Attachment #30363 for bug #55046

View | Details | Raw Unified | Return to bug 55046
Collapse All | Expand All




package org.apache.catalina.filters;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

public class MockFilterChain implements FilterChain {

    public void doFilter(ServletRequest request, ServletResponse response)
            throws IOException, ServletException {
        // NoOp
    }

}
  + native




package org.apache.catalina.filters;

import java.io.InputStream;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.Enumeration;
import java.util.EventListener;
import java.util.Map;
import java.util.Set;

import javax.servlet.Filter;
import javax.servlet.FilterRegistration;
import javax.servlet.RequestDispatcher;
import javax.servlet.Servlet;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRegistration;
import javax.servlet.ServletRegistration.Dynamic;
import javax.servlet.SessionCookieConfig;
import javax.servlet.SessionTrackingMode;
import javax.servlet.descriptor.JspConfigDescriptor;

public class MockServletContext implements ServletContext {

    public String getContextPath() {
        throw new RuntimeException("Not implemented");
    }

    public ServletContext getContext(String uripath) {
        throw new RuntimeException("Not implemented");
    }

    public int getMajorVersion() {
        throw new RuntimeException("Not implemented");
    }

    public int getMinorVersion() {
        throw new RuntimeException("Not implemented");
    }

    public String getMimeType(String file) {
        throw new RuntimeException("Not implemented");
    }

    public Set getResourcePaths(String path) {
        throw new RuntimeException("Not implemented");
    }

    public URL getResource(String path) throws MalformedURLException {
        throw new RuntimeException("Not implemented");
    }

    public InputStream getResourceAsStream(String path) {
        throw new RuntimeException("Not implemented");
    }

    public RequestDispatcher getRequestDispatcher(String path) {

        throw new RuntimeException("Not implemented");
    }

    public RequestDispatcher getNamedDispatcher(String name) {

        throw new RuntimeException("Not implemented");
    }

    public Servlet getServlet(String name) throws ServletException {

        throw new RuntimeException("Not implemented");
    }

    public Enumeration getServlets() {

        throw new RuntimeException("Not implemented");
    }

    public Enumeration getServletNames() {

        throw new RuntimeException("Not implemented");
    }

    public void log(String msg) {
        // NOOP
    }

    public void log(Exception exception, String msg) {
        // NOOP
    }

    public void log(String message, Throwable throwable) {
        // NOOP
    }

    public String getRealPath(String path) {

        throw new RuntimeException("Not implemented");
    }

    public String getServerInfo() {

        throw new RuntimeException("Not implemented");
    }

    public String getInitParameter(String name) {

        throw new RuntimeException("Not implemented");
    }

    public Enumeration getInitParameterNames() {

        throw new RuntimeException("Not implemented");
    }

    public Object getAttribute(String name) {

        throw new RuntimeException("Not implemented");
    }

    public Enumeration getAttributeNames() {

        throw new RuntimeException("Not implemented");
    }

    public void setAttribute(String name, Object object) {
        throw new RuntimeException("Not implemented");
    }

    public void removeAttribute(String name) {
        throw new RuntimeException("Not implemented");
    }

    public String getServletContextName() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public int getEffectiveMajorVersion() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public int getEffectiveMinorVersion() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public boolean setInitParameter(String name, String value) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Dynamic addServlet(String servletName, String className) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Dynamic addServlet(String servletName, Servlet servlet) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Dynamic addServlet(String servletName,
            Class<? extends Servlet> servletClass) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public <T extends Servlet> T createServlet(Class<T> c)
            throws ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public ServletRegistration getServletRegistration(String servletName) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Map<String, ? extends ServletRegistration> getServletRegistrations() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public javax.servlet.FilterRegistration.Dynamic addFilter(
            String filterName, String className) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public javax.servlet.FilterRegistration.Dynamic addFilter(
            String filterName, Filter filter) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public javax.servlet.FilterRegistration.Dynamic addFilter(
            String filterName, Class<? extends Filter> filterClass) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public <T extends Filter> T createFilter(Class<T> c)
            throws ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public FilterRegistration getFilterRegistration(String filterName) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Map<String, ? extends FilterRegistration> getFilterRegistrations() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public SessionCookieConfig getSessionCookieConfig() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public void setSessionTrackingModes(
            Set<SessionTrackingMode> sessionTrackingModes) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Set<SessionTrackingMode> getDefaultSessionTrackingModes() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Set<SessionTrackingMode> getEffectiveSessionTrackingModes() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public void addListener(String className) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public <T extends EventListener> void addListener(T t) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public void addListener(Class<? extends EventListener> listenerClass) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public <T extends EventListener> T createListener(Class<T> c)
            throws ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public JspConfigDescriptor getJspConfigDescriptor() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public ClassLoader getClassLoader() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public void declareRoles(String... roleNames) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public String getVirtualServerName() {
        throw new RuntimeException("Not implemented");
    }

