.2.4 +########################################################### + +Bug + + [SHIRO-517] - Caused by: java.lang.NoClassDefFoundError: Lcom/google/inject/internal/util/$ImmutableList; + [SHIRO-518] - Shiro-CAS: Security Problem in cas-client-core versions older than 3.3.2 + [SHIRO-556] - https://shiro.apache.org/realm.html appears to link to the javadoc under static/current/apidocs not static/latest + +Improvement + + [SHIRO-332] - Change access level of method 'isPermitted' in org.apache.shiro.realm.AuthorizingRealm (line 461) from private to protected + [SHIRO-496] - Update shiro.guice dependency + [SHIRO-498] - ThreadLocal should not be created when not necessary + + +########################################################### +# 1.2.2 +########################################################### + +Bug: + + [SHIRO-316] - Annotations in samples-aspectj Project Does not Work + [SHIRO-351] - Shiro Native Session implementation cannot extract JSESSIONID From URL if JSESSIONID is URL parameter (not HTTP parameter) + [SHIRO-379] - SimpleAccountRealm concurrency access to roles and users + [SHIRO-380] - runAs feature (still) doesn't work + [SHIRO-387] - EnvironmentLoader destroys wrong environment + [SHIRO-388] - Stackoverflow org.apache.shiro.session.SessionListener.onStop() + [SHIRO-389] - Fix OSGI Exports for shiro-ehcache + [SHIRO-390] - OSGi Import for JSP (javax.servlet.jsp) should be declared optional + [SHIRO-394] - PropertiesRealm reloading not working when loading from file + [SHIRO-399] - Memory leak for invalid sessions + [SHIRO-403] - Trunk will not build under JDK 1.7 due to webstart plugin + [SHIRO-413] - init() method is not called on class that implements org.apache.shiro.util.Initializable + [SHIRO-415] - isLoginAttempt method in BasicHttpAuthenticationFilter class fails if used in any locale other than English + [SHIRO-418] - Javadoc typo in JdbcRealm.SaltStyle + [SHIRO-423] - INI ReflectionBuilder should not wrap reference values + [SHIRO-429] - perms filter parsing is too sensitive to a trailing space + [SHIRO-431] - please use git ignore + [SHIRO-447] - Broken Javadoc links + + +########################################################### +# 1.2.1 +########################################################### + +Bug: + + [SHIRO-341] - ReflectionBuilder has invalid log message format + [SHIRO-342] - Running the example as described at http://shiro.apache.org/10-minute-tutorial.html fails + [SHIRO-344] - runAs feature doesn't work + [SHIRO-350] - Creating a subject should not create a session + [SHIRO-353] - DefaultSecurityManager has invalid SLF4J log instruction + [SHIRO-354] - Authentication cache + [SHIRO-358] - Source Tarball doesn't Build + [SHIRO-363] - PasswordMatcher should support character arrays + [SHIRO-368] - DomainPermission(string, string) constructor sets targets to the same value as actions + [SHIRO-375] - Basic authentication issue when using COLON character + [SHIRO-376] - shiro-cas feature should not depend on shiro-cas + [SHIRO-377] - PropertiesRealm unable to reload Properties + + +########################################################### +# 1.2.0 +########################################################### + +Backwards Incompatible Changes +-------------------------------- +- The following org.apache.shiro.mgt.DefaultSecurityManager methods have been removed: + bindPrincipalsToSession(principals, context) + + This logic has been moved into a SubjectDAO concept to allow end-users to control + exactly how the Session may be used for subject state persistence. This allows a + single point of control rather than needing to configure Shiro in multiple places. + + If you overrode this method in Shiro 1.0 or 1.1, please look at the new + org.apache.shiro.mgt.DefaultSubjectDAO implementation, which performs compatible logic. + Documentation for this is covered here: + http://shiro.apache.org/session-management.html#SessionManagement-SessionsandSubjectState + +- The org.apache.shiro.web.session.mgt.ServletContainerSessionManager implementation + (enabled by default for all web applications) no longer subclasses + org.apache.shiro.session.mgt.AbstractSessionManager. AbstractSessionManager existed + originally to consolidate a 'globalSessionTimeout' configuration property for + subclasses. However, the ServletContainerSessionManager has been changed to always + reflect the session configuration from web.xml (per its namesake). Because web.xml + is the definitive source for session timeout configuration, the 'extends' clause + was removed to avoid configuration confusion: if someone attempted to configure + 'globalSessionTimeout' on a ServletContainerSessionManager instance, it would never + be honored. It was better to remove the extends clause to ensure that any + such configuration would fail fast when Shiro starts up to reflect the invalid config. + + +Potential Breaking Changes +-------------------------------- +- The org.apache.shiro.web.filter.mgt.FilterChainManager class's + addFilter(String name, Filter filter) semantics have changed. It now no longer + attempts to initialize a filter by default before adding the filter to the chain. + If you ever called this method, you can call the + addFilter(name, filter, true) method to achieve the <= 1.1 behavior. + +- The org.apache.shiro.crypto.SecureRandomNumberGenerator previously defaulted to generating + 128 random _bytes_ each time the nextBytes() method was called. This is too large for most purposes, so the + default has been changed to 16 _bytes_ (which equals 128 bits - what was originally intended). If for some reason + you need more than 16 bytes (128 bits) of randomly generated bits, you will need to configure the + 'defaultNextByteSize' property to match your desired size (in bytes, NOT bits). + +- Shiro's Block Cipher Services (AesCipherService, BlowfishCipherService) have had the following changes: + + 1) The internal Cipher Mode and Streaming Cipher Mode have been changed from CFB to the new default of CBC. + CBC is more commonly used for block ciphers today (e.g. SSL). + If you were using an AES or Blowfish CipherService you will want to revert to the previous defaults in your config + to ensure you can still decrypt previously encrypted data. For example, in code: + + blockCipherService.setMode(OperationMode.CFB); + blockCipherService.setStreamingMode(OperationMode.CFB); + + or, in shiro.ini: + + blockCipherService.modeName = CFB + blockCipherService.streamingModeName = CFB + + 2) The internal Streaming Padding Scheme has been changed from NONE to PKCS5 as PKCS5 is more commonly used. + If you were using an AES or Blowfish CipherService for streaming operations, you will want to revert to the + previous padding scheme default to ensure you can still decrypt previously encrypted data. For example, in code: + + blockCipherService.setStreamingPaddingScheme(PaddingScheme.NONE); + + or, in shiro.ini: + + blockCipherService.streamingPaddingSchemeName = NoPadding + + Note the difference in code vs shiro.ini in this last example: 'NoPadding' is the correct text value, 'NONE' is + the correct Enum value. + +########################################################### +# 1.1.0 +########################################################### + +Backwards Incompatible Changes +-------------------------------- +- The org.apache.shiro.web.util.RedirectView class's + appendQueryProperties(StringBuffer targetUrl, Map model, String encodingScheme) + method has been changed to accept a StringBuilder argument instead of a + StringBuffer per SHIRO-191. RedirectView is considered an internal + implementation support class and Shiro end-users should not be affected by this. diff --git a/core/src/main/java/org/apache/shiro/authc/SimpleAccount.java b/core/src/main/java/org/apache/shiro/authc/SimpleAccount.java index 790668b6bf..d173ebd73b 100644 --- a/core/src/main/java/org/apache/shiro/authc/SimpleAccount.java +++ b/core/src/main/java/org/apache/shiro/authc/SimpleAccount.java @@ -96,9 +96,9 @@ public SimpleAccount(Object principal, Object credentials, String realmName) { * @see org.apache.shiro.authc.credential.HashedCredentialsMatcher HashedCredentialsMatcher * @since 1.1 */ - @SuppressWarnings("checkstyle:LineLength") public SimpleAccount(Object principal, Object hashedCredentials, ByteSource credentialsSalt, String realmName) { - this(principal instanceof PrincipalCollection ? (PrincipalCollection) principal : new SimplePrincipalCollection(principal, realmName), + this(principal instanceof PrincipalCollection ? (PrincipalCollection) principal + : new SimplePrincipalCollection(principal, realmName), hashedCredentials, credentialsSalt); } @@ -164,8 +164,8 @@ public SimpleAccount(PrincipalCollection principals, Object credentials, Set roleNames, Set permissions) { + public SimpleAccount(Object principal, Object credentials, String realmName, + Set roleNames, Set permissions) { this.authcInfo = new SimpleAuthenticationInfo(new SimplePrincipalCollection(principal, realmName), credentials); this.authzInfo = new SimpleAuthorizationInfo(roleNames); this.authzInfo.setObjectPermissions(permissions); @@ -182,8 +182,9 @@ public SimpleAccount(Object principal, Object credentials, String realmName, Set * @param roleNames the names of the roles assigned to this account. * @param permissions the permissions assigned to this account directly (not those assigned to any of the realms). */ - @SuppressWarnings("checkstyle:LineLength") - public SimpleAccount(Collection principals, Object credentials, String realmName, Set roleNames, Set permissions) { + + public SimpleAccount(Collection principals, Object credentials, String realmName, + Set roleNames, Set permissions) { this.authcInfo = new SimpleAuthenticationInfo(new SimplePrincipalCollection(principals, realmName), credentials); this.authzInfo = new SimpleAuthorizationInfo(roleNames); this.authzInfo.setObjectPermissions(permissions); diff --git a/core/src/main/java/org/apache/shiro/authc/credential/HashedCredentialsMatcher.java b/core/src/main/java/org/apache/shiro/authc/credential/HashedCredentialsMatcher.java index 0ba10d6464..87c663079c 100644 --- a/core/src/main/java/org/apache/shiro/authc/credential/HashedCredentialsMatcher.java +++ b/core/src/main/java/org/apache/shiro/authc/credential/HashedCredentialsMatcher.java @@ -212,7 +212,6 @@ public void setStoredCredentialsHexEncoded(boolean storedCredentialsHexEncoded) this.storedCredentialsHexEncoded = storedCredentialsHexEncoded; } - @SuppressWarnings("checkstyle:LineLength") /** * Returns {@code true} if a submitted {@code AuthenticationToken}'s credentials should be salted when hashing, * {@code false} if it should not be salted. @@ -225,7 +224,8 @@ public void setStoredCredentialsHexEncoded(boolean storedCredentialsHexEncoded) * {@code false} if it should not be salted. * @deprecated since Shiro 1.1. Hash salting is now expected to be based on if the {@link AuthenticationInfo} * returned from the {@code Realm} is a {@link SaltedAuthenticationInfo} instance and its - * {@link org.apache.shiro.authc.SaltedAuthenticationInfo#getCredentialsSalt() getCredentialsSalt()} method returns a non-null value. + * {@link org.apache.shiro.authc.SaltedAuthenticationInfo#getCredentialsSalt() getCredentialsSalt()} method + * returns a non-null value. * This method and the 1.0 behavior still exists for backwards compatibility if the {@code Realm} does not return * {@code SaltedAuthenticationInfo} instances, but it is highly recommended that {@code Realm} implementations * that support hashed credentials start returning {@link SaltedAuthenticationInfo SaltedAuthenticationInfo} @@ -244,14 +244,16 @@ public boolean isHashSalted() { /** * Sets whether to salt a submitted {@code AuthenticationToken}'s credentials when hashing. *

- * If enabled, the salt used will be obtained via the {@link #getSalt(org.apache.shiro.authc.AuthenticationToken) getCredentialsSalt} method. + * If enabled, the salt used will be obtained via the + * {@link #getSalt(org.apache.shiro.authc.AuthenticationToken) getCredentialsSalt} method. *

* The default value is {@code false}. * * @param hashSalted whether to salt a submitted {@code AuthenticationToken}'s credentials when hashing. * @deprecated since Shiro 1.1. Hash salting is now expected to be based on if the {@link AuthenticationInfo} * returned from the {@code Realm} is a {@link SaltedAuthenticationInfo} instance and its - * {@link org.apache.shiro.authc.SaltedAuthenticationInfo#getCredentialsSalt() getCredentialsSalt()} method returns a non-null value. + * {@link org.apache.shiro.authc.SaltedAuthenticationInfo#getCredentialsSalt() getCredentialsSalt()} + * method returns a non-null value. * This method and the 1.0 behavior still exists for backwards compatibility if the {@code Realm} does not return * {@code SaltedAuthenticationInfo} instances, but it is highly recommended that {@code Realm} implementations * that support hashed credentials start returning {@link SaltedAuthenticationInfo SaltedAuthenticationInfo} @@ -299,7 +301,6 @@ public void setHashIterations(int hashIterations) { } } - @SuppressWarnings("checkstyle:LineLength") /** * Returns a salt value used to hash the token's credentials. *

@@ -311,7 +312,8 @@ public void setHashIterations(int hashIterations) { * @return a salt value to use to hash the authentication token's credentials. * @deprecated since Shiro 1.1. Hash salting is now expected to be based on if the {@link AuthenticationInfo} * returned from the {@code Realm} is a {@link SaltedAuthenticationInfo} instance and its - * {@link org.apache.shiro.authc.SaltedAuthenticationInfo#getCredentialsSalt() getCredentialsSalt()} method returns a non-null value. + * {@link org.apache.shiro.authc.SaltedAuthenticationInfo#getCredentialsSalt() getCredentialsSalt()} method + * returns a non-null value. * This method and the 1.0 behavior still exists for backwards compatibility if the {@code Realm} does not return * {@code SaltedAuthenticationInfo} instances, but it is highly recommended that {@code Realm} implementations * that support hashed credentials start returning {@link SaltedAuthenticationInfo SaltedAuthenticationInfo} @@ -451,10 +453,10 @@ protected Hash hashProvidedCredentials(Object credentials, Object salt, int hash return new SimpleHash(hashAlgorithmName, credentials, requireNonNull(salt, "salt cannot be null."), hashIterations); } - @SuppressWarnings("checkstyle:LineLength") /** * Returns a new, uninitialized instance, without its byte array set. Used as a utility method in the - * {@link SimpleCredentialsMatcher#getCredentials(org.apache.shiro.authc.AuthenticationInfo) getCredentials(AuthenticationInfo)} implementation. + * {@link SimpleCredentialsMatcher#getCredentials(org.apache.shiro.authc.AuthenticationInfo) + * getCredentials(AuthenticationInfo)} implementation. * * @return a new, uninitialized instance, without its byte array set. */ diff --git a/core/src/main/java/org/apache/shiro/authc/pam/AbstractAuthenticationStrategy.java b/core/src/main/java/org/apache/shiro/authc/pam/AbstractAuthenticationStrategy.java index 28ebc64985..718578f954 100644 --- a/core/src/main/java/org/apache/shiro/authc/pam/AbstractAuthenticationStrategy.java +++ b/core/src/main/java/org/apache/shiro/authc/pam/AbstractAuthenticationStrategy.java @@ -36,20 +36,21 @@ */ public abstract class AbstractAuthenticationStrategy implements AuthenticationStrategy { - @SuppressWarnings("checkstyle:LineLength") /** - * Simply returns new {@link org.apache.shiro.authc.SimpleAuthenticationInfo SimpleAuthenticationInfo}();, which supports + * Simply returns new {@link org.apache.shiro.authc.SimpleAuthenticationInfo SimpleAuthenticationInfo}();, + * which supports * aggregating account data across realms. */ - public AuthenticationInfo beforeAllAttempts(Collection realms, AuthenticationToken token) throws AuthenticationException { + public AuthenticationInfo beforeAllAttempts(Collection realms, AuthenticationToken token) + throws AuthenticationException { return new SimpleAuthenticationInfo(); } - @SuppressWarnings("checkstyle:LineLength") /** * Simply returns the aggregate method argument, without modification. */ - public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException { + public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) + throws AuthenticationException { return aggregate; } @@ -95,11 +96,11 @@ protected AuthenticationInfo merge(AuthenticationInfo info, AuthenticationInfo a } } - @SuppressWarnings("checkstyle:LineLength") /** * Simply returns the aggregate argument without modification. Can be overridden for custom behavior. */ - public AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException { + public AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) + throws AuthenticationException { return aggregate; } } diff --git a/core/src/main/java/org/apache/shiro/authc/pam/AllSuccessfulStrategy.java b/core/src/main/java/org/apache/shiro/authc/pam/AllSuccessfulStrategy.java index 05b7fb9ba9..8d200a85dc 100644 --- a/core/src/main/java/org/apache/shiro/authc/pam/AllSuccessfulStrategy.java +++ b/core/src/main/java/org/apache/shiro/authc/pam/AllSuccessfulStrategy.java @@ -45,10 +45,10 @@ public class AllSuccessfulStrategy extends AbstractAuthenticationStrategy { */ private static final Logger LOGGER = LoggerFactory.getLogger(AllSuccessfulStrategy.class); - @SuppressWarnings("checkstyle:LineLength") /** * Because all realms in this strategy must complete successfully, this implementation ensures that the given - * Realm {@link org.apache.shiro.realm.Realm#supports(org.apache.shiro.authc.AuthenticationToken) supports} the given + * Realm {@link org.apache.shiro.realm.Realm#supports(org.apache.shiro.authc.AuthenticationToken) supports} + * the given * token argument. If it does not, this method throws an * {@link UnsupportedTokenException UnsupportedTokenException} to end the authentication * process immediately. If the realm does support the token, the info argument is returned immediately. @@ -76,8 +76,8 @@ public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, * realm did in fact authenticate successfully * */ - @SuppressWarnings("checkstyle:LineLength") - public AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo info, AuthenticationInfo aggregate, Throwable t) + public AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, + AuthenticationInfo info, AuthenticationInfo aggregate, Throwable t) throws AuthenticationException { if (t != null) { if (t instanceof AuthenticationException) { diff --git a/core/src/main/java/org/apache/shiro/authc/pam/AtLeastOneSuccessfulStrategy.java b/core/src/main/java/org/apache/shiro/authc/pam/AtLeastOneSuccessfulStrategy.java index 1278ea7310..c1928d583c 100644 --- a/core/src/main/java/org/apache/shiro/authc/pam/AtLeastOneSuccessfulStrategy.java +++ b/core/src/main/java/org/apache/shiro/authc/pam/AtLeastOneSuccessfulStrategy.java @@ -51,8 +51,8 @@ private static boolean isEmpty(PrincipalCollection pc) { * is not null, and if either is null, throws an AuthenticationException to indicate * that none of the realms authenticated successfully. */ - @SuppressWarnings("checkstyle:LineLength") - public AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException { + public AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) + throws AuthenticationException { //we know if one or more were able to successfully authenticate if the aggregated account object does not //contain null or empty data: if (aggregate == null || isEmpty(aggregate.getPrincipals())) { diff --git a/core/src/main/java/org/apache/shiro/authc/pam/AuthenticationStrategy.java b/core/src/main/java/org/apache/shiro/authc/pam/AuthenticationStrategy.java index 622bfb8f64..0231b6212b 100644 --- a/core/src/main/java/org/apache/shiro/authc/pam/AuthenticationStrategy.java +++ b/core/src/main/java/org/apache/shiro/authc/pam/AuthenticationStrategy.java @@ -56,10 +56,9 @@ public interface AuthenticationStrategy { * @return an empty AuthenticationInfo object that will populated with data from multiple realms. * @throws AuthenticationException if the strategy implementation does not wish the Authentication attempt to execute. */ - @SuppressWarnings("checkstyle:LineLength") - AuthenticationInfo beforeAllAttempts(Collection realms, AuthenticationToken token) throws AuthenticationException; + AuthenticationInfo beforeAllAttempts(Collection realms, AuthenticationToken token) + throws AuthenticationException; - @SuppressWarnings("checkstyle:LineLength") /** * Method invoked by the ModularAuthenticator just prior to the realm being consulted for account data, * allowing pre-authentication-attempt logic for that realm only. @@ -73,12 +72,13 @@ public interface AuthenticationStrategy { * @param aggregate the aggregated AuthenticationInfo object being used across the multi-realm authentication attempt * @return the AuthenticationInfo object that will be presented to further realms in the authentication process - returning * the {@code aggregate} method argument is the normal case if no special action needs to be taken. - * @throws org.apache.shiro.authc.AuthenticationException an exception thrown by the Strategy implementation if it wishes the login - * process for the associated subject (user) to stop immediately. + * @throws org.apache.shiro.authc.AuthenticationException + * an exception thrown by the Strategy implementation if it wishes the login process + * for the associated subject (user) to stop immediately. */ - AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException; + AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) + throws AuthenticationException; - @SuppressWarnings("checkstyle:LineLength") /** * Method invoked by the ModularAuthenticator just after the given realm has been consulted for authentication, * allowing post-authentication-attempt logic for that realm only. @@ -91,7 +91,8 @@ public interface AuthenticationStrategy { * @param token the {@code AuthenticationToken} submitted for the subject attempting system log-in. * @param singleRealmInfo the info returned from a single realm. * @param aggregateInfo the aggregate info representing all realms in a multi-realm environment. - * @param t the Throwable thrown by the Realm during the attempt, or {@code null} if the method returned normally. + * @param t the Throwable thrown by the Realm during the attempt, + * or {@code null} if the method returned normally. * @return the AuthenticationInfo object that will be presented to further realms in the authentication process - returning * the {@code aggregateAccount} method argument is the normal case if no special action needs to be taken. * @throws AuthenticationException an exception thrown by the Strategy implementation if it wishes the login process @@ -102,13 +103,13 @@ AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregateInfo, Throwable t) throws AuthenticationException; - @SuppressWarnings("checkstyle:LineLength") /** * Method invoked by the ModularAuthenticator signifying that all of its configured Realms have been consulted * for account data, allowing post-processing after all realms have completed. * *

