public final class RegExMethodAuthorizer extends Object implements MethodInvocationAuthorizer
MethodInvocationAuthorizer
that only allows the execution of
those methods matching the configured regular expression.
Some known dangerous methods, like Object.getClass()
, are also rejected by this
authorizer implementation, no matter whether the method matches the configured regular
expressions
or not (see RestrictedMethodAuthorizer.isPermanentlyForbiddenMethod(Method, Object)
).
When correctly configured, this authorizer implementation addresses the four known security
risks: Java Reflection
, Cache Modification
, Region Modification
and
Region Entry Modification
.
For the above statement to remain true, however, the regular expressions used must be
exhaustively studied and configured so no mutator methods match. If the regular expressions are
not restrictive enough, the Region Entry Modification
security risk still exists: users
with the DATA:READ:RegionName
privileges will be able to execute methods (even those
modifying the entry) on the objects stored within the region and on instances used as bind
parameters of the query, so this authorizer must be used with extreme care.
Usage of this authorizer implementation is only recommended for scenarios on which the user or operator knows exactly what code is deployed to the cluster, how and when; allowing a correct configuration of the regular expressions. It might also be used on clusters on which the entries stored are immutable.
Constructor and Description |
---|
RegExMethodAuthorizer(Cache cache,
Set<String> allowedPatterns)
Creates a
RegExMethodAuthorizer object and initializes it so it can be safely used
in a multi-threaded environment. |
RegExMethodAuthorizer(RestrictedMethodAuthorizer restrictedMethodAuthorizer,
Set<String> allowedPatterns)
Creates a
RegExMethodAuthorizer object and initializes it so it can be safely used
in a multi-threaded environment. |
Modifier and Type | Method and Description |
---|---|
boolean |
authorize(Method method,
Object target)
Executes the authorization logic to determine whether the
method is allowed to be
executed on the target object instance. |
Set<String> |
getAllowedPatterns()
Returns an unmodifiable view of the regular expressions used to configure this authorizer.
|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
initialize
public RegExMethodAuthorizer(Cache cache, Set<String> allowedPatterns)
RegExMethodAuthorizer
object and initializes it so it can be safely used
in a multi-threaded environment.
Applications can use this constructor as part of the initialization for custom authorizers
(see Declarable.initialize(Cache, Properties)
, when using a declarative approach.
cache
- the Cache
instance that owns this authorizer, required in order to
configure the default RestrictedMethodAuthorizer
.allowedPatterns
- the regular expressions that will be used to determine whether a method
is authorized or not.public RegExMethodAuthorizer(RestrictedMethodAuthorizer restrictedMethodAuthorizer, Set<String> allowedPatterns)
RegExMethodAuthorizer
object and initializes it so it can be safely used
in a multi-threaded environment.
restrictedMethodAuthorizer
- the default RestrictedMethodAuthorizer
to use.allowedPatterns
- the regular expressions that will be used to determine whether a method
is authorized or not.public Set<String> getAllowedPatterns()
public boolean authorize(Method method, Object target)
method
is allowed to be
executed on the target
object instance.
If the target
object is an instance of Region
, this methods also ensures that
the user has the DATA:READ
permission granted for the target Region
.
authorize
in interface MethodInvocationAuthorizer
method
- the Method
that should be authorized.target
- the Object
on which the Method
will be executed.true
if the method
can be executed on on the target
instance,
false
otherwise.MethodInvocationAuthorizer