}
  + native




package org.apache.catalina.filters;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.security.Principal;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Locale;
import java.util.Map;

import javax.servlet.AsyncContext;
import javax.servlet.DispatcherType;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletInputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import javax.servlet.http.HttpUpgradeHandler;
import javax.servlet.http.Part;

public class MockHttpServletRequest implements HttpServletRequest {

    private Map<String, Object> attributes = new HashMap<String, Object>();
    private Map<String, List<String>> headers = new HashMap<String, List<String>>();
    private String method;
    private String contentType;

    public Object getAttribute(String name) {
        return attributes.get(name);
    }

    public Enumeration getAttributeNames() {
        return Collections.enumeration(attributes.keySet());
    }

    public String getCharacterEncoding() {

        throw new RuntimeException("Not implemented");
    }

    public void setCharacterEncoding(String env)
            throws UnsupportedEncodingException {

    }

    public int getContentLength() {

        throw new RuntimeException("Not implemented");
    }

    public String getContentType() {
        return this.contentType;
    }

    public void setContentType(String contentType) {
        this.contentType = contentType;
    }

    public ServletInputStream getInputStream() throws IOException {

        throw new RuntimeException("Not implemented");
    }

    public String getParameter(String name) {

        throw new RuntimeException("Not implemented");
    }

    public Enumeration getParameterNames() {

        throw new RuntimeException("Not implemented");
    }

    public String[] getParameterValues(String name) {

        throw new RuntimeException("Not implemented");
    }

    public Map getParameterMap() {

        throw new RuntimeException("Not implemented");
    }

    public String getProtocol() {

        throw new RuntimeException("Not implemented");
    }

    public String getScheme() {

        throw new RuntimeException("Not implemented");
    }

    public String getServerName() {

        throw new RuntimeException("Not implemented");
    }

    public int getServerPort() {

        throw new RuntimeException("Not implemented");
    }

    public BufferedReader getReader() throws IOException {

        throw new RuntimeException("Not implemented");
    }

    public String getRemoteAddr() {

        throw new RuntimeException("Not implemented");
    }

    public String getRemoteHost() {

        throw new RuntimeException("Not implemented");
    }

    public void setAttribute(String name, Object o) {
        attributes.put(name, o);
    }

    public void removeAttribute(String name) {
        attributes.remove(name);
    }

    public Locale getLocale() {

        throw new RuntimeException("Not implemented");
    }

    public Enumeration getLocales() {

        throw new RuntimeException("Not implemented");
    }

    public boolean isSecure() {

        throw new RuntimeException("Not implemented");
    }

    public RequestDispatcher getRequestDispatcher(String path) {

        throw new RuntimeException("Not implemented");
    }

    public String getRealPath(String path) {

        throw new RuntimeException("Not implemented");
    }

    public int getRemotePort() {

        throw new RuntimeException("Not implemented");
    }

    public String getLocalName() {

        throw new RuntimeException("Not implemented");
    }

    public String getLocalAddr() {

        throw new RuntimeException("Not implemented");
    }

    public int getLocalPort() {

        throw new RuntimeException("Not implemented");
    }

    public String getAuthType() {

        throw new RuntimeException("Not implemented");
    }

    public Cookie[] getCookies() {

        throw new RuntimeException("Not implemented");
    }

    public long getDateHeader(String name) {

        throw new RuntimeException("Not implemented");
    }

    public String getHeader(String name) {
        List<String> list = headers.get(name);
        if (list != null) {
            return CORSFilter.join(new HashSet<String>(list), ",");
        }
        return null;
    }