Returns the final AuthenticationInfo object that will be returned from the Authenticator to the authenticate() caller. - * This is most likely the aggregate AuthenticationInfo object that has been populated by many realms, but the actual return value is + * This is most likely the aggregate AuthenticationInfo object that has been populated by many realms, + * but the actual return value is * always up to the implementation. * * @param token the {@code AuthenticationToken} submitted for the subject attempting system log-in. diff --git a/core/src/main/java/org/apache/shiro/authc/pam/FirstSuccessfulStrategy.java b/core/src/main/java/org/apache/shiro/authc/pam/FirstSuccessfulStrategy.java index 98907aa9ba..2845edf30d 100644 --- a/core/src/main/java/org/apache/shiro/authc/pam/FirstSuccessfulStrategy.java +++ b/core/src/main/java/org/apache/shiro/authc/pam/FirstSuccessfulStrategy.java @@ -51,20 +51,19 @@ public boolean getStopAfterFirstSuccess() { * Returns {@code null} immediately, relying on this class's {@link #merge merge} implementation to return * only the first {@code info} object it encounters, ignoring all subsequent ones. */ - @SuppressWarnings("checkstyle:LineLength") - public AuthenticationInfo beforeAllAttempts(Collection realms, AuthenticationToken token) throws AuthenticationException { + public AuthenticationInfo beforeAllAttempts(Collection realms, AuthenticationToken token) + throws AuthenticationException { return null; } - - @SuppressWarnings("checkstyle:LineLength") /** * Throws ShortCircuitIterationException if stopAfterFirstSuccess is set and authentication is * successful with a previously consulted realm. * Returns the aggregate method argument, without modification * otherwise. */ - public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException { + public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) + throws AuthenticationException { if (getStopAfterFirstSuccess() && aggregate != null && !isEmpty(aggregate.getPrincipals())) { throw new ShortCircuitIterationException(); } diff --git a/core/src/main/java/org/apache/shiro/authz/Authorizer.java b/core/src/main/java/org/apache/shiro/authz/Authorizer.java index 7f77ba6769..9245dc3366 100644 --- a/core/src/main/java/org/apache/shiro/authz/Authorizer.java +++ b/core/src/main/java/org/apache/shiro/authz/Authorizer.java @@ -254,17 +254,16 @@ public interface Authorizer { */ void checkRoles(PrincipalCollection subjectPrincipal, Collection roleIdentifiers) throws AuthorizationException; - @SuppressWarnings("checkstyle:LineLength") /** * Same as {@link #checkRoles(org.apache.shiro.subject.PrincipalCollection, java.util.Collection) - * checkRoles(PrincipalCollection subjectPrincipal, Collection<String> roleIdentifiers)} but doesn't require a collection - * as an argument. - * Asserts the corresponding Subject/user has all of the specified roles by returning quietly if they do or + * checkRoles(PrincipalCollection subjectPrincipal, + * Collection<String> roleIdentifiers)} but doesn't require a collection as an argument. + * Asserts the corresponding Subject/user has all the specified roles by returning quietly if they do or * throwing an {@link AuthorizationException} if they do not. * * @param subjectPrincipal the application-specific subject/user identifier. * @param roleIdentifiers the application-specific role identifiers to check (usually role ids or role names). - * @throws AuthorizationException if the user does not have all of the specified roles. + * @throws AuthorizationException if the user does not have all the specified roles. * @since 1.1.0 */ void checkRoles(PrincipalCollection subjectPrincipal, String... roleIdentifiers) throws AuthorizationException; diff --git a/core/src/main/java/org/apache/shiro/authz/ModularRealmAuthorizer.java b/core/src/main/java/org/apache/shiro/authz/ModularRealmAuthorizer.java index 78f439108f..a038a230ba 100644 --- a/core/src/main/java/org/apache/shiro/authz/ModularRealmAuthorizer.java +++ b/core/src/main/java/org/apache/shiro/authz/ModularRealmAuthorizer.java @@ -102,7 +102,6 @@ public PermissionResolver getPermissionResolver() { return this.permissionResolver; } - @SuppressWarnings("checkstyle:LineLength") /** * Sets the specified {@link PermissionResolver PermissionResolver} on all of the wrapped realms that * implement the {@link org.apache.shiro.authz.permission.PermissionResolverAware PermissionResolverAware} interface. @@ -111,8 +110,9 @@ public PermissionResolver getPermissionResolver() { * PermissionResolver interface. If you do not want this to occur, the realms must * configure themselves individually (or be configured individually). * - * @param permissionResolver the permissionResolver to set on all of the wrapped realms that implement the - * {@link org.apache.shiro.authz.permission.PermissionResolverAware PermissionResolverAware} interface. + * @param permissionResolver the permissionResolver to set on all the wrapped realms that implement the + * {@link org.apache.shiro.authz.permission.PermissionResolverAware PermissionResolverAware} + * interface. */ public void setPermissionResolver(PermissionResolver permissionResolver) { this.permissionResolver = permissionResolver; @@ -156,7 +156,6 @@ public RolePermissionResolver getRolePermissionResolver() { return this.rolePermissionResolver; } - @SuppressWarnings("checkstyle:LineLength") /** * Sets the specified {@link RolePermissionResolver RolePermissionResolver} on all of the wrapped realms that * implement the {@link org.apache.shiro.authz.permission.RolePermissionResolverAware PermissionResolverAware} interface. @@ -165,8 +164,9 @@ public RolePermissionResolver getRolePermissionResolver() { * RolePermissionResolver interface. If you do not want this to occur, the realms must * configure themselves individually (or be configured individually). * - * @param rolePermissionResolver the rolePermissionResolver to set on all of the wrapped realms that implement the - * {@link org.apache.shiro.authz.permission.RolePermissionResolverAware RolePermissionResolverAware} interface. + * @param rolePermissionResolver the rolePermissionResolver to set on all the wrapped realms that implement the + * {@link org.apache.shiro.authz.permission.RolePermissionResolverAware RolePermissionResolverAware} + * interface. */ public void setRolePermissionResolver(RolePermissionResolver rolePermissionResolver) { this.rolePermissionResolver = rolePermissionResolver; @@ -180,7 +180,8 @@ public void setRolePermissionResolver(RolePermissionResolver rolePermissionResol * {@link org.apache.shiro.authz.permission.RolePermissionResolverAware RolePermissionResolverAware} interface. *

* This method is called after setting a rolePermissionResolver on this ModularRealmAuthorizer via the - * {@link #setRolePermissionResolver(org.apache.shiro.authz.permission.RolePermissionResolver) setRolePermissionResolver} method. + * {@link #setRolePermissionResolver(org.apache.shiro.authz.permission.RolePermissionResolver) setRolePermissionResolver} + * method. *

* It is also called after setting one or more realms via the {@link #setRealms setRealms} method to allow these * newly available realms to be given the RolePermissionResolver already in use. @@ -356,13 +357,13 @@ public void checkPermissions(PrincipalCollection principals, String... permissio } } - @SuppressWarnings("checkstyle:LineLength") /** * If !{@link #isPermitted(org.apache.shiro.subject.PrincipalCollection, Permission) isPermitted(permission)} for * all the given Permissions, throws * an UnauthorizedException otherwise returns quietly. */ - public void checkPermissions(PrincipalCollection principals, Collection permissions) throws AuthorizationException { + public void checkPermissions(PrincipalCollection principals, Collection permissions) + throws AuthorizationException { assertRealmsConfigured(); if (permissions != null) { for (Permission permission : permissions) { @@ -433,9 +434,9 @@ public void checkRole(PrincipalCollection principals, String role) throws Author } } - @SuppressWarnings("checkstyle:LineLength") /** - * Calls {@link #checkRoles(PrincipalCollection principals, String... roles) checkRoles(PrincipalCollection principals, String... roles) }. + * Calls {@link #checkRoles(PrincipalCollection principals, String... roles) + * checkRoles(PrincipalCollection principals, String... roles) }. */ public void checkRoles(PrincipalCollection principals, Collection roles) throws AuthorizationException { //SHIRO-234 - roles.toArray() -> roles.toArray(new String[roles.size()]) diff --git a/core/src/main/java/org/apache/shiro/authz/annotation/RequiresAuthentication.java b/core/src/main/java/org/apache/shiro/authz/annotation/RequiresAuthentication.java index 1f84ddb209..a7e33ee193 100644 --- a/core/src/main/java/org/apache/shiro/authz/annotation/RequiresAuthentication.java +++ b/core/src/main/java/org/apache/shiro/authz/annotation/RequiresAuthentication.java @@ -24,14 +24,14 @@ import java.lang.annotation.RetentionPolicy; import java.lang.annotation.Target; -@SuppressWarnings("checkstyle:LineLength") /** * Requires the current Subject to have been authenticated during their current session for the annotated * class/instance/method to be accessed or invoked. This is more restrictive than the * {@link RequiresUser RequiresUser} annotation. *

* This annotation basically ensures that - * {@link org.apache.shiro.subject.Subject subject}.{@link org.apache.shiro.subject.Subject#isAuthenticated() isAuthenticated()} === true + * {@link org.apache.shiro.subject.Subject subject}. + * {@link org.apache.shiro.subject.Subject#isAuthenticated() isAuthenticated()} === true *

* See the {@link RequiresUser RequiresUser} and * {@link org.apache.shiro.authc.RememberMeAuthenticationToken RememberMeAuthenticationToken} JavaDoc for an diff --git a/core/src/main/java/org/apache/shiro/authz/aop/AuthenticatedAnnotationHandler.java b/core/src/main/java/org/apache/shiro/authz/aop/AuthenticatedAnnotationHandler.java index 2d13b0d002..3abf06e0c9 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/AuthenticatedAnnotationHandler.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/AuthenticatedAnnotationHandler.java @@ -18,11 +18,11 @@ */ package org.apache.shiro.authz.aop; -import java.lang.annotation.Annotation; - import org.apache.shiro.authz.UnauthenticatedException; import org.apache.shiro.authz.annotation.RequiresAuthentication; +import java.lang.annotation.Annotation; + /** * Handles {@link RequiresAuthentication RequiresAuthentication} annotations and ensures the calling subject is @@ -40,10 +40,10 @@ public AuthenticatedAnnotationHandler() { super(RequiresAuthentication.class); } - @SuppressWarnings("checkstyle:LineLength") /** * Ensures that the calling Subject is authenticated, and if not, throws an - * {@link org.apache.shiro.authz.UnauthenticatedException UnauthenticatedException} indicating the method is not allowed to be executed. + * {@link org.apache.shiro.authz.UnauthenticatedException UnauthenticatedException} + * indicating the method is not allowed to be executed. * * @param a the annotation to inspect * @throws org.apache.shiro.authz.UnauthenticatedException if the calling Subject has not yet diff --git a/core/src/main/java/org/apache/shiro/authz/aop/AuthorizingAnnotationMethodInterceptor.java b/core/src/main/java/org/apache/shiro/authz/aop/AuthorizingAnnotationMethodInterceptor.java index 26d02dbad6..e49f4d02ba 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/AuthorizingAnnotationMethodInterceptor.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/AuthorizingAnnotationMethodInterceptor.java @@ -68,14 +68,14 @@ public Object invoke(MethodInvocation methodInvocation) throws Throwable { return methodInvocation.proceed(); } - @SuppressWarnings("checkstyle:LineLength") /** * Ensures the calling Subject is authorized to execute the specified MethodInvocation. *

* As this is an AnnotationMethodInterceptor, this implementation merely delegates to the internal * {@link AuthorizingAnnotationHandler AuthorizingAnnotationHandler} by first acquiring the annotation by * calling {@link #getAnnotation(MethodInvocation) getAnnotation(methodInvocation)} and then calls - * {@link AuthorizingAnnotationHandler#assertAuthorized(java.lang.annotation.Annotation) handler.assertAuthorized(annotation)}. + * {@link AuthorizingAnnotationHandler#assertAuthorized(java.lang.annotation.Annotation) + * handler.assertAuthorized(annotation)}. * * @param mi the MethodInvocation to check to see if it is allowed to proceed/execute. * @throws AuthorizationException if the method invocation is not allowed to continue/execute. diff --git a/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationHandler.java b/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationHandler.java index c74e86b67f..10e567741f 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationHandler.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationHandler.java @@ -18,19 +18,19 @@ */ package org.apache.shiro.authz.aop; -import java.lang.annotation.Annotation; - import org.apache.shiro.authz.AuthorizationException; import org.apache.shiro.authz.UnauthenticatedException; import org.apache.shiro.authz.annotation.RequiresGuest; -@SuppressWarnings("checkstyle:LineLength") +import java.lang.annotation.Annotation; + /** * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresGuest RequiresGuest} annotation * is declared, and if so, ensures the calling Subject does not * have an {@link org.apache.shiro.subject.Subject#getPrincipal() identity} before invoking the method. *

- * This annotation essentially ensures that subject.{@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} == null. + * This annotation essentially ensures that subject. + * {@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} == null. * * @since 0.9.0 */ diff --git a/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationMethodInterceptor.java b/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationMethodInterceptor.java index a89409bbf0..7acaa5454e 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationMethodInterceptor.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/GuestAnnotationMethodInterceptor.java @@ -20,13 +20,13 @@ import org.apache.shiro.aop.AnnotationResolver; -@SuppressWarnings("checkstyle:LineLength") /** * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresGuest RequiresGuest} annotation * is declared, and if so, ensures the calling Subject does not * have an {@link org.apache.shiro.subject.Subject#getPrincipal() identity} before invoking the method. *

- * This annotation essentially ensures that subject.{@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} == null. + * This annotation essentially ensures that subject. + * {@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} == null. * * @since 0.9.0 */ diff --git a/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationHandler.java b/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationHandler.java index d943a28c77..d8cfb9031e 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationHandler.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationHandler.java @@ -53,14 +53,13 @@ protected String[] getAnnotationValue(Annotation a) { return rpAnnotation.value(); } - @SuppressWarnings("checkstyle:LineLength") /** * Ensures that the calling Subject has the Annotation's specified permissions, and if not, throws an * AuthorizingException indicating access is denied. * * @param a the RequiresPermission annotation being inspected to check for one or more permissions - * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject does not have the permission(s) necessary to - * continue access or execution. + * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject does not have + * the permission(s) necessary to continue access or execution. */ public void assertAuthorized(Annotation a) throws AuthorizationException { if (!(a instanceof RequiresPermissions)) { diff --git a/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationMethodInterceptor.java b/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationMethodInterceptor.java index 1a20e486cc..244fc673d3 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationMethodInterceptor.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/PermissionAnnotationMethodInterceptor.java @@ -20,10 +20,9 @@ import org.apache.shiro.aop.AnnotationResolver; -@SuppressWarnings("checkstyle:LineLength") /** - * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresPermissions RequiresPermissions} annotation is declared, and if so, performs - * a permission check to see if the calling Subject is allowed to call the method. + * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresPermissions RequiresPermissions} annotation is declared, + * and if so, performs a permission check to see if the calling Subject is allowed to call the method. * * @since 0.9 */ diff --git a/core/src/main/java/org/apache/shiro/authz/aop/RoleAnnotationHandler.java b/core/src/main/java/org/apache/shiro/authz/aop/RoleAnnotationHandler.java index d827ce807d..0cc8de0614 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/RoleAnnotationHandler.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/RoleAnnotationHandler.java @@ -25,10 +25,9 @@ import java.lang.annotation.Annotation; import java.util.Arrays; -@SuppressWarnings("checkstyle:LineLength") /** - * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresRoles RequiresRoles} annotation is declared, and if so, performs - * a role check to see if the calling Subject is allowed to proceed. + * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresRoles RequiresRoles} annotation is declared, + * and if so, performs a role check to see if the calling Subject is allowed to proceed. * * @since 0.9.0 */ @@ -42,14 +41,13 @@ public RoleAnnotationHandler() { super(RequiresRoles.class); } - @SuppressWarnings("checkstyle:LineLength") /** * Ensures that the calling Subject has the Annotation's specified roles, and if not, throws an * AuthorizingException indicating that access is denied. * * @param a the RequiresRoles annotation to use to check for one or more roles - * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject does not have the role(s) necessary to - * proceed. + * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject does not have the role(s) + * necessary to proceed. */ public void assertAuthorized(Annotation a) throws AuthorizationException { if (!(a instanceof RequiresRoles)) { diff --git a/core/src/main/java/org/apache/shiro/authz/aop/RolesAllowedAnnotationHandler.java b/core/src/main/java/org/apache/shiro/authz/aop/RolesAllowedAnnotationHandler.java index 745d90e173..8ab9327760 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/RolesAllowedAnnotationHandler.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/RolesAllowedAnnotationHandler.java @@ -39,14 +39,13 @@ public RolesAllowedAnnotationHandler() { super(RolesAllowed.class); } - @SuppressWarnings("checkstyle:LineLength") /** * Ensures that the calling Subject has one of the Annotation's specified roles, and if not, throws an * AuthorizingException indicating that access is denied. * * @param a the RolesAllowed annotation to use to check for one or more roles - * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject does not have the role necessary to - * proceed. + * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject does not have the role + * necessary to proceed. */ @Override public void assertAuthorized(Annotation a) throws AuthorizationException { diff --git a/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationHandler.java b/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationHandler.java index a3ebe94fb9..77bd16a7f4 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationHandler.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationHandler.java @@ -18,20 +18,20 @@ */ package org.apache.shiro.authz.aop; -import java.lang.annotation.Annotation; - import org.apache.shiro.authz.AuthorizationException; import org.apache.shiro.authz.UnauthenticatedException; import org.apache.shiro.authz.annotation.RequiresUser; -@SuppressWarnings("checkstyle:LineLength") +import java.lang.annotation.Annotation; + /** * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresUser RequiresUser} annotation * is declared, and if so, ensures the calling Subject is either * {@link org.apache.shiro.subject.Subject#isAuthenticated() authenticated} or remembered via remember * me services before allowing access. *

- * This annotation essentially ensures that subject.{@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} != null. + * This annotation essentially ensures that subject. + * {@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} != null. * * @since 0.9.0 */ @@ -46,7 +46,6 @@ public UserAnnotationHandler() { super(RequiresUser.class); } - @SuppressWarnings("checkstyle:LineLength") /** * Ensures that the calling Subject is a user, that is, they are either * {@link org.apache.shiro.subject.Subject#isAuthenticated() authenticated} or remembered via remember @@ -54,7 +53,8 @@ public UserAnnotationHandler() { * AuthorizingException indicating access is not allowed. * * @param a the RequiresUser annotation to check - * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject is not authenticated or remembered via rememberMe services. + * @throws org.apache.shiro.authz.AuthorizationException if the calling Subject is not authenticated + * or remembered via rememberMe services. */ public void assertAuthorized(Annotation a) throws AuthorizationException { if (a instanceof RequiresUser && getSubject().getPrincipal() == null) { diff --git a/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationMethodInterceptor.java b/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationMethodInterceptor.java index 3c5532b28f..5c569fc8c5 100644 --- a/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationMethodInterceptor.java +++ b/core/src/main/java/org/apache/shiro/authz/aop/UserAnnotationMethodInterceptor.java @@ -20,14 +20,14 @@ import org.apache.shiro.aop.AnnotationResolver; -@SuppressWarnings("checkstyle:LineLength") /** * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresUser RequiresUser} annotation * is declared, and if so, ensures the calling Subject is either * {@link org.apache.shiro.subject.Subject#isAuthenticated() authenticated} or remembered via remember * me services before invoking the method. *

- * This annotation essentially ensures that subject.{@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} != null. + * This annotation essentially ensures that subject. + * {@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} != null. * * @since 0.9.0 */ diff --git a/core/src/main/java/org/apache/shiro/authz/permission/PermissionResolver.java b/core/src/main/java/org/apache/shiro/authz/permission/PermissionResolver.java index 7fa1df20ad..9da96a4306 100644 --- a/core/src/main/java/org/apache/shiro/authz/permission/PermissionResolver.java +++ b/core/src/main/java/org/apache/shiro/authz/permission/PermissionResolver.java @@ -20,7 +20,6 @@ import org.apache.shiro.authz.Permission; -@SuppressWarnings("checkstyle:LineLength") /** * A {@code PermissionResolver} resolves a String value and converts it into a * {@link org.apache.shiro.authz.Permission Permission} instance. @@ -43,9 +42,11 @@ * Although this happens to be the Shiro default, you are of course free to provide custom * String-to-Permission conversion by providing Shiro components any instance of this interface. * - * @see org.apache.shiro.authz.ModularRealmAuthorizer#setPermissionResolver(PermissionResolver) ModularRealmAuthorizer.setPermissionResolver - * @see org.apache.shiro.realm.AuthorizingRealm#setPermissionResolver(PermissionResolver) AuthorizingRealm.setPermissionResolver - * @see PermissionResolverAware PermissionResolverAware + * @see org.apache.shiro.authz.ModularRealmAuthorizer#setPermissionResolver(PermissionResolver) + * ModularRealmAuthorizer.setPermissionResolver + * @see org.apache.shiro.realm.AuthorizingRealm#setPermissionResolver(PermissionResolver) + * AuthorizingRealm.setPermissionResolver + * @see PermissionResolverAware PermissionResolverAware * @since 0.9 */ public interface PermissionResolver { diff --git a/core/src/main/java/org/apache/shiro/authz/permission/WildcardPermission.java b/core/src/main/java/org/apache/shiro/authz/permission/WildcardPermission.java index f4c91e35be..dd8f1c5011 100644 --- a/core/src/main/java/org/apache/shiro/authz/permission/WildcardPermission.java +++ b/core/src/main/java/org/apache/shiro/authz/permission/WildcardPermission.java @@ -105,8 +105,6 @@ */ public class WildcardPermission implements Permission, Serializable { - //TODO - JavaDoc methods - /*-------------------------------------------- | C O N S T A N T S | ============================================*/ @@ -148,12 +146,12 @@ protected void setParts(String wildcardString) { setParts(wildcardString, DEFAULT_CASE_SENSITIVE); } - @SuppressWarnings("checkstyle:LineLength") protected void setParts(String wildcardString, boolean caseSensitive) { wildcardString = StringUtils.clean(wildcardString); if (wildcardString == null || wildcardString.isEmpty()) { - throw new IllegalArgumentException("Wildcard string cannot be null or empty. Make sure permission strings are properly formatted."); + throw new IllegalArgumentException("Wildcard string cannot be null or empty." + + "Make sure permission strings are properly formatted."); } if (!caseSensitive) { @@ -167,14 +165,15 @@ protected void setParts(String wildcardString, boolean caseSensitive) { Set subparts = CollectionUtils.asSet(part.split(SUBPART_DIVIDER_TOKEN)); if (subparts.isEmpty()) { - throw new IllegalArgumentException( - "Wildcard string cannot contain parts with only dividers. Make sure permission strings are properly formatted."); + throw new IllegalArgumentException("Wildcard string cannot contain parts with only dividers." + + "Make sure permission strings are properly formatted."); } this.parts.add(subparts); } if (this.parts.isEmpty()) { - throw new IllegalArgumentException("Wildcard string cannot contain only dividers. Make sure permission strings are properly formatted."); + throw new IllegalArgumentException("Wildcard string cannot contain only dividers." + + "Make sure permission strings are properly formatted."); } } diff --git a/core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java b/core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java index 0dcf38c69b..f5896e033a 100644 --- a/core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java +++ b/core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java @@ -18,15 +18,12 @@ */ package org.apache.shiro.mgt; -import java.util.Objects; -import java.util.function.Supplier; - import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.RememberMeAuthenticationToken; -import org.apache.shiro.crypto.cipher.ByteSourceBroker; import org.apache.shiro.crypto.cipher.AesCipherService; +import org.apache.shiro.crypto.cipher.ByteSourceBroker; import org.apache.shiro.crypto.cipher.CipherService; import org.apache.shiro.lang.io.DefaultSerializer; import org.apache.shiro.lang.io.Serializer; @@ -38,6 +35,9 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import java.util.Objects; +import java.util.function.Supplier; + /** * Abstract implementation of the {@code RememberMeManager} interface that handles * {@link #setSerializer(Serializer) serialization} and @@ -455,14 +455,14 @@ protected PrincipalCollection convertBytesToPrincipals(byte[] bytes, SubjectCont * is being used to construct a {@link Subject} instance. * @return nothing - the original {@code RuntimeException} is propagated in all cases. */ - @SuppressWarnings("checkstyle:LineLength") protected PrincipalCollection onRememberedPrincipalFailure(RuntimeException e, SubjectContext context) { if (LOGGER.isWarnEnabled()) { String message = "There was a failure while trying to retrieve remembered principals. This could be due to a " + "configuration problem or corrupted principals. This could also be due to a recently " + "changed encryption key, if you are using a shiro.ini file, this property would be " - + "'securityManager.rememberMeManager.cipherKey' see: http://shiro.apache.org/web.html#Web-RememberMeServices. " + + "'securityManager.rememberMeManager.cipherKey'" + + "see: http://shiro.apache.org/web.html#Web-RememberMeServices. " + "The remembered identity will be forgotten and not used for this request."; LOGGER.warn(message); } diff --git a/core/src/main/java/org/apache/shiro/mgt/AuthorizingSecurityManager.java b/core/src/main/java/org/apache/shiro/mgt/AuthorizingSecurityManager.java index daf2d27664..0cbea9dc02 100644 --- a/core/src/main/java/org/apache/shiro/mgt/AuthorizingSecurityManager.java +++ b/core/src/main/java/org/apache/shiro/mgt/AuthorizingSecurityManager.java @@ -145,8 +145,8 @@ public void checkPermissions(PrincipalCollection principals, String... permissio this.authorizer.checkPermissions(principals, permissions); } - @SuppressWarnings("checkstyle:LineLength") - public void checkPermissions(PrincipalCollection principals, Collection permissions) throws AuthorizationException { + public void checkPermissions(PrincipalCollection principals, Collection permissions) + throws AuthorizationException { this.authorizer.checkPermissions(principals, permissions); } diff --git a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java index fb2962ebf1..9912f6ab14 100644 --- a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java +++ b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java @@ -119,11 +119,11 @@ public SubjectFactory getSubjectFactory() { return subjectFactory; } - @SuppressWarnings("checkstyle:LineLength") /** * Sets the {@code SubjectFactory} responsible for creating {@link Subject} instances exposed to the application. * - * @param subjectFactory the {@code SubjectFactory} responsible for creating {@link Subject} instances exposed to the application. + * @param subjectFactory the {@code SubjectFactory} responsible for creating + * {@link Subject} instances exposed to the application. */ public void setSubjectFactory(SubjectFactory subjectFactory) { this.subjectFactory = subjectFactory; diff --git a/core/src/main/java/org/apache/shiro/mgt/RealmSecurityManager.java b/core/src/main/java/org/apache/shiro/mgt/RealmSecurityManager.java index 891bb1554d..748ddd169a 100644 --- a/core/src/main/java/org/apache/shiro/mgt/RealmSecurityManager.java +++ b/core/src/main/java/org/apache/shiro/mgt/RealmSecurityManager.java @@ -147,11 +147,10 @@ protected void applyEventBusToRealms() { } } - @SuppressWarnings("checkstyle:LineLength") /** * Simply calls {@link #applyCacheManagerToRealms() applyCacheManagerToRealms()} to allow the - * newly set {@link org.apache.shiro.cache.CacheManager CacheManager} to be propagated to the internal collection of Realm - * that would need to use it. + * newly set {@link org.apache.shiro.cache.CacheManager CacheManager} to be propagated to the + * internal collection of Realm that would need to use it. */ protected void afterCacheManagerSet() { super.afterCacheManagerSet(); diff --git a/core/src/main/java/org/apache/shiro/mgt/SessionsSecurityManager.java b/core/src/main/java/org/apache/shiro/mgt/SessionsSecurityManager.java index 3f9dfd3f73..e2180888e8 100644 --- a/core/src/main/java/org/apache/shiro/mgt/SessionsSecurityManager.java +++ b/core/src/main/java/org/apache/shiro/mgt/SessionsSecurityManager.java @@ -97,11 +97,10 @@ public SessionManager getSessionManager() { return this.sessionManager; } - @SuppressWarnings("checkstyle:LineLength") /** - * Calls {@link org.apache.shiro.mgt.AuthorizingSecurityManager#afterCacheManagerSet() super.afterCacheManagerSet()} and then immediately calls - * {@link #applyCacheManagerToSessionManager() applyCacheManagerToSessionManager()} to ensure the - * CacheManager is applied to the SessionManager as necessary. + * Calls {@link org.apache.shiro.mgt.AuthorizingSecurityManager#afterCacheManagerSet() super.afterCacheManagerSet()} + * and then immediately calls {@link #applyCacheManagerToSessionManager() applyCacheManagerToSessionManager()} + * to ensure the CacheManager is applied to the SessionManager as necessary. */ @Override protected void afterCacheManagerSet() { diff --git a/core/src/main/java/org/apache/shiro/realm/AuthenticatingRealm.java b/core/src/main/java/org/apache/shiro/realm/AuthenticatingRealm.java index be0395352a..58ea1e9652 100644 --- a/core/src/main/java/org/apache/shiro/realm/AuthenticatingRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/AuthenticatingRealm.java @@ -494,10 +494,9 @@ private AuthenticationInfo getCachedAuthenticationInfo(AuthenticationToken token return info; } - @SuppressWarnings("checkstyle:LineLength") /** * Caches the specified info if authentication caching - * {@link #isAuthenticationCachingEnabled(org.apache.shiro.authc.AuthenticationToken, org.apache.shiro.authc.AuthenticationInfo) isEnabled} + * {@link #isAuthenticationCachingEnabled(AuthenticationToken, AuthenticationInfo) isEnabled} * for the specific token/info pair and a cache instance is available to be used. * * @param token the authentication token submitted which resulted in a successful authentication attempt. @@ -538,7 +537,6 @@ protected boolean isAuthenticationCachingEnabled(AuthenticationToken token, Auth return isAuthenticationCachingEnabled(); } - @SuppressWarnings("checkstyle:LineLength") /** * This implementation functions as follows: *

