fix(security): do not enforce security when no @Policy annotation is present#99
fix(security): do not enforce security when no @Policy annotation is present#99SedaOran wants to merge 1 commit into
Conversation
…present When a test has no @Policy annotation, scanForPackageName() returns the empty string as the restricted package (the default when no package is found in the project scan). Since every class name starts with "", the AOP advice would treat every stack frame as restricted, causing SecurityExceptions in trivial tests that perform no forbidden operations. Fix: in JupiterSecurityExtension, only activate security enforcement (createTestCases + executeTestCases) when an explicit @Policy annotation is present. Without @Policy, settings are still reset to a clean state but no restrictions are applied, so @publictest / @Hiddentest tests without a policy annotation pass as expected. Also removes leftover System.err debug logging that was left in the beforeTestExecution callback. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 58 minutes and 28 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jerrycai0006
left a comment
jerrycai0006
left a comment
There was a problem hiding this comment.
This PR seems to conflict with a PR that has already been merged: #86
As far as I understand, the intended behavior introduced there was that the security mechanism should still be enforced even when no @Policy annotation is present.
2 participants
Summary
@Policyannotation,scanForPackageName()returns""(empty string) as the restricted package (the default when no package is found). Since every class name starts with"", the AOP advice treated every stack frame as restricted, causingSecurityExceptionin trivial tests like@PublicTest void simpleTest() { assertTrue(true); }.JupiterSecurityExtension, security enforcement (createTestCases+executeTestCases) is now only activated when an explicit@Policyannotation is present. Without@Policy, settings are reset to a clean state but no restrictions are applied.System.errdebug logging that was left in thebeforeTestExecutioncallback.Related Issues
Fixes: Minimal
@PublicTest/@HiddenTestFails — Issue #9 from the security audit.Test plan
@PublicTest void simpleTest() { assertTrue(true); }— should PASS without any@Policy@HiddenTest void hiddenSimple() { assertTrue(true); }— should PASS without any@Policy@Policystill enforce the security rules correctly🤖 Generated with Claude Code