    public void setHeader(String name, String value) {
        List<String> values = new ArrayList<String>();
        values.add(value);
        headers.put(name, values);
    }

    public Enumeration getHeaders(String name) {

        throw new RuntimeException("Not implemented");
    }

    public Enumeration getHeaderNames() {
        return Collections.enumeration(headers.keySet());
    }

    public int getIntHeader(String name) {

        throw new RuntimeException("Not implemented");
    }

    public String getMethod() {
        return method;
    }

    public void setMethod(String method) {
        this.method = method;
    }

    public String getPathInfo() {

        throw new RuntimeException("Not implemented");
    }

    public String getPathTranslated() {

        throw new RuntimeException("Not implemented");
    }

    public String getContextPath() {

        throw new RuntimeException("Not implemented");
    }

    public String getQueryString() {

        throw new RuntimeException("Not implemented");
    }

    public String getRemoteUser() {

        throw new RuntimeException("Not implemented");
    }

    public boolean isUserInRole(String role) {

        throw new RuntimeException("Not implemented");
    }

    public Principal getUserPrincipal() {

        throw new RuntimeException("Not implemented");
    }

    public String getRequestedSessionId() {

        throw new RuntimeException("Not implemented");
    }

    public String getRequestURI() {

        throw new RuntimeException("Not implemented");
    }

    public StringBuffer getRequestURL() {

        throw new RuntimeException("Not implemented");
    }

    public String getServletPath() {

        throw new RuntimeException("Not implemented");
    }

    public HttpSession getSession(boolean create) {

        throw new RuntimeException("Not implemented");
    }

    public HttpSession getSession() {

        throw new RuntimeException("Not implemented");
    }

    public boolean isRequestedSessionIdValid() {

        throw new RuntimeException("Not implemented");
    }

    public boolean isRequestedSessionIdFromCookie() {

        throw new RuntimeException("Not implemented");
    }

    public boolean isRequestedSessionIdFromURL() {

        throw new RuntimeException("Not implemented");
    }

    public boolean isRequestedSessionIdFromUrl() {

        throw new RuntimeException("Not implemented");
    }

    @Override
    public long getContentLengthLong() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public ServletContext getServletContext() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public AsyncContext startAsync() throws IllegalStateException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public AsyncContext startAsync(ServletRequest servletRequest,
            ServletResponse servletResponse) throws IllegalStateException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public boolean isAsyncStarted() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public boolean isAsyncSupported() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public AsyncContext getAsyncContext() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public DispatcherType getDispatcherType() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public String changeSessionId() {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public boolean authenticate(HttpServletResponse response)
            throws IOException, ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public void login(String username, String password) throws ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public void logout() throws ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Collection<Part> getParts() throws IOException, ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Part getPart(String name) throws IOException, ServletException {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public <T extends HttpUpgradeHandler> T upgrade(
            Class<T> httpUpgradeHandlerClass) throws IOException {
        throw new RuntimeException("Not implemented");
    }

}
  + native




package org.apache.catalina.filters;

import java.util.Enumeration;

import javax.servlet.FilterConfig;
import javax.servlet.ServletContext;

public class MockFilterConfigs {
    public static final String HTTPS_WWW_APACHE_ORG = "https://www.apache.org";
    public static final String HTTP_TOMCAT_APACHE_ORG =
            "http://tomcat.apache.org";
    public static final String EXPOSED_HEADERS = "X-CUSTOM-HEADER";
    /**
     * Any origin
     */
    public static final String ANY_ORIGIN = "*";

    public static final MockServletContext mockServletContext =
            new MockServletContext();