    @@ -548,7 +546,7 @@ protected boolean isAuthenticationCachingEnabled(AuthenticationToken token, Auth *
  1. If there is no cached {@link AuthenticationInfo} found, delegate to the * {@link #doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)} method to perform the actual * lookup. If authentication caching is enabled and possible, any returned info object will be - * {@link #cacheAuthenticationInfoIfPossible(org.apache.shiro.authc.AuthenticationToken, org.apache.shiro.authc.AuthenticationInfo) cached} + * {@link #cacheAuthenticationInfoIfPossible(AuthenticationToken, AuthenticationInfo) cached} * to be used in future authentication attempts.
    2. *
  2. If an AuthenticationInfo instance is not found in the cache or by lookup, {@code null} is returned to * indicate an account cannot be found.
    3. diff --git a/core/src/main/java/org/apache/shiro/realm/AuthorizingRealm.java b/core/src/main/java/org/apache/shiro/realm/AuthorizingRealm.java index fd9f94555b..aa702c2eb3 100644 --- a/core/src/main/java/org/apache/shiro/realm/AuthorizingRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/AuthorizingRealm.java @@ -59,7 +59,7 @@ *

    * If you find that you do not want to utilize the {@link AuthorizationInfo AuthorizationInfo} construct, * you are of course free to subclass the {@link AuthenticatingRealm AuthenticatingRealm} directly instead and - * implement the remaining Realm interface methods directly. You might do this if you want have better control + * implement the remaining Realm interface methods directly. You might do this if you want to have better control * over how the Role and Permission checks occur for your specific data source. However, using AuthorizationInfo * (and its default implementation {@link org.apache.shiro.authz.SimpleAuthorizationInfo SimpleAuthorizationInfo}) * is sufficient in the large @@ -68,7 +68,7 @@ * @see org.apache.shiro.authz.SimpleAuthorizationInfo * @since 0.2 */ -@SuppressWarnings({"checkstyle:MethodCount", "checkstyle:LineLength"}) +@SuppressWarnings({"checkstyle:MethodCount"}) public abstract class AuthorizingRealm extends AuthenticatingRealm implements Authorizer, Initializable, PermissionResolverAware, RolePermissionResolverAware { @@ -579,7 +579,8 @@ public void checkPermissions(PrincipalCollection subjectIdentifier, String... pe } } - public void checkPermissions(PrincipalCollection principal, Collection permissions) throws AuthorizationException { + public void checkPermissions(PrincipalCollection principal, + Collection permissions) throws AuthorizationException { AuthorizationInfo info = getAuthorizationInfo(principal); checkPermissions(permissions, info); } diff --git a/core/src/main/java/org/apache/shiro/realm/Realm.java b/core/src/main/java/org/apache/shiro/realm/Realm.java index 52c348275c..0a1430f467 100644 --- a/core/src/main/java/org/apache/shiro/realm/Realm.java +++ b/core/src/main/java/org/apache/shiro/realm/Realm.java @@ -85,7 +85,6 @@ public interface Realm { */ boolean supports(AuthenticationToken token); - @SuppressWarnings("checkstyle:LineLength") /** * Returns an account's authentication-specific information for the specified token, * or null if no account could be found based on the token. @@ -98,8 +97,9 @@ public interface Realm { * @param token the application-specific representation of an account principal and credentials. * @return the authentication information for the account associated with the specified token, * or null if no account could be found. - * @throws org.apache.shiro.authc.AuthenticationException if there is an error obtaining or constructing an AuthenticationInfo object based on the - * specified token or implementation-specific login behavior fails. + * @throws org.apache.shiro.authc.AuthenticationException if there is an error obtaining or constructing + * an AuthenticationInfo objectbased on the specified token + * or implementation-specific login behavior fails. */ AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException; diff --git a/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java b/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java index 2bf28669d3..98a894cbaf 100644 --- a/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java @@ -88,11 +88,10 @@ public void setGroupRolesMap(Map groupRolesMap) { | M E T H O D S | ============================================*/ - @SuppressWarnings("checkstyle:LineLength") /** * Builds an {@link AuthenticationInfo} object by querying the active directory LDAP context for the * specified username. This method binds to the LDAP server using the provided username and password - - * which if successful, indicates that the password is correct. + * which is successful, indicates that the password is correct. *

    * This method can be overridden by subclasses to query the LDAP server in a more complex way. * @@ -101,7 +100,8 @@ public void setGroupRolesMap(Map groupRolesMap) { * @return an {@link AuthenticationInfo} instance containing information retrieved from LDAP. * @throws NamingException if any LDAP errors occur during the search. */ - protected AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token, LdapContextFactory ldapContextFactory) throws NamingException { + protected AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token, LdapContextFactory ldapContextFactory) + throws NamingException { UsernamePasswordToken upToken = (UsernamePasswordToken) token; @@ -159,7 +159,6 @@ protected AuthorizationInfo buildAuthorizationInfo(Set roleNames) { return new SimpleAuthorizationInfo(roleNames); } - @SuppressWarnings("checkstyle:LineLength") protected Set getRoleNamesForUser(String username, LdapContext ldapContext) throws NamingException { Set roleNames; roleNames = new LinkedHashSet(); @@ -168,7 +167,8 @@ protected Set getRoleNamesForUser(String username, LdapContext ldapConte searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE); String userPrincipalName = username; - if (principalSuffix != null && !userPrincipalName.toLowerCase(Locale.ROOT).endsWith(principalSuffix.toLowerCase(Locale.ROOT))) { + if (principalSuffix != null + && !userPrincipalName.toLowerCase(Locale.ROOT).endsWith(principalSuffix.toLowerCase(Locale.ROOT))) { userPrincipalName += principalSuffix; } diff --git a/core/src/main/java/org/apache/shiro/realm/jdbc/JdbcRealm.java b/core/src/main/java/org/apache/shiro/realm/jdbc/JdbcRealm.java index a2e9ca87f6..2d476ac14d 100644 --- a/core/src/main/java/org/apache/shiro/realm/jdbc/JdbcRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/jdbc/JdbcRealm.java @@ -46,7 +46,6 @@ import java.util.LinkedHashSet; import java.util.Set; -@SuppressWarnings("checkstyle:LineLength") /** * Realm that allows authentication and authorization via JDBC calls. The default queries suggest a potential schema * for retrieving the user's password for authentication, and querying for a user's roles and permissions. The @@ -55,7 +54,8 @@ * If the default implementation * of authentication and authorization cannot handle your schema, this class can be subclassed and the * appropriate methods overridden. (usually {@link #doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)}, - * {@link #getRoleNamesForUser(java.sql.Connection, String)}, and/or {@link #getPermissions(java.sql.Connection, String, java.util.Collection)} + * {@link #getRoleNamesForUser(java.sql.Connection, String)}, + * and/or {@link #getPermissions(java.sql.Connection, String, java.util.Collection)} *

    * This realm supports caching by extending from {@link org.apache.shiro.realm.AuthorizingRealm}. * @@ -63,8 +63,6 @@ */ public class JdbcRealm extends AuthorizingRealm { - //TODO - complete JavaDoc - /*-------------------------------------------- | C O N S T A N T S | ============================================*/ @@ -76,8 +74,8 @@ public class JdbcRealm extends AuthorizingRealm { /** * The default query used to retrieve account data for the user when {@link #saltStyle} is COLUMN. */ - @SuppressWarnings("checkstyle:LineLength") - protected static final String DEFAULT_SALTED_AUTHENTICATION_QUERY = "select password, password_salt from users where username = ?"; + protected static final String DEFAULT_SALTED_AUTHENTICATION_QUERY + = "select password, password_salt from users where username = ?"; /** * The default query used to retrieve the roles that apply to a user. @@ -286,7 +284,6 @@ protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) return info; } - @SuppressWarnings("checkstyle:LineLength") private String[] getPasswordForUser(Connection conn, String username) throws SQLException { String[] result; @@ -317,7 +314,8 @@ private String[] getPasswordForUser(Connection conn, String username) throws SQL // Check to ensure only one row is processed if (foundResult) { - throw new AuthenticationException("More than one user row found for user [" + username + "]. Usernames must be unique."); + throw new AuthenticationException("More than one user row found for user [" + + username + "]. Usernames must be unique."); } result[0] = rs.getString(1); diff --git a/core/src/main/java/org/apache/shiro/realm/ldap/AbstractLdapRealm.java b/core/src/main/java/org/apache/shiro/realm/ldap/AbstractLdapRealm.java index 475993e09e..edd6e52832 100644 --- a/core/src/main/java/org/apache/shiro/realm/ldap/AbstractLdapRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/ldap/AbstractLdapRealm.java @@ -228,10 +228,8 @@ protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principal * @return an {@link AuthenticationInfo} instance containing information retrieved from the LDAP server. * @throws NamingException if any LDAP errors occur during the search. */ - @SuppressWarnings("checkstyle:LineLength") - protected abstract AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token, LdapContextFactory ldapContextFactory) - throws NamingException; - + protected abstract AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token, + LdapContextFactory ldapContextFactory) throws NamingException; /** *

    Abstract method that should be implemented by subclasses to builds an @@ -243,8 +241,7 @@ protected abstract AuthenticationInfo queryForAuthenticationInfo(AuthenticationT * @return an {@link AuthorizationInfo} instance containing information retrieved from the LDAP server. * @throws NamingException if any LDAP errors occur during the search. */ - @SuppressWarnings("checkstyle:LineLength") - protected abstract AuthorizationInfo queryForAuthorizationInfo(PrincipalCollection principal, LdapContextFactory ldapContextFactory) - throws NamingException; + protected abstract AuthorizationInfo queryForAuthorizationInfo(PrincipalCollection principal, + LdapContextFactory ldapContextFactory) throws NamingException; } diff --git a/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java b/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java index ed01701e29..d742f7bf30 100644 --- a/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/ldap/DefaultLdapRealm.java @@ -343,14 +343,13 @@ protected Object getLdapPrincipal(AuthenticationToken token) { return principal; } - @SuppressWarnings("checkstyle:LineLength") /** * This implementation opens an LDAP connection using the token's * {@link #getLdapPrincipal(org.apache.shiro.authc.AuthenticationToken) discovered principal} and provided * {@link AuthenticationToken#getCredentials() credentials}. If the connection opens successfully, the * authentication attempt is immediately considered successful and a new * {@link AuthenticationInfo} instance is - * {@link #createAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken, Object, Object, javax.naming.ldap.LdapContext) created} + * {@link #createAuthenticationInfo(AuthenticationToken, Object, Object, LdapContext) created} * and returned. If the connection cannot be opened, either because LDAP authentication failed or some other * JNDI problem, an {@link NamingException} will be thrown. * diff --git a/core/src/main/java/org/apache/shiro/realm/ldap/JndiLdapContextFactory.java b/core/src/main/java/org/apache/shiro/realm/ldap/JndiLdapContextFactory.java index fcfd313e9a..4659b26f0d 100644 --- a/core/src/main/java/org/apache/shiro/realm/ldap/JndiLdapContextFactory.java +++ b/core/src/main/java/org/apache/shiro/realm/ldap/JndiLdapContextFactory.java @@ -504,7 +504,7 @@ protected LdapContext createLdapContext(Hashtable env) throws NamingException { * @param environment the JNDI environment settings to be validated * @throws AuthenticationException if a configuration problem is detected */ - @SuppressWarnings({"checkstyle:LineLength", "checkstyle:BooleanExpressionComplexity"}) + @SuppressWarnings({"checkstyle:BooleanExpressionComplexity"}) protected void validateAuthenticationInfo(Hashtable environment) throws AuthenticationException { // validate when using Simple auth both principal and credentials are set diff --git a/core/src/main/java/org/apache/shiro/realm/text/PropertiesRealm.java b/core/src/main/java/org/apache/shiro/realm/text/PropertiesRealm.java index d60ba48c03..fc48083ea8 100644 --- a/core/src/main/java/org/apache/shiro/realm/text/PropertiesRealm.java +++ b/core/src/main/java/org/apache/shiro/realm/text/PropertiesRealm.java @@ -184,11 +184,11 @@ public void destroy() { } } - @SuppressWarnings("checkstyle:LineLength") protected void startReloadThread() { if (this.reloadIntervalSeconds > 0) { this.scheduler = Executors.newSingleThreadScheduledExecutor(); - ((ScheduledExecutorService) this.scheduler).scheduleAtFixedRate(this, reloadIntervalSeconds, reloadIntervalSeconds, TimeUnit.SECONDS); + ((ScheduledExecutorService) this.scheduler) + .scheduleAtFixedRate(this, reloadIntervalSeconds, reloadIntervalSeconds, TimeUnit.SECONDS); } } diff --git a/core/src/main/java/org/apache/shiro/session/mgt/AbstractNativeSessionManager.java b/core/src/main/java/org/apache/shiro/session/mgt/AbstractNativeSessionManager.java index f6a701e0dd..a172a01d03 100644 --- a/core/src/main/java/org/apache/shiro/session/mgt/AbstractNativeSessionManager.java +++ b/core/src/main/java/org/apache/shiro/session/mgt/AbstractNativeSessionManager.java @@ -42,7 +42,7 @@ * * @since 1.0 */ -@SuppressWarnings({"checkstyle:MethodCount", "checkstyle:LineLength"}) +@SuppressWarnings({"checkstyle:MethodCount"}) public abstract class AbstractNativeSessionManager extends AbstractSessionManager implements NativeSessionManager, EventBusAware { private static final Logger LOGGER = LoggerFactory.getLogger(AbstractSessionManager.class); @@ -114,9 +114,10 @@ public Session start(SessionContext context) { * {@link SessionFactory} when instantiating the internal {@code Session} instance. * @return the new {@code Session} instance. * @throws org.apache.shiro.authz.HostUnauthorizedException if the system access control policy restricts access based - * on client location/IP and the specified hostAddress hasn't been enabled. - * @throws AuthorizationException if the system access control policy does not allow the currently executing - * caller to start sessions. + * on client location/IP and + * the specified hostAddress hasn't been enabled. + * @throws AuthorizationException if the system access control policy does not allow + * the currently executing caller to start sessions. */ protected abstract Session createSession(SessionContext context) throws AuthorizationException; diff --git a/core/src/main/java/org/apache/shiro/session/mgt/SessionValidationScheduler.java b/core/src/main/java/org/apache/shiro/session/mgt/SessionValidationScheduler.java index 5fad2a7eda..260b3c22fb 100644 --- a/core/src/main/java/org/apache/shiro/session/mgt/SessionValidationScheduler.java +++ b/core/src/main/java/org/apache/shiro/session/mgt/SessionValidationScheduler.java @@ -18,10 +18,10 @@ */ package org.apache.shiro.session.mgt; -@SuppressWarnings("checkstyle:LineLength") /** * Interface that should be implemented by classes that can control validating sessions on a regular - * basis. This interface is used as a delegate for session validation by the {@link org.apache.shiro.session.mgt.DefaultSessionManager} + * basis. This interface is used as a delegate for session validation + * by the {@link org.apache.shiro.session.mgt.DefaultSessionManager} * * @see org.apache.shiro.session.mgt.DefaultSessionManager#setSessionValidationScheduler(SessionValidationScheduler) * @since 0.1 diff --git a/core/src/main/java/org/apache/shiro/session/mgt/SimpleSession.java b/core/src/main/java/org/apache/shiro/session/mgt/SimpleSession.java index 0a0c0932d1..8b125a3184 100644 --- a/core/src/main/java/org/apache/shiro/session/mgt/SimpleSession.java +++ b/core/src/main/java/org/apache/shiro/session/mgt/SimpleSession.java @@ -379,11 +379,12 @@ public boolean equals(Object obj) { * @return true if all the attributes, except the id, are equal to this object's attributes. * @since 1.0 */ - @SuppressWarnings({"checkstyle:BooleanExpressionComplexity", "checkstyle:MethodCount", "checkstyle:LineLength"}) + @SuppressWarnings({"checkstyle:BooleanExpressionComplexity", "checkstyle:MethodCount"}) protected boolean onEquals(SimpleSession ss) { return (getStartTimestamp() != null ? getStartTimestamp().equals(ss.getStartTimestamp()) : ss.getStartTimestamp() == null) && (getStopTimestamp() != null ? getStopTimestamp().equals(ss.getStopTimestamp()) : ss.getStopTimestamp() == null) - && (getLastAccessTime() != null ? getLastAccessTime().equals(ss.getLastAccessTime()) : ss.getLastAccessTime() == null) + && (getLastAccessTime() != null + ? getLastAccessTime().equals(ss.getLastAccessTime()) : ss.getLastAccessTime() == null) && (getTimeout() == ss.getTimeout()) && (isExpired() == ss.isExpired()) && (getHost() != null ? getHost().equals(ss.getHost()) : ss.getHost() == null) diff --git a/core/src/main/java/org/apache/shiro/subject/Subject.java b/core/src/main/java/org/apache/shiro/subject/Subject.java index 2da9716d53..7b1c83f967 100644 --- a/core/src/main/java/org/apache/shiro/subject/Subject.java +++ b/core/src/main/java/org/apache/shiro/subject/Subject.java @@ -725,7 +725,6 @@ public Builder session(Session session) { return this; } - @SuppressWarnings("checkstyle:LineLength") /** * Ensures the {@code Subject} being built will reflect the specified principals (aka identity). *

    @@ -735,7 +734,7 @@ public Builder session(Session session) { * was named "{@code myRealm}", you might create the '{@code jsmith} {@code Subject} instance this * way: * 

    -         * PrincipalCollection identity = new {@link org.apache.shiro.subject.SimplePrincipalCollection#SimplePrincipalCollection(Object, String)
+         * PrincipalCollection identity = new {@link SimplePrincipalCollection#SimplePrincipalCollection(Object, String)
          *                                  SimplePrincipalCollection}("jsmith", "myRealm");
          * Subject jsmith = new Subject.Builder().principals(identity).buildSubject();
    *

    @@ -745,7 +744,7 @@ public Builder session(Session session) { * instance this way: * 

              * long userId = //get user ID from somewhere
-         * PrincipalCollection userIdentity = new {@link org.apache.shiro.subject.SimplePrincipalCollection#SimplePrincipalCollection(Object, String)
+         * PrincipalCollection userIdentity = new {@link SimplePrincipalCollection#SimplePrincipalCollection(Object, String)
          *                                  SimplePrincipalCollection}(userId, "jdbcRealm");
          * Subject user = new Subject.Builder().principals(identity).buildSubject();
    * diff --git a/core/src/main/java/org/apache/shiro/util/PermissionUtils.java b/core/src/main/java/org/apache/shiro/util/PermissionUtils.java index f1e0ba1097..f574b96487 100644 --- a/core/src/main/java/org/apache/shiro/util/PermissionUtils.java +++ b/core/src/main/java/org/apache/shiro/util/PermissionUtils.java @@ -51,8 +51,8 @@ public static Set toPermissionStrings(String permissionsString) { return null; } - @SuppressWarnings("checkstyle:LineLength") - public static Set resolvePermissions(Collection permissionStrings, PermissionResolver permissionResolver) { + public static Set resolvePermissions(Collection permissionStrings, + PermissionResolver permissionResolver) { Set permissions = new LinkedHashSet<>(permissionStrings.size()); for (String permissionString : permissionStrings) { permissions.add(permissionResolver.resolvePermission(permissionString)); diff --git a/core/src/main/java/org/apache/shiro/util/ThreadContext.java b/core/src/main/java/org/apache/shiro/util/ThreadContext.java index 6fe7b3f71c..267a7949b9 100644 --- a/core/src/main/java/org/apache/shiro/util/ThreadContext.java +++ b/core/src/main/java/org/apache/shiro/util/ThreadContext.java @@ -328,8 +328,8 @@ public static Subject unbindSubject() { return (Subject) remove(SUBJECT_KEY); } - @SuppressWarnings("checkstyle:LineLength") - private static final class InheritableThreadLocalMap> extends InheritableThreadLocal> { + private static final class InheritableThreadLocalMap> + extends InheritableThreadLocal> { /** * This implementation was added to address a diff --git a/core/src/test/groovy/org/apache/shiro/config/ogdl/event/LoggingBeanEventListenerTest.groovy b/core/src/test/groovy/org/apache/shiro/config/ogdl/event/LoggingBeanEventListenerTest.groovy index 13aa46256f..3a5e354a94 100644 --- a/core/src/test/groovy/org/apache/shiro/config/ogdl/event/LoggingBeanEventListenerTest.groovy +++ b/core/src/test/groovy/org/apache/shiro/config/ogdl/event/LoggingBeanEventListenerTest.groovy @@ -32,7 +32,7 @@ class LoggingBeanEventListenerTest { @Test void testMisnamedBeanEventClass() { - def m = [foo: 'bar'] as Map + def m = [foo: 'bar'] as Map Object o = new Object() BeanEvent evt = new MisnamedBean('baz', o, m) diff --git a/core/src/test/groovy/org/apache/shiro/lang/codec/H64Test.groovy b/core/src/test/groovy/org/apache/shiro/lang/codec/H64Test.groovy index 257b6b7a30..6db9bae606 100644 --- a/core/src/test/groovy/org/apache/shiro/lang/codec/H64Test.groovy +++ b/core/src/test/groovy/org/apache/shiro/lang/codec/H64Test.groovy @@ -36,7 +36,7 @@ class H64Test { public void testDefault() { byte[] orig = new SecureRandomNumberGenerator().nextBytes(6).bytes - LOG.trace("bytes: $orig"); ; + LOG.trace("bytes: $orig");; String encoded = H64.encodeToString(orig) LOG.trace("encoded: $encoded"); diff --git a/core/src/test/groovy/org/apache/shiro/mgt/DefaultSubjectDAOTest.groovy b/core/src/test/groovy/org/apache/shiro/mgt/DefaultSubjectDAOTest.groovy index 3820b420bd..785dac22cf 100644 --- a/core/src/test/groovy/org/apache/shiro/mgt/DefaultSubjectDAOTest.groovy +++ b/core/src/test/groovy/org/apache/shiro/mgt/DefaultSubjectDAOTest.groovy @@ -115,7 +115,7 @@ class DefaultSubjectDAOTest { expect(subject.getSession(false)).andReturn null //turn off session storage: - ((DefaultSessionStorageEvaluator) dao.sessionStorageEvaluator).sessionStorageEnabled = false + ((DefaultSessionStorageEvaluator)dao.sessionStorageEvaluator).sessionStorageEnabled = false replay subject diff --git a/core/src/test/java/org/apache/shiro/authc/AbstractAuthenticatorTest.java b/core/src/test/java/org/apache/shiro/authc/AbstractAuthenticatorTest.java index 4811c1cb5d..c03b5a608f 100644 --- a/core/src/test/java/org/apache/shiro/authc/AbstractAuthenticatorTest.java +++ b/core/src/test/java/org/apache/shiro/authc/AbstractAuthenticatorTest.java @@ -47,11 +47,12 @@ public class AbstractAuthenticatorTest { AbstractAuthenticator abstractAuthenticator; private final SimpleAuthenticationInfo info = new SimpleAuthenticationInfo("user1", "secret", "realmName"); - @SuppressWarnings("checkstyle:LineLength") @BeforeAll static void setUpLogger() { LoggerContext loggerContext = - (LoggerContext) LogManager.getContext(AbstractAuthenticatorTest.class.getClassLoader(), false, URI.create("log4j2-list.xml")); + (LoggerContext) LogManager.getContext(AbstractAuthenticatorTest.class.getClassLoader(), + false, + URI.create("log4j2-list.xml")); Configuration configuration = loggerContext.getConfiguration(); listAppender = configuration.getAppender("List"); } @@ -181,11 +182,11 @@ protected AuthenticationInfo doAuthenticate(AuthenticationToken token) throws Au }); } - @SuppressWarnings("checkstyle:LineLength") @Test void logExceptionAfterDoAuthenticateThrowsNonAuthenticationException() { // NOTE: log4j is a test dependency - final String expectedExceptionMessage = "exception thrown for test logExceptionAfterDoAuthenticateThrowsNonAuthenticationException"; + final String expectedExceptionMessage = "exception thrown" + + " for test logExceptionAfterDoAuthenticateThrowsNonAuthenticationException"; abstractAuthenticator = new AbstractAuthenticator() { protected AuthenticationInfo doAuthenticate(AuthenticationToken token) throws AuthenticationException { diff --git a/core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java b/core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java index 2180f1f8c1..85eb9b8ad4 100644 --- a/core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java +++ b/core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java @@ -65,7 +65,6 @@ import static org.hamcrest.Matchers.is; import static org.junit.jupiter.api.Assertions.assertTrue; - /** * Simple test case for ActiveDirectoryRealm. *

