Spring 模拟的 junit 测试使用 spring-security 3.2.0.RC1 版本抛出 NullPointerException答案

【问题标题】：Spring mocked junit tests throw NullPointerException with spring-security 3.2.0.RC1 versionSpring 模拟的 junit 测试使用 spring-security 3.2.0.RC1 版本抛出 NullPointerException
【发布时间】：2013-11-27 11:53:48
【问题描述】：

我有一个使用 Spring MockMvc 执行请求的 junit 测试。

private MockMvc mvc;

@Before
public void setUp() {
    mvc = MockMvcBuilders.standaloneSetup(new LoginController())
            .addFilter(new AnonymousAuthenticationFilter("anonymous"))
            .addFilter(new SecurityContextHolderAwareRequestFilter())
            .addFilter(new XssValidationFilter()).build();
    SecurityContextHolder.getContext().setAuthentication(null);
}

@Test
public void test() throws Exception {
    MockHttpServletRequestBuilder builder = MockMvcRequestBuilders.get("/login.htm")
            .param(USER, "admin").param(PASSWORD, "pass");
    ResultActions perform = mvc.perform(builder);
    (assertions..)
}

测试工作正常，直到我将 spring-security 库版本提升到 3.2.0.RC1。现在，我在以下位置收到 NullPointerException：

ResultActions perform = mvc.perform(builder);

堆栈跟踪是：

java.lang.NullPointerException
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:150)
at org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:137)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
at org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:137)
at org.springframework.test.web.servlet.MockMvc.perform(MockMvc.java:141)
at com.mycompany.controller.main.LoginControllerTest.test(LoginControllerTest.java:134)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:601)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
at org.springframework.test.context.junit4.statements.RunBeforeTestMethodCallbacks.evaluate(RunBeforeTestMethodCallbacks.java:74)
at org.springframework.test.context.junit4.statements.RunAfterTestMethodCallbacks.evaluate(RunAfterTestMethodCallbacks.java:83)
at org.springframework.test.context.junit4.statements.SpringRepeat.evaluate(SpringRepeat.java:72)
at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:230)
at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:87)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
at org.springframework.test.context.junit4.statements.RunBeforeTestClassCallbacks.evaluate(RunBeforeTestClassCallbacks.java:61)
at org.springframework.test.context.junit4.statements.RunAfterTestClassCallbacks.evaluate(RunAfterTestClassCallbacks.java:71)
at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:173)
at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:50)
at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:467)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:683)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:390)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:197)

我不知道该怎么办。如何修复该测试？我需要这个新版本的 spring-security，因为它支持 CSRF 攻击预防。

您好，彼得。

【问题讨论】：

考虑联系 Spring Security 开发人员并在适当的时候提交一个错误。
您的测试设置代码错误。 Spring Security 中的大多数过滤器都实现了 InitializingBean，它通常由 spring 容器调用。但是您的设置代码无法调用它。 SecurityContextHolderAwareRequestFilter 的 3.2 版本在该方法中做了一些额外的设置来检测 Servlet 3.0 与否。

标签： java junit spring-security mocking spring-test

【解决方案1】：

正如 M. Deinum 所说，我必须在 SecurityContextHolderAwareRequestFilter 上调用 afterPropertiesSet 方法。所以 setUp 方法看起来是这样的：

@Before
public void setUp() throws ServletException {
    Mockito.reset(userGroupInfo, licenseManager);
    SecurityContextHolderAwareRequestFilter securityContextHolderAwareRequestFilter = new SecurityContextHolderAwareRequestFilter();
    securityContextHolderAwareRequestFilter.afterPropertiesSet();
    mvc = MockMvcBuilders.standaloneSetup(new LoginController(userGroupInfo, licenseManager, userInfo))
            .addFilter(new AnonymousAuthenticationFilter("anonymous"))
            .addFilter(securityContextHolderAwareRequestFilter)
            .addFilter(new XssValidationFilter()).build();
    SecurityContextHolder.getContext().setAuthentication(null);
}

【讨论】：