    public static FilterConfig getDefaultFilterConfig() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS;
        final String allowedOrigins = CORSFilter.DEFAULT_ALLOWED_ORIGINS;
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials =
                CORSFilter.DEFAULT_SUPPORTS_CREDENTIALS;
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getFilterConfigAnyOriginAndSupportsCredentials() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";
        final String allowedOrigins = CORSFilter.DEFAULT_ALLOWED_ORIGINS;
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials = "true";
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig
            getFilterConfigAnyOriginAndSupportsCredentialsDisabled() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";
        final String allowedOrigins = CORSFilter.DEFAULT_ALLOWED_ORIGINS;
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials = "false";
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig
            getFilterConfigSpecificOriginAndSupportsCredentialsDisabled() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";
        final String allowedOrigins =
                HTTP_TOMCAT_APACHE_ORG + "," + HTTPS_WWW_APACHE_ORG;
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials = "false";
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getFilterConfigWithExposedHeaders() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS;
        final String allowedOrigins = CORSFilter.DEFAULT_ALLOWED_ORIGINS;
        final String exposedHeaders = EXPOSED_HEADERS;
        final String supportCredentials =
                CORSFilter.DEFAULT_SUPPORTS_CREDENTIALS;
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getSecureFilterConfig() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";
        final String allowedOrigins = HTTPS_WWW_APACHE_ORG;
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials = "true";
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled = "true";
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getNullFilterConfig() {
        return generateFilterConfig(null, null, null, null, null, null, null,
                null);
    }

    public static FilterConfig getSpecificOriginFilterConfig() {
        final String allowedOrigins =
                HTTPS_WWW_APACHE_ORG + "," + HTTP_TOMCAT_APACHE_ORG;

        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials =
                CORSFilter.DEFAULT_SUPPORTS_CREDENTIALS;
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getSpecificOriginFilterConfigNegativeMaxAge() {
        final String allowedOrigins =
                HTTPS_WWW_APACHE_ORG + "," + HTTP_TOMCAT_APACHE_ORG;

        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS + ",PUT";
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials =
                CORSFilter.DEFAULT_SUPPORTS_CREDENTIALS;
        final String preflightMaxAge = "-1";
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getFilterConfigInvalidMaxPreflightAge() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS;
        final String allowedOrigins = CORSFilter.DEFAULT_ALLOWED_ORIGINS;
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials =
                CORSFilter.DEFAULT_SUPPORTS_CREDENTIALS;
        final String preflightMaxAge = "abc";
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = CORSFilter.DEFAULT_DECORATE_REQUEST;

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getEmptyFilterConfig() {
        final String allowedHttpHeaders = "";
        final String allowedHttpMethods = "";
        final String allowedOrigins = "";
        final String exposedHeaders = "";
        final String supportCredentials = "";
        final String preflightMaxAge = "";
        final String loggingEnabled = "";
        final String decorateRequest = "";

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    public static FilterConfig getFilterConfigDecorateRequestDisabled() {
        final String allowedHttpHeaders =
                CORSFilter.DEFAULT_ALLOWED_HTTP_HEADERS;
        final String allowedHttpMethods =
                CORSFilter.DEFAULT_ALLOWED_HTTP_METHODS;
        final String allowedOrigins = CORSFilter.DEFAULT_ALLOWED_ORIGINS;
        final String exposedHeaders = CORSFilter.DEFAULT_EXPOSED_HEADERS;
        final String supportCredentials =
                CORSFilter.DEFAULT_SUPPORTS_CREDENTIALS;
        final String preflightMaxAge =
                CORSFilter.DEFAULT_PREFLIGHT_MAXAGE;
        final String loggingEnabled =
                CORSFilter.DEFAULT_LOGGING_ENABLED;
        final String decorateRequest = "false";

        return generateFilterConfig(allowedHttpHeaders, allowedHttpMethods,
                allowedOrigins, exposedHeaders, supportCredentials,
                preflightMaxAge, loggingEnabled, decorateRequest);
    }