    @@ -130,13 +129,13 @@ void testExistingUserSuffix() throws Exception { assertExistingUserSuffix(USERNAME + "@EXAMPLE.com", "testuser@EXAMPLE.com"); } - @SuppressWarnings("checkstyle:LineLength") public void assertExistingUserSuffix(String username, String expectedPrincipalName) throws Exception { LdapContext ldapContext = createMock(LdapContext.class); NamingEnumeration results = createMock(NamingEnumeration.class); Capture captureArgs = Capture.newInstance(CaptureType.ALL); - expect(ldapContext.search(anyString(), anyString(), capture(captureArgs), anyObject(SearchControls.class))).andReturn(results); + expect(ldapContext.search(anyString(), anyString(), capture(captureArgs), anyObject(SearchControls.class))) + .andReturn(results); replay(ldapContext); ActiveDirectoryRealm activeDirectoryRealm = new ActiveDirectoryRealm() {{ diff --git a/core/src/test/java/org/apache/shiro/realm/jdbc/JDBCRealmTest.java b/core/src/test/java/org/apache/shiro/realm/jdbc/JDBCRealmTest.java index 6516b98611..ac560f6f6d 100644 --- a/core/src/test/java/org/apache/shiro/realm/jdbc/JDBCRealmTest.java +++ b/core/src/test/java/org/apache/shiro/realm/jdbc/JDBCRealmTest.java @@ -70,7 +70,6 @@ public class JDBCRealmTest { private String name; - @SuppressWarnings("checkstyle:LineLength") @BeforeEach public void setup(TestInfo testInfo) { Optional testMethod = testInfo.getTestMethod(); @@ -80,7 +79,9 @@ public void setup(TestInfo testInfo) { ThreadContext.remove(); Ini config = new Ini(); config.setSectionProperty("main", "myRealm", "org.apache.shiro.realm.jdbc.JdbcRealm"); - config.setSectionProperty("main", "myRealmCredentialsMatcher", "org.apache.shiro.authc.credential.Sha256CredentialsMatcher"); + config.setSectionProperty("main", + "myRealmCredentialsMatcher", + "org.apache.shiro.authc.credential.Sha256CredentialsMatcher"); config.setSectionProperty("main", "myRealm.credentialsMatcher", "$myRealmCredentialsMatcher"); config.setSectionProperty("main", "securityManager.sessionManager.sessionValidationSchedulerEnabled", "false"); diff --git a/core/src/test/java/org/apache/shiro/realm/text/TextConfigurationRealmTest.java b/core/src/test/java/org/apache/shiro/realm/text/TextConfigurationRealmTest.java index 6a69bfc52a..f041bac00b 100644 --- a/core/src/test/java/org/apache/shiro/realm/text/TextConfigurationRealmTest.java +++ b/core/src/test/java/org/apache/shiro/realm/text/TextConfigurationRealmTest.java @@ -167,12 +167,15 @@ public void run() { void testIsPermitted() throws InterruptedException { setUpForReadConfigurationTest(); executeTest(new Runnable() { - @SuppressWarnings("checkstyle:LineLength") + public void run() { PrincipalCollection principalCollection = new SimplePrincipalCollection("user1", "realm1"); - assertTrue(realm.isPermitted(principalCollection, "role1_permission1"), "permission not permitted when it should be"); - assertTrue(realm.isPermittedAll(principalCollection, new String[] {"role1_permission1", "role2_permission2"}), + assertTrue(realm.isPermitted(principalCollection, + "role1_permission1"), "permission not permitted when it should be"); + assertTrue(realm.isPermittedAll(principalCollection, + "role1_permission1", "role2_permission2"), + "permission not permitted when it should be"); } }); } diff --git a/core/src/test/java/org/apache/shiro/util/AntPathMatcherTests.java b/core/src/test/java/org/apache/shiro/util/AntPathMatcherTests.java index 682ccc89e9..c01154d61f 100644 --- a/core/src/test/java/org/apache/shiro/util/AntPathMatcherTests.java +++ b/core/src/test/java/org/apache/shiro/util/AntPathMatcherTests.java @@ -29,7 +29,9 @@ /** * Unit tests for {@link AntPathMatcher}. *

    - * Adapted from Spring Framework's similar AntPathMatcherTests + * Adapted from + * + * Spring Framework's similar AntPathMatcherTests */ public class AntPathMatcherTests { @@ -279,7 +281,6 @@ void uniqueDelimiter() { assertFalse(pathMatcher.match(".*bla.test", "XXXbl.test")); } - @SuppressWarnings("checkstyle:LineLength") @Test void extractPathWithinPattern() throws Exception { assertEquals(pathMatcher.extractPathWithinPattern("/docs/commit.html", "/docs/commit.html"), ""); diff --git a/core/src/test/resources/org/apache/shiro/config/IniSecurityManagerFactoryTest.propsRealm.properties b/core/src/test/resources/org/apache/shiro/config/IniSecurityManagerFactoryTest.propsRealm.properties index e3ed3561d4..9170a2711a 100644 --- a/core/src/test/resources/org/apache/shiro/config/IniSecurityManagerFactoryTest.propsRealm.properties +++ b/core/src/test/resources/org/apache/shiro/config/IniSecurityManagerFactoryTest.propsRealm.properties @@ -16,13 +16,15 @@ # specific language governing permissions and limitations # under the License. # + # ------------------------------ # Users and their assigned roles # ------------------------------ # user 'root' with password 'secret' and the 'root' role -user.root=secret,root +user.root = secret,root + # ------------------------------- # Roles with assigned permissions # ------------------------------- # 'root' role has all permissions, indicated by the wildcard '*' -role.root=* +role.root = * diff --git a/core/src/test/resources/test.shiro.ini b/core/src/test/resources/test.shiro.ini index 884752a9c7..40a3bba883 100644 --- a/core/src/test/resources/test.shiro.ini +++ b/core/src/test/resources/test.shiro.ini @@ -1,21 +1,21 @@ -# -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. -# - -[users] +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +[users] jsmith = jsmith,role1 \ No newline at end of file diff --git a/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/DefaultHashServiceTest.groovy b/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/DefaultHashServiceTest.groovy index 2d8ea5b94e..93e4cca6ad 100644 --- a/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/DefaultHashServiceTest.groovy +++ b/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/DefaultHashServiceTest.groovy @@ -51,7 +51,7 @@ class DefaultHashServiceTest { @Test void testRequestWithEmptySource() { - def source = ByteSource.Util.bytes((byte[]) null) + def source = ByteSource.Util.bytes((byte[])null) def request = new HashRequest.Builder().setSource(source).build() def service = createSha256Service() assertNull service.computeHash(request) diff --git a/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/format/Shiro1CryptFormatTest.groovy b/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/format/Shiro1CryptFormatTest.groovy index 7a82d3d6e0..7ac441e3a6 100644 --- a/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/format/Shiro1CryptFormatTest.groovy +++ b/crypto/hash/src/test/groovy/org/apache/shiro/crypto/hash/format/Shiro1CryptFormatTest.groovy @@ -51,7 +51,7 @@ class Shiro1CryptFormatTest { String formatted = format.format(hash); String expected = - Shiro1CryptFormat.MCF_PREFIX + alg + '$' + iterations + '$' + salt.toBase64() + '$' + hash.toBase64() + Shiro1CryptFormat.MCF_PREFIX + alg + '$' + iterations + '$' + salt.toBase64() + '$' + hash.toBase64() assertNotNull formatted assertEquals expected, formatted diff --git a/crypto/support/hashes/argon2/src/main/java/org/apache/shiro/crypto/support/hashes/argon2/Argon2Hash.java b/crypto/support/hashes/argon2/src/main/java/org/apache/shiro/crypto/support/hashes/argon2/Argon2Hash.java index d9d00dc4fa..67d2d8ba33 100644 --- a/crypto/support/hashes/argon2/src/main/java/org/apache/shiro/crypto/support/hashes/argon2/Argon2Hash.java +++ b/crypto/support/hashes/argon2/src/main/java/org/apache/shiro/crypto/support/hashes/argon2/Argon2Hash.java @@ -41,7 +41,6 @@ import static java.util.Collections.unmodifiableSet; import static java.util.Objects.requireNonNull; -@SuppressWarnings("checkstyle:LineLength") /** * The Argon2 key derivation function (KDF) is a modern algorithm to shade and hash passwords. * @@ -52,9 +51,11 @@ * argon2-cffi.readthedocs.io. * The RFC suggests to use 1 GiB of memory for frontend and 4 GiB for backend authentication.

    * - *

    Example crypt string is: {@code $argon2i$v=19$m=16384,t=100,p=2$M3ByeyZKLjFRREJqQi87WQ$5kRCtDjL6RoIWGq9bL27DkFNunucg1hW280PmP0XDtY}.

    + *

    Example crypt string is: + * {@code $argon2i$v=19$m=16384,t=100,p=2$M3ByeyZKLjFRREJqQi87WQ$5kRCtDjL6RoIWGq9bL27DkFNunucg1hW280PmP0XDtY}.

    * - *

    Default values are taken from draft-irtf-cfrg-argon2-13. + *

    Default values are taken from + * draft-irtf-cfrg-argon2-13. * This implementation is using the parameters from section 4, paragraph 2 (memory constrained environment).

    * * @since 2.0 @@ -106,7 +107,8 @@ class Argon2Hash extends AbstractCryptHash { private final int parallelism; - Argon2Hash(String algorithmName, int argonVersion, byte[] hashedData, ByteSource salt, int iterations, int memoryAsKB, int parallelism) { + Argon2Hash(String algorithmName, int argonVersion, byte[] hashedData, + ByteSource salt, int iterations, int memoryAsKB, int parallelism) { super(algorithmName, hashedData, salt); this.argonVersion = argonVersion; this.iterations = iterations; @@ -140,7 +142,8 @@ public static Argon2Hash fromString(String input) { final String algorithmName = parts[0].trim(); if (!ALGORITHMS_ARGON2.contains(algorithmName)) { - throw new UnsupportedOperationException("Unsupported algorithm: " + algorithmName + ". Expected one of: " + ALGORITHMS_ARGON2); + throw new UnsupportedOperationException("Unsupported algorithm: " + algorithmName + + ". Expected one of: " + ALGORITHMS_ARGON2); } final int version = parseVersion(parts[1]); @@ -158,7 +161,8 @@ private static int parseParallelism(String parameters) { String parameter = DELIMITER_COMMA.splitAsStream(parameters) .filter(parm -> parm.startsWith("p=")) .findAny() - .orElseThrow(() -> new IllegalArgumentException("Did not found memory parameter 'p='. Got: [" + parameters + "].")); + .orElseThrow(() -> new IllegalArgumentException("Did not found memory parameter 'p='. Got: [" + + parameters + "].")); return Integer.parseInt(parameter.substring(2)); } @@ -166,7 +170,8 @@ private static int parseIterations(String parameters) { String parameter = DELIMITER_COMMA.splitAsStream(parameters) .filter(parm -> parm.startsWith("t=")) .findAny() - .orElseThrow(() -> new IllegalArgumentException("Did not found memory parameter 't='. Got: [" + parameters + "].")); + .orElseThrow(() -> new IllegalArgumentException("Did not found memory parameter 't='. Got: [" + + parameters + "].")); return Integer.parseInt(parameter.substring(2)); } @@ -175,7 +180,8 @@ private static int parseMemory(String parameters) { String parameter = DELIMITER_COMMA.splitAsStream(parameters) .filter(parm -> parm.startsWith("m=")) .findAny() - .orElseThrow(() -> new IllegalArgumentException("Did not found memory parameter 'm='. Got: [" + parameters + "].")); + .orElseThrow(() -> new IllegalArgumentException("Did not found memory parameter 'm='. Got: [" + + parameters + "].")); return Integer.parseInt(parameter.substring(2)); } @@ -355,7 +361,8 @@ public boolean equals(Object other) { return false; } Argon2Hash that = (Argon2Hash) other; - return argonVersion == that.argonVersion && iterations == that.iterations && memoryKiB == that.memoryKiB && parallelism == that.parallelism; + return argonVersion == that.argonVersion && iterations == that.iterations + && memoryKiB == that.memoryKiB && parallelism == that.parallelism; } @Override diff --git a/event/src/test/groovy/org/apache/shiro/event/support/SingleArgumentMethodEventListenerTest.groovy b/event/src/test/groovy/org/apache/shiro/event/support/SingleArgumentMethodEventListenerTest.groovy index e930941591..44d3f251ec 100644 --- a/event/src/test/groovy/org/apache/shiro/event/support/SingleArgumentMethodEventListenerTest.groovy +++ b/event/src/test/groovy/org/apache/shiro/event/support/SingleArgumentMethodEventListenerTest.groovy @@ -100,4 +100,5 @@ class SingleArgumentMethodEventListenerTest { } + } diff --git a/integration-tests/guice4/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java b/integration-tests/guice4/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java index 3826089072..48c714fb8a 100644 --- a/integration-tests/guice4/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java +++ b/integration-tests/guice4/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java @@ -44,7 +44,6 @@ public SampleShiroServletModule(ServletContext servletContext) { this.servletContext = servletContext; } - @SuppressWarnings("checkstyle:LineLength") @Override protected void configureShiroWeb() { bindConstant().annotatedWith(Names.named("shiro.loginUrl")).to("/login.jsp"); @@ -58,7 +57,10 @@ protected void configureShiroWeb() { this.addFilterChain("/logout", LOGOUT); this.addFilterChain("/account/**", AUTHC); - this.addFilterChain("/remoting/**", filterConfig(AUTHC), filterConfig(ROLES, "b2bClient"), filterConfig(PERMS, "remote:invoke:lan,wan")); + this.addFilterChain("/remoting/**", + filterConfig(AUTHC), + filterConfig(ROLES, "b2bClient"), + filterConfig(PERMS, "remote:invoke:lan,wan")); } @Provides diff --git a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/errorpages/invalidErrorPage.xhtml b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/errorpages/invalidErrorPage.xhtml index 3dc14a1ca8..a324ab4e00 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/errorpages/invalidErrorPage.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/errorpages/invalidErrorPage.xhtml @@ -18,28 +18,28 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Exception Page - - -
    Exception happened
    -

    -

      -
    • Date/time: #{of:formatDate(now, 'yyyy-MM-dd HH:mm:ss')}
      • -
    • User agent: #{header['user-agent']}
      • -
    • User IP: #{request.remoteAddr}
      • -
    • Request URI: #{requestScope['javax.servlet.error.request_uri']}
      • -
    • Ajax request: #{facesContext.partialViewContext.ajaxRequest ? 'Yes' : 'No'}
      • -
    • Status code: #{requestScope['javax.servlet.error.status_code']}
      • -
    • Exception type: #{requestScope['javax.servlet.error.exception_type']}
      • -
    • Exception message: #{requestScope['javax.servlet.error.message']}
      • -
    • Exception UUID: #{requestScope['org.omnifaces.exception_uuid']}
      • -
    • Stack trace: - 
      #{of:printStackTrace(requestScope['javax.servlet.error.exception'])}
      -
      • -
    -     + + Exception Page + + +
    Exception happened
    +

    +

      +
    • Date/time: #{of:formatDate(now, 'yyyy-MM-dd HH:mm:ss')}
      • +
    • User agent: #{header['user-agent']}
      • +
    • User IP: #{request.remoteAddr}
      • +
    • Request URI: #{requestScope['javax.servlet.error.request_uri']}
      • +
    • Ajax request: #{facesContext.partialViewContext.ajaxRequest ? 'Yes' : 'No'}
      • +
    • Status code: #{requestScope['javax.servlet.error.status_code']}
      • +
    • Exception type: #{requestScope['javax.servlet.error.exception_type']}
      • +
    • Exception message: #{requestScope['javax.servlet.error.message']}
      • +
    • Exception UUID: #{requestScope['org.omnifaces.exception_uuid']}
      • +
    • Stack trace: + 
      #{of:printStackTrace(requestScope['javax.servlet.error.exception'])}
      +
      • +
    +     diff --git a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/faces-config.xml b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/faces-config.xml index c7381f96ed..95cd0a3d51 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/faces-config.xml +++ b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/faces-config.xml @@ -24,11 +24,9 @@ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_3.xsd"> - org.omnifaces.exceptionhandler.FullAjaxExceptionHandlerFactory - + org.omnifaces.exceptionhandler.FullAjaxExceptionHandlerFactory - org.omnifaces.exceptionhandler.ViewExpiredExceptionHandlerFactory - + org.omnifaces.exceptionhandler.ViewExpiredExceptionHandlerFactory org.omnifaces.resourcehandler.VersionedResourceHandler diff --git a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/payara-web.xml b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/payara-web.xml index 6bbebbecd1..dffb4abb98 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/payara-web.xml +++ b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/payara-web.xml @@ -17,8 +17,7 @@ ~ specific language governing permissions and limitations ~ under the License. --> - + diff --git a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/web.xml b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/web.xml index 62cea200bd..f2d6b867d2 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/web.xml +++ b/integration-tests/jakarta-ee/src/main/webapp/WEB-INF/web.xml @@ -35,9 +35,7 @@ org.omnifaces.EXCEPTION_TYPES_TO_IGNORE_IN_LOGGING - javax.faces.application.ViewExpiredException, java.nio.channels.ClosedByInterruptException, - java.sql.SQLException - + javax.faces.application.ViewExpiredException, java.nio.channels.ClosedByInterruptException, java.sql.SQLException diff --git a/integration-tests/jakarta-ee/src/main/webapp/index.xhtml b/integration-tests/jakarta-ee/src/main/webapp/index.xhtml index 89c0b33cdd..2db3a33cae 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/index.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/index.xhtml @@ -17,12 +17,12 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Index - - - Apache Shiro Examples - + + Index + + + Apache Shiro Examples + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/adminpage.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/adminpage.xhtml index 97ecfdf2dc..fbc74a33c8 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/adminpage.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/adminpage.xhtml @@ -17,15 +17,15 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Admin Page - - - Admin user required to access this page - Access Granted! - - - - + + Admin Page + + + Admin user required to access this page - Access Granted! + + + + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/loginform.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/loginform.xhtml index 59b5d8f893..3d39e29ff9 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/loginform.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/loginform.xhtml @@ -17,38 +17,35 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Please Log In - - - - Please Log In -

    - - Username: - + + Please Log In + + + + Please Log In

    - Password: - + + Username: +

    + Password: +

    + Remember Me: +

    + + +

    - Remember Me: - -

    - - - -

    -

    - Your Session Has Expired -
    -
    - Login Failed -
    - -     +
    + Your Session Has Expired +
    +
    + Login Failed +
    + + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthenticated.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthenticated.xhtml index bc38bc52e3..8d80e06d04 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthenticated.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthenticated.xhtml @@ -17,13 +17,13 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - User Not Authenticated - - - User Not Authenticated - + + User Not Authenticated + + + User Not Authenticated + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthorized.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthorized.xhtml index 8fa1961431..1bb4583fbb 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthorized.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/auth/unauthorized.xhtml @@ -17,15 +17,15 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Unauthorized - - - Not enough permissions for this user - - - - + + Unauthorized + + + Not enough permissions for this user + + + + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/form.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/form.xhtml index aa04f36d1c..2aab6c82e4 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/form.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/form.xhtml @@ -17,48 +17,47 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Form Page - - - - First Name: - -

    - Last Name: - -

    - - - - Address: - -

    - City: - -

    - - - -

    - - -

    - -     - Logout (via filter) - -     - + + Form Page + + + + First Name: + +

    + Last Name: + +

    + + + + Address: + +

    + City: + +

    + + + +

    + + +

    + +     + Logout (via filter) +     + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/index.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/index.xhtml index 3dd9b5071a..38f57ed656 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/index.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/index.xhtml @@ -17,18 +17,18 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Apache Shiro Example - - - This is the Apache Shiro home page -

    - Administrator Page -

    - Regular User Page -

    - Fill out form - + + Apache Shiro Example + + + This is the Apache Shiro home page +

    + Administrator Page +

    + Regular User Page +

    + Fill out form + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/protected.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/protected.xhtml index 8023c5b62a..0f3348479d 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/protected.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/protected.xhtml @@ -17,18 +17,18 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Protected Page - - - Protected Page - User login required - Authorized! - - -

    - - - - + + Protected Page + + + Protected Page - User login required - Authorized! + + +

    + + + + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/manybeans.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/manybeans.xhtml index 84a5eb7a8b..11fd926243 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/manybeans.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/manybeans.xhtml @@ -17,57 +17,53 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Many Beans Unprotected - - - Using Web Sessions: - -

    - - - - - - - - - - - - - - - - - - - + + Many Beans Unprotected + + + Using Web Sessions:

    - - - -

    - Your Session Has Expired -
    - - - -     - + + + + + + + + + + + + + + + + + + + +

    + + + +

    + Your Session Has Expired +
    +     + + + + diff --git a/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/tags.xhtml b/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/tags.xhtml index 6505c89333..901fe15a09 100644 --- a/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/tags.xhtml +++ b/integration-tests/jakarta-ee/src/main/webapp/shiro/unprotected/tags.xhtml @@ -17,29 +17,27 @@ ~ specific language governing permissions and limitations ~ under the License. --> - - - Tags Test Page - - - Guest Content - User Content - Authenticated Content - Not Authenticated Content - - - - Regular Role - Lacks Admin Role - Has Some Role - Has Some Permission - Has Permission - Lacks Permission - Remembered - + + Tags Test Page + + + Guest Content + User Content + Authenticated Content + Not Authenticated Content + + + + Regular Role + Lacks Admin Role + Has Some Role + Has Some Permission + Has Permission + Lacks Permission + Remembered + diff --git a/integration-tests/jakarta-ee/src/test/resources/arquillian.xml b/integration-tests/jakarta-ee/src/test/resources/arquillian.xml index 182a23f888..83ec397d6e 100644 --- a/integration-tests/jakarta-ee/src/test/resources/arquillian.xml +++ b/integration-tests/jakarta-ee/src/test/resources/arquillian.xml @@ -13,9 +13,9 @@ limitations under the License. --> + xmlns="http://jboss.org/schema/arquillian" + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://jboss.org/schema/arquillian http://jboss.org/schema/arquillian/arquillian_1_0.xsd"> ${webdriver.browser} -headless diff --git a/integration-tests/jaxrs/app/src/main/java/org/apache/shiro/testing/jaxrs/app/config/ShiroServletFilter.java b/integration-tests/jaxrs/app/src/main/java/org/apache/shiro/testing/jaxrs/app/config/ShiroServletFilter.java index 173848c4fd..43f1a4c3c2 100644 --- a/integration-tests/jaxrs/app/src/main/java/org/apache/shiro/testing/jaxrs/app/config/ShiroServletFilter.java +++ b/integration-tests/jaxrs/app/src/main/java/org/apache/shiro/testing/jaxrs/app/config/ShiroServletFilter.java @@ -23,12 +23,14 @@ import javax.servlet.DispatcherType; import javax.servlet.annotation.WebFilter; -@SuppressWarnings("checkstyle:LineLength") @Dependent @WebFilter( asyncSupported = true, urlPatterns = {"/*"}, - dispatcherTypes = {DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.INCLUDE, DispatcherType.ERROR, DispatcherType.ASYNC} + dispatcherTypes = { + DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.INCLUDE, + DispatcherType.ERROR, DispatcherType.ASYNC + } ) public class ShiroServletFilter extends org.apache.shiro.web.servlet.ShiroFilter { } diff --git a/integration-tests/jaxrs/app/src/main/resources/META-INF/beans.xml b/integration-tests/jaxrs/app/src/main/resources/META-INF/beans.xml index 0c5842171a..e052c65014 100644 --- a/integration-tests/jaxrs/app/src/main/resources/META-INF/beans.xml +++ b/integration-tests/jaxrs/app/src/main/resources/META-INF/beans.xml @@ -23,5 +23,5 @@ xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_2_0.xsd" bean-discovery-mode="all"> - + diff --git a/integration-tests/jaxrs/app/src/main/webapp/WEB-INF/beans.xml b/integration-tests/jaxrs/app/src/main/webapp/WEB-INF/beans.xml index 0c5842171a..e052c65014 100644 --- a/integration-tests/jaxrs/app/src/main/webapp/WEB-INF/beans.xml +++ b/integration-tests/jaxrs/app/src/main/webapp/WEB-INF/beans.xml @@ -23,5 +23,5 @@ xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_2_0.xsd" bean-discovery-mode="all"> - + diff --git a/integration-tests/jaxrs/meecrowave/src/test/resources/log4j2.xml b/integration-tests/jaxrs/meecrowave/src/test/resources/log4j2.xml index 0e5ceed64b..f42f81616b 100644 --- a/integration-tests/jaxrs/meecrowave/src/test/resources/log4j2.xml +++ b/integration-tests/jaxrs/meecrowave/src/test/resources/log4j2.xml @@ -18,53 +18,53 @@ ~ under the License. --> - - [%d][%highlight{%-5level}][%15.15t][%30.30logger] %msg%n - - - - - - - - - - - - - - + + [%d][%highlight{%-5level}][%15.15t][%30.30logger] %msg%n + + + + + + + + + + + + + + - + - - - - - - - + + + + + + + diff --git a/integration-tests/jaxrs/openliberty/src/main/liberty/config/server.xml b/integration-tests/jaxrs/openliberty/src/main/liberty/config/server.xml index 27ceb77063..7bf5ef9e49 100644 --- a/integration-tests/jaxrs/openliberty/src/main/liberty/config/server.xml +++ b/integration-tests/jaxrs/openliberty/src/main/liberty/config/server.xml @@ -31,14 +31,14 @@ + httpsPort="${default.https.port}" /> - + - + diff --git a/integration-tests/jaxrs/openliberty/src/test/java/org/apache/shiro/testing/jaxrs/openliberty/OpenLibertyIT.java b/integration-tests/jaxrs/openliberty/src/test/java/org/apache/shiro/testing/jaxrs/openliberty/OpenLibertyIT.java index b760d2e018..061c3ed231 100644 --- a/integration-tests/jaxrs/openliberty/src/test/java/org/apache/shiro/testing/jaxrs/openliberty/OpenLibertyIT.java +++ b/integration-tests/jaxrs/openliberty/src/test/java/org/apache/shiro/testing/jaxrs/openliberty/OpenLibertyIT.java @@ -26,9 +26,10 @@ @TestInstance(TestInstance.Lifecycle.PER_CLASS) public class OpenLibertyIT extends AbstractShiroJaxRsIT { - @SuppressWarnings("checkstyle:LineLength") + @Override protected URI getBaseUri() { - return URI.create("http://localhost:" + System.getProperty("http.port") + "/" + System.getProperty("app.context.root") + "/api"); + return URI.create("http://localhost:" + System.getProperty("http.port") + + "/" + System.getProperty("app.context.root") + "/api"); } } diff --git a/integration-tests/jaxrs/tests/src/main/java/org/apache/shiro/testing/jaxrs/tests/AbstractShiroJaxRsIT.java b/integration-tests/jaxrs/tests/src/main/java/org/apache/shiro/testing/jaxrs/tests/AbstractShiroJaxRsIT.java index 355491b5e1..888074fd44 100644 --- a/integration-tests/jaxrs/tests/src/main/java/org/apache/shiro/testing/jaxrs/tests/AbstractShiroJaxRsIT.java +++ b/integration-tests/jaxrs/tests/src/main/java/org/apache/shiro/testing/jaxrs/tests/AbstractShiroJaxRsIT.java @@ -61,7 +61,7 @@ public void testGetUsersUnauthenticated() { assertEquals(Status.UNAUTHORIZED.getStatusCode(), usersResponse.getStatus()); } - @SuppressWarnings({"checkstyle:MagicNumber", "checkstyle:LineLength"}) + @SuppressWarnings({"checkstyle:MagicNumber"}) @Test public void testGetUsersBasicAuthenticated() { final WebTarget usersTarget = client.target(getBaseUri()).path("troopers"); @@ -73,7 +73,8 @@ public void testGetUsersBasicAuthenticated() { assertEquals(Status.OK.getStatusCode(), usersResponse.getStatus()); final Stormtrooper[] stormtroopers = usersResponse.readEntity(Stormtrooper[].class); assertEquals(50, stormtroopers.length); - Arrays.stream(stormtroopers).forEach(stormtrooper -> assertTrue(stormtrooper.getStormtrooperId().getValue().startsWith("u"))); + Arrays.stream(stormtroopers).forEach(stormtrooper + -> assertTrue(stormtrooper.getStormtrooperId().getValue().startsWith("u"))); } } diff --git a/integration-tests/support/src/main/java/org/apache/shiro/testing/web/AbstractContainerIT.java b/integration-tests/support/src/main/java/org/apache/shiro/testing/web/AbstractContainerIT.java index 3d57d45eb1..37e44edf7a 100644 --- a/integration-tests/support/src/main/java/org/apache/shiro/testing/web/AbstractContainerIT.java +++ b/integration-tests/support/src/main/java/org/apache/shiro/testing/web/AbstractContainerIT.java @@ -59,7 +59,7 @@ import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertTrue; -@SuppressWarnings({"checkstyle:ClassDataAbstractionCoupling", "checkstyle:LineLength"}) +@SuppressWarnings("checkstyle:ClassDataAbstractionCoupling") public abstract class AbstractContainerIT { protected static final File TEST_KEYSTORE_PATH = setupKeyStore(); @@ -178,7 +178,8 @@ public boolean accept(File dir, String name) { return warFiles[0].getAbsolutePath().replaceFirst("\\.war$", ""); } - protected static String getBasicAuthorizationHeaderValue(String username, String password) throws UnsupportedEncodingException { + protected static String getBasicAuthorizationHeaderValue(String username, String password) + throws UnsupportedEncodingException { String authorizationHeader = username + ":" + password; byte[] valueBytes; valueBytes = authorizationHeader.getBytes("UTF-8"); diff --git a/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/BankService.java b/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/BankService.java index 2afc4c660c..a76399ddc6 100644 --- a/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/BankService.java +++ b/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/BankService.java @@ -20,7 +20,6 @@ import java.util.Date; -@SuppressWarnings("checkstyle:LineLength") public interface BankService { long[] searchAccountIdsByOwner(String anOwnerName); @@ -33,7 +32,8 @@ public interface BankService { double depositInto(long anAccountId, double anAmount) throws AccountNotFoundException, InactiveAccountException; - double withdrawFrom(long anAccountId, double anAmount) throws AccountNotFoundException, NotEnoughFundsException, InactiveAccountException; + double withdrawFrom(long anAccountId, double anAmount) + throws AccountNotFoundException, NotEnoughFundsException, InactiveAccountException; TxLog[] getTxHistoryFor(long anAccountId) throws AccountNotFoundException; diff --git a/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/SecureBankService.java b/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/SecureBankService.java index 8b2529bb16..2706734d61 100644 --- a/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/SecureBankService.java +++ b/samples/aspectj/src/main/java/org/apache/shiro/samples/aspectj/bank/SecureBankService.java @@ -182,10 +182,9 @@ public double depositInto(long anAccountId, double anAmount) throws AccountNotFo /* (non-Javadoc) * @see com.connectif.trilogy.root.security.BankService#withdrawFrom(long, double) */ - - @SuppressWarnings("checkstyle:LineLength") @RequiresPermissions("bankAccount:operate") - public double withdrawFrom(long anAccountId, double anAmount) throws AccountNotFoundException, NotEnoughFundsException, InactiveAccountException { + public double withdrawFrom(long anAccountId, double anAmount) + throws AccountNotFoundException, NotEnoughFundsException, InactiveAccountException { assertServiceState(); LOGGER.info("Making withdrawal of " + anAmount + " from account " + anAccountId); diff --git a/samples/aspectj/src/test/java/org/apache/shiro/samples/aspectj/bank/SecureBankServiceTest.java b/samples/aspectj/src/test/java/org/apache/shiro/samples/aspectj/bank/SecureBankServiceTest.java index 805f381b1f..416e9e8a75 100644 --- a/samples/aspectj/src/test/java/org/apache/shiro/samples/aspectj/bank/SecureBankServiceTest.java +++ b/samples/aspectj/src/test/java/org/apache/shiro/samples/aspectj/bank/SecureBankServiceTest.java @@ -36,7 +36,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows; -@SuppressWarnings({"checkstyle:MemberName", "checkstyle:MethodName", "checkstyle:MagicNumber", "checkstyle:LineLength"}) +@SuppressWarnings({"checkstyle:MemberName", "checkstyle:MethodName", "checkstyle:MagicNumber"}) public class SecureBankServiceTest { private static Logger logger = LoggerFactory.getLogger(SecureBankServiceTest.class); @@ -244,7 +244,8 @@ protected double makeWithdrawalAndValidateAccount(long anAccountId, int anAmount } - public static void assertAccount(String eOwnerName, boolean eIsActive, int eBalance, int eTxLogCount, long actualAccountId) throws Exception { + public static void assertAccount(String eOwnerName, boolean eIsActive, int eBalance, + int eTxLogCount, long actualAccountId) throws Exception { Assertions.assertEquals(eOwnerName, service.getOwnerOf(actualAccountId)); Assertions.assertEquals(eIsActive, service.isAccountActive(actualAccountId)); Assertions.assertEquals(eBalance, (int) service.getBalanceOf(actualAccountId)); diff --git a/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroGuiceBootstrap.java b/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroGuiceBootstrap.java index 12334bb84b..c74ff9c7ca 100644 --- a/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroGuiceBootstrap.java +++ b/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroGuiceBootstrap.java @@ -21,11 +21,12 @@ import com.google.inject.Guice; import com.google.inject.Injector; import com.google.inject.servlet.GuiceServletContextListener; -import org.apache.shiro.guice.web.ShiroWebModule; import javax.servlet.ServletContext; import javax.servlet.ServletContextEvent; +import static org.apache.shiro.guice.web.ShiroWebModule.guiceFilterModule; + public class SampleShiroGuiceBootstrap extends GuiceServletContextListener { private ServletContext servletContext; @@ -36,10 +37,9 @@ public void contextInitialized(final ServletContextEvent servletContextEvent) { super.contextInitialized(servletContextEvent); } - @SuppressWarnings("checkstyle:LineLength") @Override protected Injector getInjector() { // return Guice.createInjector(new SampleShiroServletModule(servletContext), ShiroWebModule.guiceFilterModule()); - return Guice.createInjector(new SampleShiroNativeSessionsServletModule(servletContext), ShiroWebModule.guiceFilterModule()); + return Guice.createInjector(new SampleShiroNativeSessionsServletModule(servletContext), guiceFilterModule()); } } diff --git a/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroNativeSessionsServletModule.java b/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroNativeSessionsServletModule.java index 003228057e..b20bbdd5bc 100644 --- a/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroNativeSessionsServletModule.java +++ b/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroNativeSessionsServletModule.java @@ -21,10 +21,10 @@ import com.google.inject.Provides; import com.google.inject.binder.AnnotatedBindingBuilder; import com.google.inject.name.Names; -import org.apache.shiro.lang.codec.Base64; import org.apache.shiro.config.ConfigurationException; import org.apache.shiro.config.Ini; import org.apache.shiro.guice.web.ShiroWebModule; +import org.apache.shiro.lang.codec.Base64; import org.apache.shiro.realm.text.IniRealm; import org.apache.shiro.session.mgt.SessionManager; import org.apache.shiro.web.mgt.CookieRememberMeManager; @@ -48,7 +48,6 @@ public SampleShiroNativeSessionsServletModule(ServletContext servletContext) { this.servletContext = servletContext; } - @SuppressWarnings("checkstyle:LineLength") @Override protected void configureShiroWeb() { bindConstant().annotatedWith(Names.named("shiro.loginUrl")).to("/login.jsp"); @@ -61,7 +60,10 @@ protected void configureShiroWeb() { this.addFilterChain("/login.jsp", AUTHC); this.addFilterChain("/logout", LOGOUT); this.addFilterChain("/account/**", AUTHC); - this.addFilterChain("/remoting/**", filterConfig(AUTHC), filterConfig(ROLES, "b2bClient"), filterConfig(PERMS, "remote:invoke:lan,wan")); + this.addFilterChain("/account/**", + filterConfig(AUTHC), + filterConfig(ROLES, "b2bClient"), + filterConfig(PERMS, "remote:invoke:lan,wan")); } @Provides diff --git a/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java b/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java index 3826089072..21589161a4 100644 --- a/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java +++ b/samples/guice/src/main/java/org/apache/shiro/samples/guice/SampleShiroServletModule.java @@ -44,7 +44,6 @@ public SampleShiroServletModule(ServletContext servletContext) { this.servletContext = servletContext; } - @SuppressWarnings("checkstyle:LineLength") @Override protected void configureShiroWeb() { bindConstant().annotatedWith(Names.named("shiro.loginUrl")).to("/login.jsp"); @@ -58,7 +57,10 @@ protected void configureShiroWeb() { this.addFilterChain("/logout", LOGOUT); this.addFilterChain("/account/**", AUTHC); - this.addFilterChain("/remoting/**", filterConfig(AUTHC), filterConfig(ROLES, "b2bClient"), filterConfig(PERMS, "remote:invoke:lan,wan")); + this.addFilterChain("/remoting/**", + filterConfig(AUTHC), + filterConfig(ROLES, "b2bClient"), + filterConfig(PERMS, "remote:invoke:lan,wan")); } @Provides diff --git a/samples/spring-boot-web/README.md b/samples/spring-boot-web/README.md index b7045c3baa..621435cc95 100644 --- a/samples/spring-boot-web/README.md +++ b/samples/spring-boot-web/README.md @@ -1,8 +1,7 @@ Apache Shiro + Spring Web Example ================================= -A Spring Boot example web application that show the usage of a user login, checking permissions, and annotation -protected methods. +A Spring Boot example web application that show the usage of a user login, checking permissions, and annotation protected methods. Run the Example --------------- diff --git a/samples/spring-boot/README.md b/samples/spring-boot/README.md index e9961127b2..fa738cc6f6 100644 --- a/samples/spring-boot/README.md +++ b/samples/spring-boot/README.md @@ -1,8 +1,7 @@ Apache Shiro + Spring CLI Example ================================= -A Spring Boot example CLI application that show the usage of a user login, checking permissions, and annotation -protected methods. +A Spring Boot example CLI application that show the usage of a user login, checking permissions, and annotation protected methods. Run the Example --------------- diff --git a/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/CurrentUserInterceptor.java b/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/CurrentUserInterceptor.java index ed34d9350d..7c3c024430 100644 --- a/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/CurrentUserInterceptor.java +++ b/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/CurrentUserInterceptor.java @@ -43,9 +43,10 @@ public void setUserService(UserService userService) { this.userService = userService; } - @SuppressWarnings("checkstyle:LineLength") @Override - public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) + public void postHandle(HttpServletRequest httpServletRequest, + HttpServletResponse httpServletResponse, + Object obj, ModelAndView modelAndView) throws Exception { // Add the current user into the request User currentUser = userService.getCurrentUser(); diff --git a/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/ManageUsersController.java b/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/ManageUsersController.java index 131ea8e45e..80c9a16f02 100644 --- a/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/ManageUsersController.java +++ b/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/ManageUsersController.java @@ -37,7 +37,7 @@ @Controller public class ManageUsersController { - private EditUserValidator editUserValidator = new EditUserValidator(); + private final EditUserValidator editUserValidator = new EditUserValidator(); private UserService userService; @@ -63,10 +63,10 @@ public String showEditUserForm(Model model, @RequestParam Long userId, @ModelAtt return "editUser"; } - @SuppressWarnings("checkstyle:LineLength") @RequestMapping(value = "/editUser", method = RequestMethod.POST) @RequiresPermissions("user:edit") - public String editUser(Model model, @RequestParam Long userId, @ModelAttribute EditUserCommand command, BindingResult errors) { + public String editUser(Model model, @RequestParam Long userId, + @ModelAttribute EditUserCommand command, BindingResult errors) { editUserValidator.validate(command, errors); if (errors.hasErrors()) { diff --git a/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/SecurityController.java b/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/SecurityController.java index ea4eed8892..640ffbf736 100644 --- a/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/SecurityController.java +++ b/samples/spring-hibernate/src/main/java/org/apache/shiro/samples/sprhib/web/SecurityController.java @@ -41,7 +41,6 @@ public String showLoginForm(Model model, @ModelAttribute LoginCommand command) { return "login"; } - @SuppressWarnings("checkstyle:LineLength") @RequestMapping(value = "/login", method = RequestMethod.POST) public String login(Model model, @ModelAttribute LoginCommand command, BindingResult errors) { loginValidator.validate(command, errors); @@ -50,7 +49,8 @@ public String login(Model model, @ModelAttribute LoginCommand command, BindingRe return showLoginForm(model, command); } - UsernamePasswordToken token = new UsernamePasswordToken(command.getUsername(), command.getPassword(), command.isRememberMe()); + UsernamePasswordToken token = new UsernamePasswordToken(command.getUsername(), + command.getPassword(), command.isRememberMe()); try { SecurityUtils.getSubject().login(token); } catch (AuthenticationException e) { diff --git a/samples/spring-mvc/README.md b/samples/spring-mvc/README.md index 188e85cd14..ffba06f528 100644 --- a/samples/spring-mvc/README.md +++ b/samples/spring-mvc/README.md @@ -1,8 +1,7 @@ Apache Shiro + Spring Web Example ================================= -This example creates a web application (WAR packaged) to demonstrate configuring Apache Shiro via Spring. This example -also includes a Spring Remoting example. +This example creates a web application (WAR packaged) to demonstrate configuring Apache Shiro via Spring. This example also includes a Spring Remoting example. Run the Example --------------- diff --git a/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/BootstrapDataPopulator.java b/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/BootstrapDataPopulator.java index 1314c68346..d80cc8900f 100644 --- a/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/BootstrapDataPopulator.java +++ b/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/BootstrapDataPopulator.java @@ -26,12 +26,13 @@ import javax.sql.DataSource; -@SuppressWarnings({"checkstyle:LineLength", "checkstyle:ExplicitInitialization"}) /** * A data populator that creates a set of security tables and test data that can be used by the * Shiro Spring sample application to demonstrate the use of the {@link org.apache.shiro.realm.jdbc.JdbcRealm} - * The tables created by this class follow the default table and column names that {@link org.apache.shiro.realm.jdbc.JdbcRealm} uses. + * The tables created by this class follow the default table and column names that + * {@link org.apache.shiro.realm.jdbc.JdbcRealm} uses. */ +@SuppressWarnings("checkstyle:ExplicitInitialization") public class BootstrapDataPopulator implements InitializingBean { private static final String CREATE_TABLES = "create table users (\n" diff --git a/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/DefaultSampleManager.java b/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/DefaultSampleManager.java index 3f8f153db0..1585dac398 100644 --- a/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/DefaultSampleManager.java +++ b/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/DefaultSampleManager.java @@ -58,8 +58,6 @@ public class DefaultSampleManager implements SampleManager { /*-------------------------------------------- | M E T H O D S | ============================================*/ - - @SuppressWarnings("checkstyle:LineLength") public String getValue() { String value = null; @@ -68,20 +66,21 @@ public String getValue() { if (session != null) { value = (String) session.getAttribute(VALUE_KEY); if (LOGGER.isDebugEnabled()) { - LOGGER.debug("retrieving session key [" + VALUE_KEY + "] with value [" + value + "] on session with id [" + session.getId() + "]"); + LOGGER.debug("retrieving session key [" + VALUE_KEY + "] with value [" + + value + "] on session with id [" + session.getId() + "]"); } } return value; } - @SuppressWarnings("checkstyle:LineLength") public void setValue(String newValue) { Subject subject = SecurityUtils.getSubject(); Session session = subject.getSession(); if (LOGGER.isDebugEnabled()) { - LOGGER.debug("saving session key [" + VALUE_KEY + "] with value [" + newValue + "] on session with id [" + session.getId() + "]"); + LOGGER.debug("saving session key [" + VALUE_KEY + "] with value [" + + newValue + "] on session with id [" + session.getId() + "]"); } session.setAttribute(VALUE_KEY, newValue); diff --git a/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/realm/SaltAwareJdbcRealm.java b/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/realm/SaltAwareJdbcRealm.java index bbd67b29d6..cd911874a2 100644 --- a/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/realm/SaltAwareJdbcRealm.java +++ b/samples/spring-mvc/src/main/java/org/apache/shiro/samples/spring/realm/SaltAwareJdbcRealm.java @@ -91,7 +91,6 @@ protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) return info; } - @SuppressWarnings("checkstyle:LineLength") private String getPasswordForUser(Connection conn, String username) throws SQLException { PreparedStatement ps = null; @@ -110,7 +109,8 @@ private String getPasswordForUser(Connection conn, String username) throws SQLEx // Check to ensure only one row is processed if (foundResult) { - throw new AuthenticationException("More than one user row found for user [" + username + "]. Usernames must be unique."); + throw new AuthenticationException("More than one user row found for user [" + + username + "]. Usernames must be unique."); } password = rs.getString(1); diff --git a/samples/spring-mvc/src/main/resources/application.properties b/samples/spring-mvc/src/main/resources/application.properties index e1623ac6f6..f78b8fdc67 100644 --- a/samples/spring-mvc/src/main/resources/application.properties +++ b/samples/spring-mvc/src/main/resources/application.properties @@ -16,10 +16,13 @@ # specific language governing permissions and limitations # under the License. # + # Let Shiro Manage the sessions -shiro.userNativeSessionManager=true +shiro.userNativeSessionManager = true + # disable URL session rewriting -shiro.sessionManager.sessionIdUrlRewritingEnabled=false -shiro.loginUrl=/s/login -shiro.successUrl=/s/index -shiro.unauthorizedUrl=/s/unauthorized +shiro.sessionManager.sessionIdUrlRewritingEnabled = false + +shiro.loginUrl = /s/login +shiro.successUrl = /s/index +shiro.unauthorizedUrl = /s/unauthorized diff --git a/samples/spring-mvc/src/main/resources/ehcache.xml b/samples/spring-mvc/src/main/resources/ehcache.xml index f047641b7d..eb3504d41c 100644 --- a/samples/spring-mvc/src/main/resources/ehcache.xml +++ b/samples/spring-mvc/src/main/resources/ehcache.xml @@ -72,7 +72,7 @@ java.io.tmpdir - Default temp file path --> overflowToDisk="false" diskPersistent="false" diskExpiryThreadIntervalSeconds="120" - /> + /> ]]> $]]> @@ -32,8 +32,8 @@ /* - * - */ + * + */ (\s|\t)*/\*.*$ @@ -44,7 +44,7 @@ - ~ + ~ ]]> (\s|\t)*$]]> diff --git a/support/aspectj/src/main/java/org/apache/shiro/aspectj/AspectjAnnotationsAuthorizingMethodInterceptor.java b/support/aspectj/src/main/java/org/apache/shiro/aspectj/AspectjAnnotationsAuthorizingMethodInterceptor.java index 3c04686347..5a8f5e26b6 100644 --- a/support/aspectj/src/main/java/org/apache/shiro/aspectj/AspectjAnnotationsAuthorizingMethodInterceptor.java +++ b/support/aspectj/src/main/java/org/apache/shiro/aspectj/AspectjAnnotationsAuthorizingMethodInterceptor.java @@ -46,13 +46,13 @@ public class AspectjAnnotationsAuthorizingMethodInterceptor extends AnnotationsA * @param aJoinPoint The joint point to intercept. * @throws Throwable If an error occurs performing the method invocation. */ - @SuppressWarnings("checkstyle:LineLength") protected void performBeforeInterception(JoinPoint aJoinPoint) throws Throwable { if (LOGGER.isTraceEnabled()) { LOGGER.trace("#### Invoking a method decorated with a Shiro annotation" + "\n\tkind : " + aJoinPoint.getKind() + "\n\tjoinPoint : " + aJoinPoint - + "\n\tannotations: " + Arrays.toString(((MethodSignature) aJoinPoint.getSignature()).getMethod().getAnnotations()) + + "\n\tannotations: " + + Arrays.toString(((MethodSignature) aJoinPoint.getSignature()).getMethod().getAnnotations()) + "\n\ttarget : " + aJoinPoint.getTarget() ); } diff --git a/support/aspectj/src/test/java/org/apache/shiro/aspectj/SecuredDummyService.java b/support/aspectj/src/test/java/org/apache/shiro/aspectj/SecuredDummyService.java index 00891c9f0a..8682ff7132 100644 --- a/support/aspectj/src/test/java/org/apache/shiro/aspectj/SecuredDummyService.java +++ b/support/aspectj/src/test/java/org/apache/shiro/aspectj/SecuredDummyService.java @@ -57,10 +57,10 @@ public void retrieve() { log("retrieve"); } - @SuppressWarnings("checkstyle:LineLength") public void log(String aMessage) { if (aMessage != null) { - System.out.println(new Timestamp(System.currentTimeMillis()).toString() + " [" + Thread.currentThread() + "] * LOG * " + aMessage); + System.out.println(new Timestamp(System.currentTimeMillis()) + + " [" + Thread.currentThread() + "] * LOG * " + aMessage); } else { System.out.println("\n\n"); } diff --git a/support/ehcache/src/main/resources/org/apache/shiro/cache/ehcache/ehcache.xml b/support/ehcache/src/main/resources/org/apache/shiro/cache/ehcache/ehcache.xml index e8ffeb51f2..fad756a082 100644 --- a/support/ehcache/src/main/resources/org/apache/shiro/cache/ehcache/ehcache.xml +++ b/support/ehcache/src/main/resources/org/apache/shiro/cache/ehcache/ehcache.xml @@ -70,7 +70,7 @@ overflowToDisk="false" diskPersistent="false" diskExpiryThreadIntervalSeconds="120" - /> + /> + xmlns="http://xmlns.jcp.org/xml/ns/javaee" + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facelettaglibrary_2_3.xsd"> http://shiro.apache.org/tags diff --git a/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/AnnotationAuthorizationFilter.java b/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/AnnotationAuthorizationFilter.java index 9207b905c7..4e2421aa2a 100644 --- a/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/AnnotationAuthorizationFilter.java +++ b/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/AnnotationAuthorizationFilter.java @@ -56,9 +56,9 @@ public class AnnotationAuthorizationFilter implements ContainerRequestFilter { private final Map authzChecks; - @SuppressWarnings("checkstyle:LineLength") public AnnotationAuthorizationFilter(Collection authzSpecs) { - Map authChecks = new HashMap(authzSpecs.size()); + Map authChecks = + new HashMap(authzSpecs.size()); for (Annotation authSpec : authzSpecs) { authChecks.put(createHandler(authSpec), authSpec); } diff --git a/support/quartz/src/main/java/org/apache/shiro/session/mgt/quartz/QuartzSessionValidationScheduler.java b/support/quartz/src/main/java/org/apache/shiro/session/mgt/quartz/QuartzSessionValidationScheduler.java index 053816cb4b..3a11a71bf3 100644 --- a/support/quartz/src/main/java/org/apache/shiro/session/mgt/quartz/QuartzSessionValidationScheduler.java +++ b/support/quartz/src/main/java/org/apache/shiro/session/mgt/quartz/QuartzSessionValidationScheduler.java @@ -36,10 +36,9 @@ import static org.quartz.SimpleScheduleBuilder.simpleSchedule; -@SuppressWarnings("checkstyle:LineLength") /** - * An implementation of the {@link org.apache.shiro.session.mgt.SessionValidationScheduler SessionValidationScheduler} that uses Quartz to schedule a - * job to call {@link org.apache.shiro.session.mgt.ValidatingSessionManager#validateSessions()} on + * An implementation of the {@link org.apache.shiro.session.mgt.SessionValidationScheduler SessionValidationScheduler} + * that uses Quartz to schedule a job to call {@link org.apache.shiro.session.mgt.ValidatingSessionManager#validateSessions()} on * a regular basis. * * @since 0.1 @@ -134,7 +133,7 @@ public boolean isEnabled() { /** * Specifies how frequently (in milliseconds) this Scheduler will call the - * {@link org.apache.shiro.session.mgt.ValidatingSessionManager#validateSessions() ValidatingSessionManager#validateSessions()} method. + * {@link ValidatingSessionManager#validateSessions() ValidatingSessionManager#validateSessions()} method. * *