    private static FilterConfig generateFilterConfig(
            final String allowedHttpHeaders, final String allowedHttpMethods,
            final String allowedOrigins, final String exposedHeaders,
            final String supportCredentials, final String preflightMaxAge,
            final String loggingEnabled, final String decorateRequest) {
        FilterConfig filterConfig = new FilterConfig() {

            public String getFilterName() {
                return "cors-filter";
            }

            public ServletContext getServletContext() {
                return mockServletContext;
            }

            public String getInitParameter(String name) {
                if (CORSFilter.PARAM_CORS_ALLOWED_HEADERS
                        .equalsIgnoreCase(name)) {
                    return allowedHttpHeaders;
                } else if (CORSFilter.PARAM_CORS_ALLOWED_METHODS
                        .equalsIgnoreCase(name)) {
                    return allowedHttpMethods;
                } else if (CORSFilter.PARAM_CORS_ALLOWED_ORIGINS
                        .equalsIgnoreCase(name)) {
                    return allowedOrigins;
                } else if (CORSFilter.PARAM_CORS_EXPOSED_HEADERS
                        .equalsIgnoreCase(name)) {
                    return exposedHeaders;
                } else if (CORSFilter.PARAM_CORS_SUPPORT_CREDENTIALS
                        .equalsIgnoreCase(name)) {
                    return supportCredentials;
                } else if (CORSFilter.PARAM_CORS_PREFLIGHT_MAXAGE
                        .equalsIgnoreCase(name)) {
                    return preflightMaxAge;
                } else if (CORSFilter.PARAM_CORS_LOGGING_ENABLED
                        .equalsIgnoreCase(name)) {
                    return loggingEnabled;
                } else if (CORSFilter.PARAM_CORS_REQUEST_DECORATE
                        .equalsIgnoreCase(name)) {
                    return decorateRequest;
                }
                return null;
            }

            @SuppressWarnings("rawtypes")
            public Enumeration getInitParameterNames() {
                return null;
            }
        };

        return filterConfig;
    }
}
  + native




package org.apache.catalina.filters;

import java.io.IOException;
import java.util.LinkedHashSet;
import java.util.Set;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.junit.Assert;
import org.junit.Test;

public class TestCORSFilter {
    private FilterChain filterChain = new MockFilterChain();

    /**
     * Tests if a GET request is treated as simple request.
     * 
     * @See http://www.w3.org/TR/cors/#simple-method
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterSimpleGET() throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("GET");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                "https://www.apache.org"));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    /**
     * Tests if a POST request is treated as simple request.
     * 
     * @See http://www.w3.org/TR/cors/#simple-method
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterSimplePOST() throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setContentType("text/plain");
        request.setMethod("POST");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                "https://www.apache.org"));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    /**
     * Tests if a HEAD request is treated as simple request.
     * 
     * @See http://www.w3.org/TR/cors/#simple-method
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterSimpleHEAD() throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("HEAD");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                "https://www.apache.org"));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    /**
     * Test the presence of specific origin in response, when '*' is not used.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterSimpleSpecificHeader() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("POST");
        request.setContentType("text/plain");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    /**
     * Tests the prsence of the origin (and not '*') in the response, when
     * supports credentials is enabled alongwith any origin, '*'.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterSimpleAnyOriginAndSupportsCredentials()
            throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("GET");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getFilterConfigAnyOriginAndSupportsCredentials());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS)
                .equals(
                        "true"));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    /**
     * Tests the presence of the origin (and not '*') in the response, when
     * supports credentials is enabled alongwith any origin, '*'.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterSimpleAnyOriginAndSupportsCredentialsDisabled()
            throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("GET");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getFilterConfigAnyOriginAndSupportsCredentialsDisabled());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.ANY_ORIGIN));
        Assert.assertNull(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    /**
     * Tests the presence of exposed headers in response, if configured.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterSimpleWithExposedHeaders() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("POST");
        request.setContentType("text/plain");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getFilterConfigWithExposedHeaders());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                "https://www.apache.org"));
        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS)
                .equals(MockFilterConfigs.EXPOSED_HEADERS));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    /**
     * Checks if an OPTIONS request is processed as pre-flight.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterPreflight() throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.PRE_FLIGHT.name().toLowerCase()));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS).equals(
                "Content-Type"));
    }