    Unless this method is called, the default value is {@link #DEFAULT_SESSION_VALIDATION_INTERVAL}. * diff --git a/support/spring-boot/spring-boot-starter/src/main/java/org/apache/shiro/spring/config/web/autoconfigure/ShiroWebFilterConfiguration.java b/support/spring-boot/spring-boot-starter/src/main/java/org/apache/shiro/spring/config/web/autoconfigure/ShiroWebFilterConfiguration.java index 8eeeb12b29..9a103a280c 100644 --- a/support/spring-boot/spring-boot-starter/src/main/java/org/apache/shiro/spring/config/web/autoconfigure/ShiroWebFilterConfiguration.java +++ b/support/spring-boot/spring-boot-starter/src/main/java/org/apache/shiro/spring/config/web/autoconfigure/ShiroWebFilterConfiguration.java @@ -55,13 +55,13 @@ protected ShiroFilterFactoryBean shiroFilterFactoryBean() { return super.shiroFilterFactoryBean(); } - @SuppressWarnings("checkstyle:LineLength") @Bean(name = REGISTRATION_BEAN_NAME) @ConditionalOnMissingBean(name = REGISTRATION_BEAN_NAME) protected FilterRegistrationBean filterShiroFilterRegistrationBean() throws Exception { FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean<>(); - filterRegistrationBean.setDispatcherTypes(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.INCLUDE, DispatcherType.ERROR); + filterRegistrationBean.setDispatcherTypes(DispatcherType.REQUEST, DispatcherType.FORWARD, + DispatcherType.INCLUDE, DispatcherType.ERROR); filterRegistrationBean.setFilter((AbstractShiroFilter) shiroFilterFactoryBean().getObject()); filterRegistrationBean.setName(FILTER_NAME); filterRegistrationBean.setOrder(1); diff --git a/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json b/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json index c044287156..5ef21158f5 100644 --- a/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json +++ b/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/additional-spring-configuration-metadata.json @@ -5,6 +5,7 @@ } ], "properties": [ + { "name": "shiro.enabled", "type": "java.lang.Boolean", diff --git a/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/spring.factories b/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/spring.factories index f4988fd2ed..42451ea18c 100644 --- a/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/spring.factories +++ b/support/spring-boot/spring-boot-starter/src/main/resources/META-INF/spring.factories @@ -1,4 +1,5 @@ -org.springframework.boot.diagnostics.FailureAnalyzer=\ +org.springframework.boot.diagnostics.FailureAnalyzer = \ org.apache.shiro.spring.boot.autoconfigure.ShiroNoRealmConfiguredFailureAnalyzer + org.springframework.boot.env.EnvironmentPostProcessor=\ org.apache.shiro.spring.config.web.autoconfigure.ShiroEnvironmentPostProcessor \ No newline at end of file diff --git a/support/spring-boot/spring-boot-starter/src/test/resources/logback.xml b/support/spring-boot/spring-boot-starter/src/test/resources/logback.xml index 24f64a645f..19d7e2461f 100644 --- a/support/spring-boot/spring-boot-starter/src/test/resources/logback.xml +++ b/support/spring-boot/spring-boot-starter/src/test/resources/logback.xml @@ -30,23 +30,23 @@ - + - + - + - + - + - + diff --git a/support/spring/src/main/java/org/apache/shiro/spring/ShiroEventBusBeanPostProcessor.java b/support/spring/src/main/java/org/apache/shiro/spring/ShiroEventBusBeanPostProcessor.java index c12d5fe388..fdbe833ed9 100644 --- a/support/spring/src/main/java/org/apache/shiro/spring/ShiroEventBusBeanPostProcessor.java +++ b/support/spring/src/main/java/org/apache/shiro/spring/ShiroEventBusBeanPostProcessor.java @@ -28,14 +28,14 @@ import java.util.List; -@SuppressWarnings("checkstyle:LineLength") /** - * Spring {@link BeanPostProcessor} that detects, {@link EventBusAware} and classes containing {@link Subscribe @Subscribe} methods. - * Any classes implementing EventBusAware will have the setEventBus() method called with the eventBus. Any - * classes discovered with methods that are annotated with @Subscribe will be automatically registered with the EventBus. + * Spring {@link BeanPostProcessor} that detects, {@link EventBusAware} and classes containing + * {@link Subscribe @Subscribe} methods. Any classes implementing EventBusAware will have the setEventBus() method + * called with the eventBus. Any classes discovered with methods that are annotated + * with @Subscribe will be automatically registered with the EventBus. * - *

    NOTE: in a Spring environment implementing EventBusAware is not necessary, as you can just inject the EventBus with - * {@link org.springframework.beans.factory.annotation.Autowire @Autowire}.

    + *

    NOTE: in a Spring environment implementing EventBusAware is not necessary, + * as you can just inject the EventBus with {@link org.springframework.beans.factory.annotation.Autowire @Autowire}.

    * * @see EventBusAware * @see Subscribe diff --git a/support/spring/src/main/java/org/apache/shiro/spring/security/interceptor/AopAllianceAnnotationsAuthorizingMethodInterceptor.java b/support/spring/src/main/java/org/apache/shiro/spring/security/interceptor/AopAllianceAnnotationsAuthorizingMethodInterceptor.java index 746b90cd88..96535d0326 100644 --- a/support/spring/src/main/java/org/apache/shiro/spring/security/interceptor/AopAllianceAnnotationsAuthorizingMethodInterceptor.java +++ b/support/spring/src/main/java/org/apache/shiro/spring/security/interceptor/AopAllianceAnnotationsAuthorizingMethodInterceptor.java @@ -95,13 +95,12 @@ public Object getThis() { }; } - @SuppressWarnings("checkstyle:LineLength") /** * Simply casts the method argument to an * {@link org.aopalliance.intercept.MethodInvocation org.aopalliance.intercept.MethodInvocation} and then * calls methodInvocation.{@link org.aopalliance.intercept.MethodInvocation#proceed proceed}() * - * @param aopAllianceMethodInvocation the {@link org.aopalliance.intercept.MethodInvocation org.aopalliance.intercept.MethodInvocation} + * @param aopAllianceMethodInvocation the {@link MethodInvocation org.aopalliance.intercept.MethodInvocation} * @return the {@link org.aopalliance.intercept.MethodInvocation#proceed() * org.aopalliance.intercept.MethodInvocation.proceed()} method call result. * @throws Throwable if the underlying AOP Alliance proceed() call throws a Throwable. diff --git a/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java b/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java index a73c90fc57..2defde5d21 100644 --- a/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java +++ b/support/spring/src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebConfiguration.java @@ -38,7 +38,6 @@ /** * @since 1.4.0 */ -@SuppressWarnings("checkstyle:LineLength") public class AbstractShiroWebConfiguration extends AbstractShiroConfiguration { @Value("#{ @environment['shiro.sessionManager.sessionIdCookieEnabled'] ?: true }") @@ -50,12 +49,13 @@ public class AbstractShiroWebConfiguration extends AbstractShiroConfiguration { @Value("#{ @environment['shiro.userNativeSessionManager'] ?: false }") protected boolean useNativeSessionManager; - // Session Cookie info - @Value("#{ @environment['shiro.sessionManager.cookie.name'] ?: T(org.apache.shiro.web.servlet.ShiroHttpSession).DEFAULT_SESSION_ID_NAME }") + @Value("#{ @environment['shiro.sessionManager.cookie.name'] ?:" + + " T(org.apache.shiro.web.servlet.ShiroHttpSession).DEFAULT_SESSION_ID_NAME }") protected String sessionIdCookieName; - @Value("#{ @environment['shiro.sessionManager.cookie.maxAge'] ?: T(org.apache.shiro.web.servlet.SimpleCookie).DEFAULT_MAX_AGE }") + @Value("#{ @environment['shiro.sessionManager.cookie.maxAge'] ?:" + + " T(org.apache.shiro.web.servlet.SimpleCookie).DEFAULT_MAX_AGE }") protected int sessionIdCookieMaxAge; @Value("#{ @environment['shiro.sessionManager.cookie.domain'] ?: null }") @@ -67,13 +67,15 @@ public class AbstractShiroWebConfiguration extends AbstractShiroConfiguration { @Value("#{ @environment['shiro.sessionManager.cookie.secure'] ?: false }") protected boolean sessionIdCookieSecure; - @Value("#{ @environment['shiro.sessionManager.cookie.sameSite'] ?: T(org.apache.shiro.web.servlet.Cookie.SameSiteOptions).LAX }") + @Value("#{ @environment['shiro.sessionManager.cookie.sameSite'] ?:" + + " T(org.apache.shiro.web.servlet.Cookie.SameSiteOptions).LAX }") protected Cookie.SameSiteOptions sessionIdCookieSameSite; // RememberMe Cookie info - @Value("#{ @environment['shiro.rememberMeManager.cookie.name'] ?: T(org.apache.shiro.web.mgt.CookieRememberMeManager).DEFAULT_REMEMBER_ME_COOKIE_NAME }") + @Value("#{ @environment['shiro.rememberMeManager.cookie.name'] ?:" + + " T(org.apache.shiro.web.mgt.CookieRememberMeManager).DEFAULT_REMEMBER_ME_COOKIE_NAME }") protected String rememberMeCookieName; @Value("#{ @environment['shiro.rememberMeManager.cookie.maxAge'] ?: T(org.apache.shiro.web.servlet.Cookie).ONE_YEAR }") @@ -88,7 +90,8 @@ public class AbstractShiroWebConfiguration extends AbstractShiroConfiguration { @Value("#{ @environment['shiro.rememberMeManager.cookie.secure'] ?: false }") protected boolean rememberMeCookieSecure; - @Value("#{ @environment['shiro.rememberMeManager.cookie.sameSite'] ?: T(org.apache.shiro.web.servlet.Cookie.SameSiteOptions).LAX }") + @Value("#{ @environment['shiro.rememberMeManager.cookie.sameSite'] ?:" + + " T(org.apache.shiro.web.servlet.Cookie.SameSiteOptions).LAX }") protected Cookie.SameSiteOptions rememberMeSameSite; @@ -129,7 +132,8 @@ protected Cookie buildCookie(String name, int maxAge, String path, String domain return buildCookie(name, maxAge, path, domain, secure, Cookie.SameSiteOptions.LAX); } - protected Cookie buildCookie(String name, int maxAge, String path, String domain, boolean secure, Cookie.SameSiteOptions sameSiteOption) { + protected Cookie buildCookie(String name, int maxAge, String path, String domain, + boolean secure, Cookie.SameSiteOptions sameSiteOption) { Cookie cookie = new SimpleCookie(name); cookie.setHttpOnly(true); cookie.setMaxAge(maxAge); diff --git a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroBeanConfigurationTest.groovy b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroBeanConfigurationTest.groovy index 5dcd527c81..cd21cf1402 100644 --- a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroBeanConfigurationTest.groovy +++ b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroBeanConfigurationTest.groovy @@ -57,4 +57,5 @@ public class ShiroBeanConfigurationTest { } + } diff --git a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroConfigurationTest.groovy b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroConfigurationTest.groovy index 3a5e61aa1e..2137df7c7a 100644 --- a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroConfigurationTest.groovy +++ b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroConfigurationTest.groovy @@ -58,7 +58,7 @@ class ShiroConfigurationTest extends AbstractJUnit4SpringContextTests { assertThat securityManager.realms, allOf(hasSize(1), hasItem(instanceOf(TextConfigurationRealm))) assertNull securityManager.cacheManager - assertSame(((DefaultSecurityManager) securityManager).getEventBus(), eventBus) + assertSame(((DefaultSecurityManager)securityManager).getEventBus(), eventBus) def defaultSecurityManager = (DefaultSecurityManager) securityManager def authorizer = (ModularRealmAuthorizer) defaultSecurityManager.getAuthorizer(); diff --git a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebConfigurationTest.groovy b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebConfigurationTest.groovy index df1aaae12a..3382b0e038 100644 --- a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebConfigurationTest.groovy +++ b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebConfigurationTest.groovy @@ -68,7 +68,7 @@ class ShiroWebConfigurationTest extends AbstractJUnit4SpringContextTests { assertNotNull shiroFilterFactoryBean assertThat shiroFilterFactoryBean.filters, anEmptyMap() - assertSame(((DefaultSecurityManager) securityManager).getEventBus(), eventBus) + assertSame(((DefaultSecurityManager)securityManager).getEventBus(), eventBus) def defaultSecurityManager = (DefaultSecurityManager) securityManager def authorizer = (ModularRealmAuthorizer) defaultSecurityManager.getAuthorizer(); diff --git a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebFilterConfigurationTest.groovy b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebFilterConfigurationTest.groovy index b7623ae899..5c6ee9f504 100644 --- a/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebFilterConfigurationTest.groovy +++ b/support/spring/src/test/groovy/org/apache/shiro/spring/config/ShiroWebFilterConfigurationTest.groovy @@ -96,8 +96,7 @@ class ShiroWebFilterConfigurationTest extends AbstractJUnit4SpringContextTests { void init(FilterConfig filterConfig) throws ServletException {} @Override - void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { - } + void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {} @Override void destroy() {} diff --git a/support/spring/src/test/java/org/apache/shiro/spring/web/DummyFilter.java b/support/spring/src/test/java/org/apache/shiro/spring/web/DummyFilter.java index 887c2bccd7..d384c1f9e3 100644 --- a/support/spring/src/test/java/org/apache/shiro/spring/web/DummyFilter.java +++ b/support/spring/src/test/java/org/apache/shiro/spring/web/DummyFilter.java @@ -33,7 +33,7 @@ * Time: 4:44:21 PM * To change this template use File | Settings | File Templates. */ -@SuppressWarnings("checkstyle:LineLength") + public class DummyFilter implements Filter { public DummyFilter() { @@ -43,7 +43,8 @@ public void init(FilterConfig filterConfig) throws ServletException { //no-op } - public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + public void doFilter(ServletRequest request, ServletResponse response, + FilterChain chain) throws IOException, ServletException { chain.doFilter(request, response); } diff --git a/support/spring/src/test/java/org/apache/shiro/spring/web/ShiroFilterFactoryBeanTest.java b/support/spring/src/test/java/org/apache/shiro/spring/web/ShiroFilterFactoryBeanTest.java index 393e363073..23c504ea59 100644 --- a/support/spring/src/test/java/org/apache/shiro/spring/web/ShiroFilterFactoryBeanTest.java +++ b/support/spring/src/test/java/org/apache/shiro/spring/web/ShiroFilterFactoryBeanTest.java @@ -82,7 +82,6 @@ void testFilterDefinition() { * * @throws Exception if there is any unexpected error */ - @SuppressWarnings("checkstyle:LineLength") @Test void testFilterDefinitionWithInit() throws Exception { @@ -106,7 +105,8 @@ void testFilterDefinitionWithInit() throws Exception { verify(mockFilterConfig); FilterChain filterChain = new FilterChain() { - public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse) throws IOException, ServletException { + public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse) + throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; assertNotNull(request.getSession()); //this line asserts the fix for the user-reported issue: diff --git a/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/AbstractAuthorizationAnnotationTest-context.xml b/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/AbstractAuthorizationAnnotationTest-context.xml index 38e2e4e59c..fb0f8e417c 100644 --- a/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/AbstractAuthorizationAnnotationTest-context.xml +++ b/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/AbstractAuthorizationAnnotationTest-context.xml @@ -1,48 +1,48 @@ - - - - - - - - - - test = test, test - - - - - - - - - - - - + + + + + + + + + + test = test, test + + + + + + + + + + + + diff --git a/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/DapcAuthorizationAnnotationTest-context.xml b/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/DapcAuthorizationAnnotationTest-context.xml index 9a966e9b39..92c98e41a7 100644 --- a/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/DapcAuthorizationAnnotationTest-context.xml +++ b/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/DapcAuthorizationAnnotationTest-context.xml @@ -1,35 +1,35 @@ - - - - - - - - - - - - + + + + + + + + + + + + diff --git a/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/SchemaAuthorizationAnnotationTest-context.xml b/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/SchemaAuthorizationAnnotationTest-context.xml index 10147bc9c3..98445e3004 100644 --- a/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/SchemaAuthorizationAnnotationTest-context.xml +++ b/support/spring/src/test/resources/org/apache/shiro/spring/security/interceptor/SchemaAuthorizationAnnotationTest-context.xml @@ -1,51 +1,51 @@ - - - - - - - - - - - - - + + + + + + + + + + + + + \ No newline at end of file diff --git a/support/spring/src/test/resources/org/apache/shiro/spring/web/config/ShiroWebConfigurationTestSameSiteStrict.properties b/support/spring/src/test/resources/org/apache/shiro/spring/web/config/ShiroWebConfigurationTestSameSiteStrict.properties index a61f663d65..ffe22c49fb 100644 --- a/support/spring/src/test/resources/org/apache/shiro/spring/web/config/ShiroWebConfigurationTestSameSiteStrict.properties +++ b/support/spring/src/test/resources/org/apache/shiro/spring/web/config/ShiroWebConfigurationTestSameSiteStrict.properties @@ -16,5 +16,6 @@ # specific language governing permissions and limitations # under the License. # -shiro.sessionManager.cookie.sameSite=STRICT -shiro.rememberMeManager.cookie.sameSite=STRICT + +shiro.sessionManager.cookie.sameSite = STRICT +shiro.rememberMeManager.cookie.sameSite = STRICT diff --git a/tools/hasher/src/main/java/org/apache/shiro/tools/hasher/Hasher.java b/tools/hasher/src/main/java/org/apache/shiro/tools/hasher/Hasher.java index 90e155f940..f9bdb58809 100644 --- a/tools/hasher/src/main/java/org/apache/shiro/tools/hasher/Hasher.java +++ b/tools/hasher/src/main/java/org/apache/shiro/tools/hasher/Hasher.java @@ -64,7 +64,6 @@ * * @since 1.2 */ -@SuppressWarnings("checkstyle:LineLength") public final class Hasher { private static final Logger LOG = LoggerFactory.getLogger(Hasher.class); @@ -77,30 +76,35 @@ public final class Hasher { private static final int DEFAULT_PASSWORD_NUM_ITERATIONS = Argon2HashProvider.Parameters.DEFAULT_ITERATIONS; private static final Option ALGORITHM = - new Option("a", "algorithm", true, "hash algorithm name. Defaults to Argon2 when password hashing, SHA-512 otherwise."); + new Option("a", "algorithm", true, + "hash algorithm name. Defaults to Argon2 when password hashing, SHA-512 otherwise."); private static final Option DEBUG = new Option("d", "debug", false, "show additional error (stack trace) information."); private static final Option FORMAT = new Option("f", "format", true, "hash output format. Defaults to 'shiro2' when password hashing, 'hex' otherwise. See below for more information."); private static final Option HELP = new Option("help", "help", false, "show this help message."); - private static final Option ITERATIONS = new Option("i", "iterations", true, - "number of hash iterations. Defaults to " + DEFAULT_PASSWORD_NUM_ITERATIONS + " when password hashing, 1 otherwise."); + private static final Option ITERATIONS = new Option("i", "iterations", true, "number of hash iterations. Defaults to " + + DEFAULT_PASSWORD_NUM_ITERATIONS + " when password hashing, 1 otherwise."); private static final Option PASSWORD = new Option("p", "password", false, "hash a password (disable typing echo)"); private static final Option PASSWORD_NC = - new Option("pnc", "pnoconfirm", false, "hash a password (disable typing echo) but disable password confirmation prompt."); + new Option("pnc", "pnoconfirm", false, "hash a password (disable typing echo)" + + " but disable password confirmation prompt."); private static final Option RESOURCE = new Option("r", "resource", false, "read and hash the resource located at . See below for more information."); private static final Option SALT = new Option("s", "salt", true, "use the specified salt. is plaintext."); private static final Option SALT_BYTES = new Option("sb", "saltbytes", true, "use the specified salt bytes. is hex or base64 encoded text."); private static final Option SALT_GEN = - new Option("gs", "gensalt", false, "generate and use a random salt. Defaults to true when password hashing, false otherwise."); + new Option("gs", "gensalt", false, + "generate and use a random salt. Defaults to true when password hashing, false otherwise."); private static final Option NO_SALT_GEN = new Option("ngs", "nogensalt", false, "do NOT generate and use a random salt (valid during password hashing)."); private static final Option SALT_GEN_SIZE = new Option("gss", "gensaltsize", true, "the number of salt bits (not bytes!) to generate. Defaults to 128."); - private static final Option PRIVATE_SALT = new Option("ps", "privatesalt", true, "use the specified private salt. is plaintext."); + private static final Option PRIVATE_SALT = new Option("ps", "privatesalt", true, + "use the specified private salt. is plaintext."); private static final Option PRIVATE_SALT_BYTES = - new Option("psb", "privatesaltbytes", true, "use the specified private salt bytes. is hex or base64 encoded text."); + new Option("psb", "privatesaltbytes", true, + "use the specified private salt bytes. is hex or base64 encoded text."); private static final String SALT_MUTEX_MSG = createMutexMessage(SALT, SALT_BYTES); @@ -117,7 +121,8 @@ public final class Hasher { private Hasher() { } - @SuppressWarnings({"checkstyle:CyclomaticComplexity", "checkstyle:MethodLength", "checkstyle:NPathComplexity", "checkstyle:MagicNumber"}) + @SuppressWarnings({"checkstyle:CyclomaticComplexity", "checkstyle:NPathComplexity", + "checkstyle:MagicNumber", "checkstyle:MethodLength"}) public static void main(String[] args) { CommandLineParser parser = new DefaultParser(); @@ -190,7 +195,8 @@ public static void main(String[] args) { generateSalt = true; generatedSaltSize = getRequiredPositiveInt(line, SALT_GEN_SIZE); if (generatedSaltSize % 8 != 0) { - throw new IllegalArgumentException("Generated salt size must be a multiple of 8 (e.g. 128, 192, 256, 512, etc.)."); + throw new IllegalArgumentException("Generated salt size must be" + + "a multiple of 8 (e.g. 128, 192, 256, 512, etc.)."); } } if (line.hasOption(PRIVATE_SALT.getOpt())) { @@ -476,7 +482,8 @@ private static char[] readPassword(boolean confirm) throws IOException { String readLine = br.readLine(); first = readLine.toCharArray(); } else { - throw new IllegalStateException("java.io.Console and java.lang.System.in are not available on the current JVM. Cannot read passwords."); + throw new IllegalStateException("java.io.Console and java.lang.System.in are not available on the current JVM." + + " Cannot read passwords."); } if (first == null || first.length == 0) { diff --git a/web/src/main/java/org/apache/shiro/web/config/ShiroFilterConfiguration.java b/web/src/main/java/org/apache/shiro/web/config/ShiroFilterConfiguration.java index b73da99697..87a2729942 100644 --- a/web/src/main/java/org/apache/shiro/web/config/ShiroFilterConfiguration.java +++ b/web/src/main/java/org/apache/shiro/web/config/ShiroFilterConfiguration.java @@ -18,6 +18,8 @@ */ package org.apache.shiro.web.config; +import org.apache.shiro.SecurityUtils; + /** * Configuration for Shiro's root level servlet filter. * @@ -50,7 +52,6 @@ public void setFilterOncePerRequest(boolean filterOncePerRequest) { this.filterOncePerRequest = filterOncePerRequest; } - @SuppressWarnings("checkstyle:LineLength") /** * Returns {@code true} if the constructed {@link SecurityManager SecurityManager} associated with the filter * should be bound to static memory (via @@ -70,16 +71,17 @@ public boolean isStaticSecurityManagerEnabled() { return staticSecurityManagerEnabled; } - @SuppressWarnings("checkstyle:LineLength") /** * Sets if the constructed {@link SecurityManager SecurityManager} associated with the filter should be bound - * to static memory (via {@code SecurityUtils.}{@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}). + * to static memory (via {@code SecurityUtils.} + * {@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}). *

    * The default value is {@code false}. * * @param staticSecurityManagerEnabled if the constructed {@link SecurityManager SecurityManager} associated with the filter - * should be bound to static memory (via - * {@code SecurityUtils.}{@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}). + * should be bound to static memory (via + * {@code SecurityUtils.} + * {@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}). * @see SHIRO-287 */ public ShiroFilterConfiguration setStaticSecurityManagerEnabled(boolean staticSecurityManagerEnabled) { diff --git a/web/src/main/java/org/apache/shiro/web/env/EnvironmentLoader.java b/web/src/main/java/org/apache/shiro/web/env/EnvironmentLoader.java index bf834c3259..7d265de562 100644 --- a/web/src/main/java/org/apache/shiro/web/env/EnvironmentLoader.java +++ b/web/src/main/java/org/apache/shiro/web/env/EnvironmentLoader.java @@ -237,11 +237,11 @@ protected Class getDefaultWebEnvironmentClass(ServletC return IniWebEnvironment.class; } - @SuppressWarnings("checkstyle:LineLength") /** * Return the WebEnvironment implementation class to use, based on the order of: *

      - *
    • A custom WebEnvironment class - specified in the {@code servletContext} {@link #ENVIRONMENT_ATTRIBUTE_KEY} property
      • + *
    • A custom WebEnvironment class + * - specified in the {@code servletContext} {@link #ENVIRONMENT_ATTRIBUTE_KEY} property
      • *
    • {@code ServiceLoader.load(WebEnvironment.class)} - * (if more then one instance is found a {@link ConfigurationException} will be thrown
      • *
    • A call to {@link #getDefaultWebEnvironmentClass(ServletContext)} (default: {@link IniWebEnvironment})
      • diff --git a/web/src/main/java/org/apache/shiro/web/env/IniWebEnvironment.java b/web/src/main/java/org/apache/shiro/web/env/IniWebEnvironment.java index cb7cb02306..da02f19980 100644 --- a/web/src/main/java/org/apache/shiro/web/env/IniWebEnvironment.java +++ b/web/src/main/java/org/apache/shiro/web/env/IniWebEnvironment.java @@ -145,7 +145,6 @@ protected void configure() { } } - @SuppressWarnings("checkstyle:LineLength") /** * Extension point to allow subclasses to provide an {@link Ini} configuration that will be merged into the * users configuration. The users configuration will override anything set here. @@ -171,7 +170,8 @@ protected void configure() { * realm.foobarSpecificField = A string * *

      - * This may cause a configuration error if MyCustomRealm does not contain the field foobarSpecificField. + * This may cause a configuration error if MyCustomRealmfoobarSpecificField. * This can be avoided if the Framework Ini uses more unique names, such as foobarRealm. which would result * in a merged configuration that looks like: * 

      
@@ -333,12 +333,11 @@ protected String[] getDefaultConfigLocations() {
         };
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Converts the specified file path to an {@link Ini} instance.
      * 
      
-     * If the path does not have a resource prefix as defined by {@link org.apache.shiro.lang.io.ResourceUtils#hasResourcePrefix(String)}, the
-     * path is expected to be resolvable by the {@code ServletContext} via
+     * If the path does not have a resource prefix as defined by {@link ResourceUtils#hasResourcePrefix(String)},
+     * the path is expected to be resolvable by the {@code ServletContext} via
      * {@link javax.servlet.ServletContext#getResourceAsStream(String)}.
      *
      * @param path     the path of the INI resource to load into an INI instance.
diff --git a/web/src/main/java/org/apache/shiro/web/filter/AccessControlFilter.java b/web/src/main/java/org/apache/shiro/web/filter/AccessControlFilter.java
index f7f1c40054..65ec890cc5 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/AccessControlFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/AccessControlFilter.java
@@ -111,8 +111,8 @@ protected Subject getSubject(ServletRequest request, ServletResponse response) {
      * {@link #onAccessDenied(ServletRequest, ServletResponse, Object)} method instead.
      * @throws Exception if an error occurs during processing.
      */
-    @SuppressWarnings("checkstyle:LineLength")
-    protected abstract boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception;
+    protected abstract boolean isAccessAllowed(ServletRequest request, ServletResponse response,
+                                               Object mappedValue) throws Exception;
 
     /**
      * Processes requests where the subject was denied access as determined by the
@@ -178,12 +178,12 @@ protected boolean isLoginRequest(ServletRequest request, ServletResponse respons
         return pathsMatch(getLoginUrl(), request);
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
+
     /**
      * Convenience method for subclasses to use when a login redirect is required.
      * 
      
      * This implementation simply calls {@link #saveRequest(javax.servlet.ServletRequest) saveRequest(request)}
-     * and then {@link #redirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse) redirectToLogin(request,response)}.
+     * and then {@link #redirectToLogin(ServletRequest, ServletResponse) redirectToLogin(request,response)}.
      *
      * @param request  the incoming ServletRequest
      * @param response the outgoing ServletResponse
diff --git a/web/src/main/java/org/apache/shiro/web/filter/PathMatchingFilter.java b/web/src/main/java/org/apache/shiro/web/filter/PathMatchingFilter.java
index 5d14eb002d..4ac41845c7 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/PathMatchingFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/PathMatchingFilter.java
@@ -106,7 +106,6 @@ protected String getPathWithinApplication(ServletRequest request) {
         return WebUtils.getPathWithinApplication(WebUtils.toHttp(request));
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Returns true if the incoming request matches the specified path pattern,
      * false otherwise.
@@ -114,7 +113,7 @@ protected String getPathWithinApplication(ServletRequest request) {
      * The default implementation acquires the request's path within the application and determines
      * if that matches:
      * 
      
-     * String requestURI = {@link #getPathWithinApplication(javax.servlet.ServletRequest) getPathWithinApplication(request)};
      
+     * String requestURI = {@link #getPathWithinApplication(ServletRequest) getPathWithinApplication(request)};
      
      * return {@link #pathsMatch(String, String) pathsMatch(path,requestURI)}      
      *
      * @param path    the configured url pattern to check the incoming request against.
@@ -253,7 +252,7 @@ protected boolean onPreHandle(ServletRequest request, ServletResponse response,
         return true;
     }
 
-    @SuppressWarnings({"UnusedParameters", "checkstyle:LineLength"})
+    @SuppressWarnings("UnusedParameters")
     /**
      * Path-matching version of the parent class's
      * {@link #isEnabled(javax.servlet.ServletRequest, javax.servlet.ServletResponse)} method, but additionally allows
@@ -267,8 +266,10 @@ protected boolean onPreHandle(ServletRequest request, ServletResponse response,
      *
      * @param request     the incoming servlet request
      * @param response    the outbound servlet response
-     * @param path        the path matched for the incoming servlet request that has been configured with the given {@code mappedValue}.
-     * @param mappedValue the filter-specific config value mapped to this filter in the URL rules mappings for the given {@code path}.
+     * @param path        the path matched for the incoming servlet request
+     *                    that has been configured with the given {@code mappedValue}.
+     * @param mappedValue the filter-specific config value mapped to
+     *                    this filter in the URL rules mappings for the given {@code path}.
      * @return {@code true} if this filter should filter the specified request, {@code false} if it should let the
      * request/response pass through immediately to the next element in the {@code FilterChain}.
      * @throws Exception in the case of any error
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/AuthenticationFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/AuthenticationFilter.java
index 8dd6804287..33b1d46723 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authc/AuthenticationFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authc/AuthenticationFilter.java
@@ -80,11 +80,10 @@ protected boolean isAccessAllowed(ServletRequest request, ServletResponse respon
         return subject.isAuthenticated() && subject.getPrincipal() != null;
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Redirects to user to the previously attempted URL after a successful login.  This implementation simply calls
      * {@link org.apache.shiro.web.util.WebUtils WebUtils}.
-     * {@link WebUtils#redirectToSavedRequest(javax.servlet.ServletRequest, javax.servlet.ServletResponse, String) redirectToSavedRequest}
+     * {@link WebUtils#redirectToSavedRequest(ServletRequest, ServletResponse, String) redirectToSavedRequest}      
      * using the {@link #getSuccessUrl() successUrl} as the {@code fallbackUrl} argument to that call.
      *
      * @param request  the incoming request
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/FormAuthenticationFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/FormAuthenticationFilter.java
index 1fe32fd84e..ff2584ef38 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authc/FormAuthenticationFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authc/FormAuthenticationFilter.java
@@ -20,6 +20,7 @@
 
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.UsernamePasswordToken;
 import org.apache.shiro.subject.Subject;
 import org.apache.shiro.web.util.WebUtils;
 import org.slf4j.Logger;
@@ -29,7 +30,6 @@
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 
-@SuppressWarnings("checkstyle:LineLength")
 /**
  * Requires the requesting user to be authenticated for the request to continue, and if they are not, forces the user
  * to login via by redirecting them to the {@link #setLoginUrl(String) loginUrl} you configure.
@@ -37,7 +37,7 @@
  * 
      This filter constructs a {@link UsernamePasswordToken UsernamePasswordToken} with the values found in
  * {@link #setUsernameParam(String) username}, {@link #setPasswordParam(String) password},
  * and {@link #setRememberMeParam(String) rememberMe} request parameters.  It then calls
- * {@link org.apache.shiro.subject.Subject#login(org.apache.shiro.authc.AuthenticationToken) Subject.login(usernamePasswordToken)},
+ * {@link Subject#login(AuthenticationToken) Subject.login(usernamePasswordToken)},
  * effectively automatically performing a login attempt.  Note that the login attempt will only occur when the
  * {@link #isLoginSubmission(javax.servlet.ServletRequest, javax.servlet.ServletResponse) isLoginSubmission(request,response)}
  * is true, which by default occurs when the request is for the {@link #setLoginUrl(String) loginUrl} and
@@ -50,7 +50,7 @@
  * 
      
  * 
      If you would prefer to handle the authentication validation and login in your own code, consider using the
  * {@link PassThruAuthenticationFilter} instead, which allows requests to the
- * {@link #loginUrl} to pass through to your application's code directly.
+ * {@link #setLoginUrl(String) loginUrl} to pass through to your application's code directly.
  *
  * @see PassThruAuthenticationFilter
  * @since 0.9
@@ -134,13 +134,12 @@ public String getRememberMeParam() {
         return rememberMeParam;
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Sets the request parameter name to look for when acquiring the rememberMe boolean value.  Unless overridden
      * by calling this method, the default is rememberMe.
      * 
      
      * RememberMe will be true if the parameter value equals any of those supported by
-     * {@link org.apache.shiro.web.util.WebUtils#isTrue(javax.servlet.ServletRequest, String) WebUtils.isTrue(request,value)}, false
+     * {@link WebUtils#isTrue(ServletRequest, String) WebUtils.isTrue(request,value)}, false
      * otherwise.
      *
      * @param rememberMeParam the name of the request param to check for acquiring the rememberMe boolean value.
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java
index fa47eb150f..636744a322 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java
@@ -31,11 +31,10 @@
 import java.util.Locale;
 import java.util.Set;
 
-@SuppressWarnings("checkstyle:LineLength")
 /**
  * Requires the requesting user to be {@link org.apache.shiro.subject.Subject#isAuthenticated() authenticated} for the
- * request to continue, and if they're not, requires the user to login via the HTTP "Authentication" header (e.g. BASIC, Bearer, etc.)
- * Upon successful login, they're allowed to continue on to the requested resource/url.
+ * request to continue, and if they're not, requires the user to login via the HTTP "Authentication"
+ * header (e.g. BASIC, Bearer, etc.) Upon successful login, they're allowed to continue on to the requested resource/url.
  * 
      
  * The {@link #onAccessDenied(ServletRequest, ServletResponse)} method will
  * only be called if the subject making the request is not
@@ -305,7 +304,8 @@ protected boolean isLoginAttempt(String authzHeader) {
      * 
      
      * The header value constructed is equal to:
      * 
      
-     * {@link #getAuthcScheme() getAuthcScheme()} + " realm=\"" + {@link #getApplicationName() getApplicationName()} + "\"";
+     * {@link #getAuthcScheme() getAuthcScheme()} + " realm=\""
+     *      + {@link #getApplicationName() getApplicationName()} + "\"";
      *
      * @param request  incoming ServletRequest, ignored by this implementation
      * @param response outgoing ServletResponse
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/LogoutFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/LogoutFilter.java
index 367c1686c5..f74832d437 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authc/LogoutFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authc/LogoutFilter.java
@@ -62,11 +62,10 @@ public class LogoutFilter extends AdviceFilter {
     @SuppressWarnings("checkstyle:ExplicitInitialization")
     private boolean postOnlyLogout = false;
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Acquires the currently executing {@link #getSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) subject},
      * a potentially Subject or request-specific
-     * {@link #getRedirectUrl(javax.servlet.ServletRequest, javax.servlet.ServletResponse, org.apache.shiro.subject.Subject) redirectUrl},
+     * {@link #getRedirectUrl(ServletRequest, ServletResponse, org.apache.shiro.subject.Subject) redirectUrl},
      * and redirects the end-user to that redirect url.
      *
      * @param request  the incoming ServletRequest
@@ -126,7 +125,6 @@ protected void issueRedirect(ServletRequest request, ServletResponse response, S
         WebUtils.issueRedirect(request, response, redirectUrl);
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Returns the redirect URL to send the user after logout.  This default implementation ignores the arguments and
      * returns the static configured {@link #getRedirectUrl() redirectUrl} property, but this method may be overridden
@@ -136,9 +134,9 @@ protected void issueRedirect(ServletRequest request, ServletResponse response, S
      * session if one is available and if necessary.
      * 
      
      * Tip: if you need to access the Subject's session, consider using the
-     * {@code Subject.}{@link Subject#getSession(boolean) getSession(false)} method to ensure a new session isn't created unnecessarily.
-     * If a session would be created, it will be immediately stopped after logout, not providing any value and
-     * unnecessarily taxing session infrastructure/resources.
+     * {@code Subject.}{@link Subject#getSession(boolean) getSession(false)} method to ensure a new session
+     * isn't created unnecessarily. If a session was created, it will be immediately stopped after logout,
+     * not providing any value and unnecessarily taxing session infrastructure/resources.
      *
      * @param request  the incoming Servlet request
      * @param response the outgoing ServletResponse
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/PassThruAuthenticationFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/PassThruAuthenticationFilter.java
index 12eefd6bf2..6aa9ea2bee 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authc/PassThruAuthenticationFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authc/PassThruAuthenticationFilter.java
@@ -18,10 +18,11 @@
  */
 package org.apache.shiro.web.filter.authc;
 
+import org.apache.shiro.subject.Subject;
+
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-@SuppressWarnings("checkstyle:LineLength")
 /**
  * An authentication filter that redirects the user to the login page when they are trying to access
  * a protected resource.  However, if the user is trying to access the login page, the filter lets
@@ -36,7 +37,7 @@
  * 
      
  * Conversely, this controller always passes all requests to the {@link #setLoginUrl loginUrl} through, both GETs and
  * POSTs.  This is useful in cases where the developer wants to write their own login behavior, which should include a
- * call to {@link org.apache.shiro.subject.Subject#login(org.apache.shiro.authc.AuthenticationToken) Subject.login(AuthenticationToken)}
+ * call to {@link Subject#login(org.apache.shiro.authc.AuthenticationToken) Subject.login(AuthenticationToken)}
  * at some point.  For example,  if the developer has their own custom MVC login controller or validator,
  * this PassThruAuthenticationFilter may be appropriate.
  *
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authc/UserFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authc/UserFilter.java
index 05a6f547f5..1c31fd1987 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authc/UserFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authc/UserFilter.java
@@ -56,10 +56,9 @@ protected boolean isAccessAllowed(ServletRequest request, ServletResponse respon
         }
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * This default implementation simply calls
-     * {@link #saveRequestAndRedirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse) saveRequestAndRedirectToLogin}
+     * {@link #saveRequestAndRedirectToLogin(ServletRequest, ServletResponse) saveRequestAndRedirectToLogin}
      * and then immediately returns false, thereby preventing the chain from continuing so the redirect may
      * execute.
      */
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authz/AuthorizationFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authz/AuthorizationFilter.java
index e02efca3a3..4253594c1e 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authz/AuthorizationFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authz/AuthorizationFilter.java
@@ -60,7 +60,6 @@ public String getUnauthorizedUrl() {
         return unauthorizedUrl;
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Sets the URL to which users should be redirected if they are denied access to an underlying path or resource.
      * 
      
@@ -72,8 +71,8 @@ public String getUnauthorizedUrl() {
      * unauthorized access.
      *
      * @param unauthorizedUrl the URL to which users should be redirected if they are denied access to an underlying
-     *                        path or resource, or {@code null} to a ensure raw {@link HttpServletResponse#SC_UNAUTHORIZED} response is
-     *                        issued (401 Unauthorized).
+     *                        path or resource, or {@code null} to an ensure raw
+     *                        {@link HttpServletResponse#SC_UNAUTHORIZED} response is issued (401 Unauthorized).
      */
     public void setUnauthorizedUrl(String unauthorizedUrl) {
         this.unauthorizedUrl = unauthorizedUrl;
@@ -107,7 +106,7 @@ public void setUnauthorizedUrl(String unauthorizedUrl) {
     protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws IOException {
 
         Subject subject = getSubject(request, response);
-        // If the subject isn't identified, redirect to login URL
+        // If the subject isn't identified, redirect to the login URL
         if (subject.getPrincipal() == null) {
             saveRequestAndRedirectToLogin(request, response);
         } else {
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authz/HttpMethodPermissionFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authz/HttpMethodPermissionFilter.java
index 309b0b5cf2..0ba3b095f2 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authz/HttpMethodPermissionFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authz/HttpMethodPermissionFilter.java
@@ -265,12 +265,11 @@ protected String[] buildPermissions(String[] configuredPerms, String action) {
         return mappedPerms;
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Resolves an 'application friendly' action verb based on the {@code HttpServletRequest}'s method, appends that
      * action to each configured permission (the {@code mappedValue} argument is a {@code String[]} array), and
      * delegates the permission check for the newly constructed permission(s) to the superclass
-     * {@link PermissionsAuthorizationFilter#isAccessAllowed(javax.servlet.ServletRequest, javax.servlet.ServletResponse, Object) isAccessAllowed}
+     * {@link PermissionsAuthorizationFilter#isAccessAllowed(ServletRequest, ServletResponse, Object) isAccessAllowed}
      * implementation to perform the actual permission check.
      *
      * @param request     the inbound {@code ServletRequest}
diff --git a/web/src/main/java/org/apache/shiro/web/filter/authz/SslFilter.java b/web/src/main/java/org/apache/shiro/web/filter/authz/SslFilter.java
index 7984358366..3ca3133b36 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/authz/SslFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/authz/SslFilter.java
@@ -31,7 +31,7 @@
  * The {@link #getPort() port} property defaults to {@code 443} and also additionally guarantees that the
  * request scheme is always 'https' (except for port 80, which retains the 'http' scheme).
  * 
      
- * In addition the filter allows enabling HTTP Strict Transport Security (HSTS).
+ * In addition, the filter allows enabling HTTP Strict Transport Security (HSTS).
  * This feature is opt-in and disabled by default. If enabled HSTS
  * will prevent any communications from being sent over HTTP to the
  * specified domain and will instead send all communications over HTTPS.
@@ -88,7 +88,6 @@ protected String getScheme(String requestScheme, int port) {
         }
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Retains the parent method's port-matching behavior but additionally guarantees that the
      * {@code ServletRequest.}{@link javax.servlet.ServletRequest#isSecure() isSecure()}.  If the port does not match or
@@ -96,7 +95,8 @@ protected String getScheme(String requestScheme, int port) {
      *
      * @param request     the incoming {@code ServletRequest}
      * @param response    the outgoing {@code ServletResponse} - ignored in this implementation
-     * @param mappedValue the filter-specific config value mapped to this filter in the URL rules mappings - ignored by this implementation.
+     * @param mappedValue the filter-specific config value mapped to this filter in the URL rules mappings
+     *                    - ignored by this implementation.
      * @return {@code true} if the request is received on an expected SSL port and the
      * {@code request.}{@link javax.servlet.ServletRequest#isSecure() isSecure()}, {@code false} otherwise.
      * @throws Exception if the call to {@code super.isAccessAllowed} throws an exception.
diff --git a/web/src/main/java/org/apache/shiro/web/filter/mgt/PathMatchingFilterChainResolver.java b/web/src/main/java/org/apache/shiro/web/filter/mgt/PathMatchingFilterChainResolver.java
index 35a4b29d7f..052ccaa507 100644
--- a/web/src/main/java/org/apache/shiro/web/filter/mgt/PathMatchingFilterChainResolver.java
+++ b/web/src/main/java/org/apache/shiro/web/filter/mgt/PathMatchingFilterChainResolver.java
@@ -94,7 +94,6 @@ public void setFilterChainManager(FilterChainManager filterChainManager) {
         this.filterChainManager = filterChainManager;
     }
 