    /**
     * Checks if an OPTIONS request is processed as pre-flight where any origin
     * is enabled.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterPreflightAnyOrigin() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.PRE_FLIGHT.name().toLowerCase()));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS).equals(
                "Content-Type"));
    }

    /**
     * Checks if an OPTIONS request is processed as pre-flight.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test
    public void testDoFilterPreflightInvalidOrigin() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://www.example.com");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertEquals(response.getStatus(),
                HttpServletResponse.SC_FORBIDDEN);
    }

    @Test
    public void testDoFilterPreflightNegativeMaxAge() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfigNegativeMaxAge());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertNull(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.PRE_FLIGHT.name().toLowerCase()));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS).equals(
                "Content-Type"));
    }

    @Test
    public void testDoFilterPreflightWithCredentials() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSecureFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS)
                .equals("true"));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.PRE_FLIGHT.name().toLowerCase()));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS).equals(
                "Content-Type"));
    }

    @Test
    public void testDoFilterPreflightWithoutCredentialsAndSpecificOrigin()
            throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getFilterConfigSpecificOriginAndSupportsCredentialsDisabled());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertNull(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.PRE_FLIGHT.name().toLowerCase()));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS).equals(
                "Content-Type"));
    }

    /**
     * Negative test, when a CORS request arrives, with a null origin.
     */
    @Test
    public void testDoFilterNullOrigin() throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();

        request.setMethod("POST");
        request.setContentType("text/plain");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.NOT_CORS, requestType);

        corsFilter.doFilter(request, response, filterChain);

        Assert.assertFalse((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
    }

    @Test
    public void testDoFilterInvalidCORSOriginNotAllowed() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "www.google.com");
        request.setMethod("POST");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    @Test(expected = ServletException.class)
    public void testDoFilterNullRequestNullResponse() throws IOException,
            ServletException {
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        corsFilter.doFilter(null, null, filterChain);
    }

    @Test(expected = ServletException.class)
    public void testDoFilterNullRequestResponse() throws IOException,
            ServletException {
        MockHttpServletResponse response = new MockHttpServletResponse();
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        corsFilter.doFilter(null, response, filterChain);
    }

    @Test(expected = ServletException.class)
    public void testDoFilterRequestNullResponse() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        corsFilter.doFilter(request, null, filterChain);
    }

    @Test
    public void testInitDefaultFilterConfig() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("GET");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(null);
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                "https://www.apache.org"));
        Assert.assertTrue((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN).equals(
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG));
        Assert.assertTrue(request.getAttribute(
                CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE).equals(
                CORSFilter.CORSRequestType.SIMPLE.name().toLowerCase()));
    }

    @Test(expected = ServletException.class)
    public void testInitInvalidFilterConfig() throws IOException,
            ServletException {
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getFilterConfigInvalidMaxPreflightAge());
        // If we don't get an exception at this point, then all mocked objects
        // worked as expected.
    }

    /**
     * Tests if a non-simple request is given to simple request handler.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test(expected = IllegalArgumentException.class)
    public void testNotSimple() throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        corsFilter.handleSimpleCORS(request, response, filterChain);
    }

    /**
     * When a non-preflight request is given to a pre-flight requets handler.
     * 
     * @throws IOException
     * @throws ServletException
     */
    @Test(expected = IllegalArgumentException.class)
    public void testNotPreflight() throws IOException, ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("GET");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getDefaultFilterConfig());
        corsFilter.handlePreflightCORS(request, response, filterChain);
    }

    @Test(expected = IllegalArgumentException.class)
    public void testDecorateCORSPropertiesNullRequestNullCORSRequestType() {
        CORSFilter.decorateCORSProperties(null, null);
    }