-    @SuppressWarnings("checkstyle:LineLength")
     public FilterChain getChain(ServletRequest request, ServletResponse response, FilterChain originalChain) {
         FilterChainManager filterChainManager = getFilterChainManager();
         if (!filterChainManager.hasChains()) {
@@ -125,7 +124,8 @@ public FilterChain getChain(ServletRequest request, ServletResponse response, Fi
                 if (pathMatches(pathPattern, requestURINoTrailingSlash)) {
                     if (LOGGER.isTraceEnabled()) {
                         LOGGER.trace("Matched path pattern [{}] for requestURI [{}].  "
-                                + "Utilizing corresponding filter chain...", pathPattern, Encode.forHtml(requestURINoTrailingSlash));
+                                + "Utilizing corresponding filter chain...",
+                                    pathPattern, Encode.forHtml(requestURINoTrailingSlash));
                     }
                     return filterChainManager.proxy(originalChain, pathPattern);
                 }
diff --git a/web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java b/web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java
index 2a4f0f51c1..eb7fbf9b77 100644
--- a/web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java
@@ -39,7 +39,6 @@
 import java.io.IOException;
 import java.util.concurrent.Callable;
 
-@SuppressWarnings("checkstyle:LineLength")
 /**
  * Abstract base class that provides all standard Shiro request filtering behavior and expects
  * subclasses to implement configuration-specific logic (INI, XML, .properties, etc.).
@@ -51,7 +50,8 @@
  * {@link #setFilterChainResolver(org.apache.shiro.web.filter.mgt.FilterChainResolver)} methods respectively.
  * 
      Static SecurityManager
      
  * By default, the {@code SecurityManager} instance enabled by this filter will not be enabled in static
- * memory via the {@code SecurityUtils.}{@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}
+ * memory via the {@code SecurityUtils.}
+ * {@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}
  * method.  Instead, it is expected that Subject instances will always be constructed on a request-processing thread
  * via instances of this Filter class.
  * 
      
@@ -143,13 +143,16 @@ public boolean isStaticSecurityManagerEnabled() {
 
     /**
      * Sets if the constructed {@link #getSecurityManager() securityManager} reference should be bound
-     * to static memory (via {@code SecurityUtils.}{@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}).
+     * to static memory (via {@code SecurityUtils.}
+     * {@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}).
      * 
      
      * The default value is {@code false}.
      *
      * @param staticSecurityManagerEnabled if the constructed {@link #getSecurityManager() securityManager} reference
      *                                     should be bound to static memory (via
-     *                                     {@code SecurityUtils.}{@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager) setSecurityManager}).
+     *                                     {@code SecurityUtils.}
+     *                                     {@link SecurityUtils#setSecurityManager(org.apache.shiro.mgt.SecurityManager)
+     *                                          setSecurityManager}).
      * @see SHIRO-287
      * @since 1.2
      */
diff --git a/web/src/main/java/org/apache/shiro/web/servlet/NameableFilter.java b/web/src/main/java/org/apache/shiro/web/servlet/NameableFilter.java
index 5e12ac85b6..c8d503c2e1 100644
--- a/web/src/main/java/org/apache/shiro/web/servlet/NameableFilter.java
+++ b/web/src/main/java/org/apache/shiro/web/servlet/NameableFilter.java
@@ -37,14 +37,13 @@ public abstract class NameableFilter extends AbstractFilter implements Nameable
      */
     private String name;
 
-    @SuppressWarnings("checkstyle:LineLength")
     /**
      * Returns the filter's name.
      * 
      
      * Unless overridden by calling the {@link #setName(String) setName(String)} method, this value defaults to the
      * filter name as specified by the servlet container at start-up:
      * 
      -     * this.name = {@link #getFilterConfig() getFilterConfig()}.{@link javax.servlet.FilterConfig#getFilterName() getName()};
      
+     * this.name = {@link #getFilterConfig() getFilterConfig()}.{@link FilterConfig#getFilterName() getName()};
      * * @return the filter name, or {@code null} if none available * @see javax.servlet.GenericServlet#getServletName() diff --git a/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java b/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java index a3997d07e5..66d630ae8d 100644 --- a/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java +++ b/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java @@ -39,18 +39,24 @@ * * @since 0.2 */ -@SuppressWarnings({"checkstyle:JavadocVariable", "checkstyle:LineLength"}) +@SuppressWarnings({"checkstyle:JavadocVariable"}) public class ShiroHttpServletRequest extends HttpServletRequestWrapper { //The following 7 constants support the Shiro's implementation of the Servlet Specification public static final String COOKIE_SESSION_ID_SOURCE = "cookie"; public static final String URL_SESSION_ID_SOURCE = "url"; - public static final String REFERENCED_SESSION_ID = ShiroHttpServletRequest.class.getName() + "_REQUESTED_SESSION_ID"; - public static final String REFERENCED_SESSION_ID_IS_VALID = ShiroHttpServletRequest.class.getName() + "_REQUESTED_SESSION_ID_VALID"; - public static final String REFERENCED_SESSION_IS_NEW = ShiroHttpServletRequest.class.getName() + "_REFERENCED_SESSION_IS_NEW"; - public static final String REFERENCED_SESSION_ID_SOURCE = ShiroHttpServletRequest.class.getName() + "REFERENCED_SESSION_ID_SOURCE"; - public static final String IDENTITY_REMOVED_KEY = ShiroHttpServletRequest.class.getName() + "_IDENTITY_REMOVED_KEY"; - public static final String SESSION_ID_URL_REWRITING_ENABLED = ShiroHttpServletRequest.class.getName() + "_SESSION_ID_URL_REWRITING_ENABLED"; + public static final String REFERENCED_SESSION_ID = ShiroHttpServletRequest.class.getName() + + "_REQUESTED_SESSION_ID"; + public static final String REFERENCED_SESSION_ID_IS_VALID = ShiroHttpServletRequest.class.getName() + + "_REQUESTED_SESSION_ID_VALID"; + public static final String REFERENCED_SESSION_IS_NEW = ShiroHttpServletRequest.class.getName() + + "_REFERENCED_SESSION_IS_NEW"; + public static final String REFERENCED_SESSION_ID_SOURCE = ShiroHttpServletRequest.class.getName() + + "REFERENCED_SESSION_ID_SOURCE"; + public static final String IDENTITY_REMOVED_KEY = ShiroHttpServletRequest.class.getName() + + "_IDENTITY_REMOVED_KEY"; + public static final String SESSION_ID_URL_REWRITING_ENABLED = ShiroHttpServletRequest.class.getName() + + "_SESSION_ID_URL_REWRITING_ENABLED"; @SuppressWarnings("checkstyle:ExplicitInitialization") protected ServletContext servletContext = null; diff --git a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java index e9f6746ef7..2004c41096 100644 --- a/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java +++ b/web/src/main/java/org/apache/shiro/web/servlet/SimpleCookie.java @@ -40,7 +40,7 @@ * * @since 1.0 */ -@SuppressWarnings({"checkstyle:MethodCount", "checkstyle:LineLength", "checkstyle:ParameterNumber"}) +@SuppressWarnings({"checkstyle:MethodCount", "checkstyle:ParameterNumber"}) public class SimpleCookie implements Cookie { /** @@ -219,8 +219,8 @@ public void setSameSite(SameSiteOptions sameSite) { } /** - * Returns the Cookie's calculated path setting. If the {@link javax.servlet.http.Cookie#getPath() path} is {@code null}, then the - * {@code request}'s {@link javax.servlet.http.HttpServletRequest#getContextPath() context path} + * Returns the Cookie's calculated path setting. If the {@link javax.servlet.http.Cookie#getPath() path} is {@code null}, + * then the {@code request}'s {@link javax.servlet.http.HttpServletRequest#getContextPath() context path} * will be returned. If getContextPath() is the empty string or null then the ROOT_PATH constant is returned. * * @param request the incoming HttpServletRequest @@ -383,7 +383,9 @@ private void appendHttpOnly(StringBuilder sb, boolean httpOnly) { private void appendSameSite(StringBuilder sb, SameSiteOptions sameSite) { if (sameSite != null) { sb.append(ATTRIBUTE_DELIMITER); - sb.append(SAME_SITE_ATTRIBUTE_NAME).append(NAME_VALUE_DELIMITER).append(sameSite.toString().toLowerCase(Locale.ENGLISH)); + sb.append(SAME_SITE_ATTRIBUTE_NAME) + .append(NAME_VALUE_DELIMITER) + .append(sameSite.toString().toLowerCase(Locale.ENGLISH)); } } diff --git a/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java b/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java index 4ca6c2c9d3..eeb9c62558 100644 --- a/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java +++ b/web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java @@ -166,7 +166,6 @@ private Object getPrincipalFromClassName() { return principal; } - @SuppressWarnings("checkstyle:LineLength") private String getPrincipalProperty(Object principal, String property) throws JspTagException { String strValue = null; @@ -185,7 +184,8 @@ private String getPrincipalProperty(Object principal, String property) throws Js } if (!foundProperty) { - final String message = "Property [" + property + "] not found in principal of type [" + principal.getClass().getName() + "]"; + final String message = "Property [" + property + "] not found in principal of type [" + + principal.getClass().getName() + "]"; if (LOGGER.isErrorEnabled()) { LOGGER.error(message); } @@ -193,7 +193,8 @@ private String getPrincipalProperty(Object principal, String property) throws Js } } catch (Exception e) { - final String message = "Error reading property [" + property + "] from principal of type [" + principal.getClass().getName() + "]"; + final String message = "Error reading property [" + property + "] from principal of type [" + + principal.getClass().getName() + "]"; if (LOGGER.isErrorEnabled()) { LOGGER.error(message, e); } diff --git a/web/src/main/java/org/apache/shiro/web/util/WebUtils.java b/web/src/main/java/org/apache/shiro/web/util/WebUtils.java index e016cc6ebf..99717f2429 100644 --- a/web/src/main/java/org/apache/shiro/web/util/WebUtils.java +++ b/web/src/main/java/org/apache/shiro/web/util/WebUtils.java @@ -56,9 +56,9 @@ public final class WebUtils { public static final String ALLOW_BACKSLASH = "org.apache.shiro.web.ALLOW_BACKSLASH"; - @SuppressWarnings("checkstyle:LineLength") /** - * {@link org.apache.shiro.session.Session Session} key used to save a request and later restore it, for example when redirecting to a + * {@link org.apache.shiro.session.Session Session} key used to save a request and later restore it, + * for example when redirecting to a * requested page after login, equal to {@code shiroSavedRequest}. */ public static final String SAVED_REQUEST_KEY = "shiroSavedRequest"; @@ -370,14 +370,15 @@ public static WebEnvironment getWebEnvironment(ServletContext sc, String attrNam * @see java.net.URLDecoder#decode(String, String) * @see java.net.URLDecoder#decode(String) */ - @SuppressWarnings({"deprecation", "checkstyle:LineLength"}) + @SuppressWarnings("deprecation") public static String decodeRequestString(HttpServletRequest request, String source) { String enc = determineEncoding(request); try { return URLDecoder.decode(source, enc); } catch (UnsupportedEncodingException ex) { if (LOGGER.isWarnEnabled()) { - LOGGER.warn("Could not decode request string [" + Encode.forHtml(source) + "] with encoding '" + Encode.forHtml(enc) + LOGGER.warn("Could not decode request string [" + Encode.forHtml(source) + + "] with encoding '" + Encode.forHtml(enc) + "': falling back to platform default encoding; exception message: " + ex.getMessage()); } return URLDecoder.decode(source); @@ -553,8 +554,8 @@ public static HttpServletResponse toHttp(ServletResponse response) { * @param http10Compatible whether to stay compatible with HTTP 1.0 clients. * @throws java.io.IOException if thrown by response methods. */ - @SuppressWarnings("checkstyle:LineLength") - public static void issueRedirect(ServletRequest request, ServletResponse response, String url, Map queryParams, boolean contextRelative, + public static void issueRedirect(ServletRequest request, ServletResponse response, String url, + Map queryParams, boolean contextRelative, boolean http10Compatible) throws IOException { RedirectView view = new RedirectView(url, contextRelative, http10Compatible); view.renderMergedOutputModel(queryParams, toHttp(request), toHttp(response)); diff --git a/web/src/main/resources/META-INF/shiro.tld b/web/src/main/resources/META-INF/shiro.tld index e554ab988d..f40b23f6fe 100644 --- a/web/src/main/resources/META-INF/shiro.tld +++ b/web/src/main/resources/META-INF/shiro.tld @@ -18,149 +18,149 @@ ~ under the License. --> + "http://java.sun.com/dtd/web-jsptaglibrary_1_2.dtd"> - 1.1.2 - - 1.2 - - Apache Shiro - - http://shiro.apache.org/tags - - Apache Shiro JSP Tag Library. - - - hasPermission - org.apache.shiro.web.tags.HasPermissionTag - JSP - Displays body content only if the current Subject (user) - 'has' (implies) the specified permission (i.e the user has the specified ability). - - - name - true - true - - - - - lacksPermission - org.apache.shiro.web.tags.LacksPermissionTag - JSP - Displays body content only if the current Subject (user) does - NOT have (not imply) the specified permission (i.e. the user lacks the specified ability) - - - name - true - true - - - - - hasRole - org.apache.shiro.web.tags.HasRoleTag - JSP - Displays body content only if the current user has the specified role. - - name - true - true - - - - - - hasAnyRoles - org.apache.shiro.web.tags.HasAnyRolesTag - JSP - Displays body content only if the current user has one of the specified roles from a - comma-separated list of role names. - - - name - true - true - - - - - lacksRole - org.apache.shiro.web.tags.LacksRoleTag - JSP - Displays body content only if the current user does NOT have the specified role - (i.e. they explicitly lack the specified role) - - - name - true - true - - - - - authenticated - org.apache.shiro.web.tags.AuthenticatedTag - JSP - Displays body content only if the current user has successfully authenticated - _during their current session_. It is more restrictive than the 'user' tag. - It is logically opposite to the 'notAuthenticated' tag. - - - - - notAuthenticated - org.apache.shiro.web.tags.NotAuthenticatedTag - JSP - Displays body content only if the current user has NOT successfully authenticated - _during their current session_. It is logically opposite to the 'authenticated' tag. - - - - - user - org.apache.shiro.web.tags.UserTag - JSP - Displays body content only if the current Subject has a known identity, either - from a previous login or from 'RememberMe' services. Note that this is semantically different - from the 'authenticated' tag, which is more restrictive. It is logically - opposite to the 'guest' tag. - - - - - guest - org.apache.shiro.web.tags.GuestTag - JSP - Displays body content only if the current Subject IS NOT known to the system, either - because they have not logged in or they have no corresponding 'RememberMe' identity. It is logically - opposite to the 'user' tag. - - - - - principal - org.apache.shiro.web.tags.PrincipalTag - JSP - Displays the user's principal or a property of the user's principal. - - type - false - true - - - property - false - true - - - defaultValue - false - true - - + 1.1.2 + + 1.2 + + Apache Shiro + + http://shiro.apache.org/tags + + Apache Shiro JSP Tag Library. + + + hasPermission + org.apache.shiro.web.tags.HasPermissionTag + JSP + Displays body content only if the current Subject (user) + 'has' (implies) the specified permission (i.e the user has the specified ability). + + + name + true + true + + + + + lacksPermission + org.apache.shiro.web.tags.LacksPermissionTag + JSP + Displays body content only if the current Subject (user) does + NOT have (not imply) the specified permission (i.e. the user lacks the specified ability) + + + name + true + true + + + + + hasRole + org.apache.shiro.web.tags.HasRoleTag + JSP + Displays body content only if the current user has the specified role. + + name + true + true + + + + + + hasAnyRoles + org.apache.shiro.web.tags.HasAnyRolesTag + JSP + Displays body content only if the current user has one of the specified roles from a + comma-separated list of role names. + + + name + true + true + + + + + lacksRole + org.apache.shiro.web.tags.LacksRoleTag + JSP + Displays body content only if the current user does NOT have the specified role + (i.e. they explicitly lack the specified role) + + + name + true + true + + + + + authenticated + org.apache.shiro.web.tags.AuthenticatedTag + JSP + Displays body content only if the current user has successfully authenticated + _during their current session_. It is more restrictive than the 'user' tag. + It is logically opposite to the 'notAuthenticated' tag. + + + + + notAuthenticated + org.apache.shiro.web.tags.NotAuthenticatedTag + JSP + Displays body content only if the current user has NOT successfully authenticated + _during their current session_. It is logically opposite to the 'authenticated' tag. + + + + + user + org.apache.shiro.web.tags.UserTag + JSP + Displays body content only if the current Subject has a known identity, either + from a previous login or from 'RememberMe' services. Note that this is semantically different + from the 'authenticated' tag, which is more restrictive. It is logically + opposite to the 'guest' tag. + + + + + guest + org.apache.shiro.web.tags.GuestTag + JSP + Displays body content only if the current Subject IS NOT known to the system, either + because they have not logged in or they have no corresponding 'RememberMe' identity. It is logically + opposite to the 'user' tag. + + + + + principal + org.apache.shiro.web.tags.PrincipalTag + JSP + Displays the user's principal or a property of the user's principal. + + type + false + true + + + property + false + true + + + defaultValue + false + true + + diff --git a/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterParameterizedTest.java b/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterParameterizedTest.java index 2501968de4..f74265db31 100644 --- a/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterParameterizedTest.java +++ b/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterParameterizedTest.java @@ -109,9 +109,10 @@ private PathMatchingFilter createTestInstance() { final String name = "pathMatchingFilter"; PathMatchingFilter filter = new PathMatchingFilter() { - @SuppressWarnings("checkstyle:LineLength") + @Override - protected boolean isEnabled(ServletRequest request, ServletResponse response, String path, Object mappedValue) throws Exception { + protected boolean isEnabled(ServletRequest request, ServletResponse response, + String path, Object mappedValue) throws Exception { return !path.equals(DISABLED_PATH); } @@ -131,7 +132,6 @@ protected boolean onPreHandle(ServletRequest request, ServletResponse response, return filter; } - @SuppressWarnings("checkstyle:LineLength") @MethodSource("generateParameters") @ParameterizedTest void testBasicAssumptions(String pattern, HttpServletRequest request, boolean shouldMatch) { @@ -139,7 +139,8 @@ void testBasicAssumptions(String pattern, HttpServletRequest request, boolean sh LOG.debug("Input pattern: [{}], input path: [{}].", this.pattern, this.request.getPathInfo()); boolean matchEnabled = filter.pathsMatch(this.pattern, this.request); assertEquals(this.shouldMatch, matchEnabled, - "PathMatch can match URL end with multi Separator, [" + this.pattern + "] - [" + this.request.getPathInfo() + "]"); + "PathMatch can match URL end with multi Separator, [" + + this.pattern + "] - [" + this.request.getPathInfo() + "]"); verify(request); } diff --git a/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterTest.java b/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterTest.java index a0c3f53d13..01b5adcc2e 100644 --- a/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterTest.java +++ b/web/src/test/java/org/apache/shiro/web/filter/PathMatchingFilterTest.java @@ -56,9 +56,10 @@ private PathMatchingFilter createTestInstance() { final String name = "pathMatchingFilter"; PathMatchingFilter filter = new PathMatchingFilter() { - @SuppressWarnings("checkstyle:LineLength") + @Override - protected boolean isEnabled(ServletRequest request, ServletResponse response, String path, Object mappedValue) throws Exception { + protected boolean isEnabled(ServletRequest request, ServletResponse response, + String path, Object mappedValue) throws Exception { return !path.equals(DISABLED_PATH); } diff --git a/web/src/test/java/org/apache/shiro/web/filter/authc/BasicHttpFilterAuthenticationTest.java b/web/src/test/java/org/apache/shiro/web/filter/authc/BasicHttpFilterAuthenticationTest.java index 8d963c30a3..ad6c106323 100644 --- a/web/src/test/java/org/apache/shiro/web/filter/authc/BasicHttpFilterAuthenticationTest.java +++ b/web/src/test/java/org/apache/shiro/web/filter/authc/BasicHttpFilterAuthenticationTest.java @@ -272,7 +272,6 @@ public void permissiveEnabledTest() { /** * @since 1.4 */ - @SuppressWarnings("checkstyle:LineLength") @Test public void httpMethodRequiresAuthenticationWithPermissive() throws Exception { runWithSubject(subject -> { @@ -285,7 +284,8 @@ public void httpMethodRequiresAuthenticationWithPermissive() throws Exception { HttpServletResponse response = mock(HttpServletResponse.class); - boolean accessAllowed = testFilter.isAccessAllowed(request, response, new String[] {"permissive", "POST", "PUT", "DELETE"}); + boolean accessAllowed = testFilter.isAccessAllowed(request, response, + new String[] {"permissive", "POST", "PUT", "DELETE"}); assertFalse(accessAllowed, "Access allowed for POST"); }); } diff --git a/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java b/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java index 8be0d85564..5c55220667 100644 --- a/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java +++ b/web/src/test/java/org/apache/shiro/web/mgt/CookieRememberMeManagerTest.java @@ -100,7 +100,6 @@ void onSuccessfulLogin() { } // SHIRO-183 - @SuppressWarnings("checkstyle:LineLength") @Test void getRememberedSerializedIdentityReturnsNullForDeletedCookie() { HttpServletRequest mockRequest = createMock(HttpServletRequest.class); @@ -112,7 +111,8 @@ void getRememberedSerializedIdentityReturnsNullForDeletedCookie() { expect(mockRequest.getAttribute(ShiroHttpServletRequest.IDENTITY_REMOVED_KEY)).andReturn(null); Cookie[] cookies = new Cookie[] { - new Cookie(CookieRememberMeManager.DEFAULT_REMEMBER_ME_COOKIE_NAME, org.apache.shiro.web.servlet.Cookie.DELETED_COOKIE_VALUE) + new Cookie(CookieRememberMeManager.DEFAULT_REMEMBER_ME_COOKIE_NAME, + org.apache.shiro.web.servlet.Cookie.DELETED_COOKIE_VALUE) }; expect(mockRequest.getCookies()).andReturn(cookies); @@ -201,8 +201,7 @@ void getRememberedPrincipalsNoMoreDefaultCipher() { } // SHIRO-69 - - @SuppressWarnings({"checkstyle:MethodName", "checkstyle:LineLength"}) + @SuppressWarnings("checkstyle:MethodName") @Test void getRememberedPrincipalsDecryptionError_whenWrongCookieValue() { HttpServletRequest mockRequest = createNiceMock(HttpServletRequest.class); @@ -224,7 +223,9 @@ void getRememberedPrincipalsDecryptionError_whenWrongCookieValue() { replay(mockRequest); CookieRememberMeManager mgr = new CookieRememberMeManager(); - assertThrows(CryptoException.class, () -> mgr.getRememberedPrincipals(context), "CryptoException should be thrown on invalid cookies"); + assertThrows(CryptoException.class, + () -> mgr.getRememberedPrincipals(context), + "CryptoException should be thrown on invalid cookies"); } @SuppressWarnings("checkstyle:MethodName") diff --git a/web/src/test/java/org/apache/shiro/web/servlet/SimpleCookieTest.java b/web/src/test/java/org/apache/shiro/web/servlet/SimpleCookieTest.java index d468dbc374..4d89b107ab 100644 --- a/web/src/test/java/org/apache/shiro/web/servlet/SimpleCookieTest.java +++ b/web/src/test/java/org/apache/shiro/web/servlet/SimpleCookieTest.java @@ -54,7 +54,6 @@ public void setUp() throws Exception { this.cookie = new SimpleCookie("test"); } - @SuppressWarnings("checkstyle:LineLength") @Test //Verifies fix for JSEC-94 public void testRemoveValue() throws Exception {