    @Test(expected = IllegalArgumentException.class)
    public void testDecorateCORSPropertiesNullRequestValidCORSRequestType() {
        CORSFilter.decorateCORSProperties(null,
                CORSFilter.CORSRequestType.SIMPLE);
    }

    @Test(expected = IllegalArgumentException.class)
    public void testDecorateCORSPropertiesValidRequestNullRequestType() {
        MockHttpServletRequest request = new MockHttpServletRequest();
        CORSFilter.decorateCORSProperties(request, null);
    }

    @Test
    public void testDecorateCORSPropertiesCORSRequestTypeNotCORS() {
        MockHttpServletRequest request = new MockHttpServletRequest();
        CORSFilter.decorateCORSProperties(request,
                CORSFilter.CORSRequestType.NOT_CORS);
        Assert.assertFalse((Boolean) request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
    }

    @Test
    public void testDecorateCORSPropertiesCORSRequestTypeInvalidCORS() {
        MockHttpServletRequest request = new MockHttpServletRequest();
        CORSFilter
                .decorateCORSProperties(request,
                        CORSFilter.CORSRequestType.INVALID_CORS);
        Assert.assertNull(request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
    }

    @Test
    public void testCheckSimpleRequestTypeAnyOrigin() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://www.w3.org");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.SIMPLE, requestType);
    }

    /**
     * Happy path test, when a valid CORS Simple request arrives.
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckSimpleRequestType() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.SIMPLE, requestType);
    }

    /**
     * Happy path test, when a valid CORS Simple request arrives.
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckActualRequestType() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setMethod("PUT");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.ACTUAL, requestType);
    }

    /**
     * Happy path test, when a valid CORS Simple request arrives.
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckActualRequestTypeMethodPOSTNotSimpleHeaders()
            throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setMethod("POST");
        request.setContentType("application/json");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.ACTUAL, requestType);
    }

    /**
     * Happy path test, when a valid CORS Pre-flight request arrives.
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckPreFlightRequestType() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Content-Type");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.PRE_FLIGHT, requestType);
    }

    /**
     * when a valid CORS Pre-flight request arrives, with no
     * Access-Control-Request-Method
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckPreFlightRequestTypeNoACRM() throws ServletException,
            IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);

        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.ACTUAL, requestType);
    }

    /**
     * when a valid CORS Pre-flight request arrives, with empty
     * Access-Control-Request-Method
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckPreFlightRequestTypeEmptyACRM()
            throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    /**
     * Happy path test, when a valid CORS Pre-flight request arrives.
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckPreFlightRequestTypeNoHeaders()
            throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "PUT");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.PRE_FLIGHT, requestType);
    }

    /**
     * Section 6.2.3
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckPreFlightRequestTypeInvalidRequestMethod()
            throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "POLITE");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * Section Section 6.2.5
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckPreFlightRequestTypeUnsupportedRequestMethod()
            throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "TRACE");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * Section Section 6.2.6
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckPreFlightRequestTypeUnsupportedRequestHeaders()
            throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "X-ANSWER");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSecureFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * Section Section 6.2.7
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckPreFlightRequestTypeAnyOriginNoWithCredentials()
            throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "Origin");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getFilterConfigAnyOriginAndSupportsCredentialsDisabled());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                "*"));
        Assert.assertNull(response
                .getHeader(CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS));
    }

    @Test
    public void testCheckPreFlightRequestTypeOriginNotAllowed()
            throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "www.ebay.com");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "PUT");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSecureFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * Happy path test, when a valid CORS Pre-flight request arrives.
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckPreFlightRequestTypeEmptyHeaders()
            throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTP_TOMCAT_APACHE_ORG);
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
                "PUT");
        request.setHeader(
                CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
                "");
        request.setMethod("OPTIONS");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.PRE_FLIGHT, requestType);
    }

    /**
     * Negative test, when a CORS request arrives, with an empty origin.
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckNotCORSRequestTypeEmptyOrigin()
            throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    /**
     * Tests for failure, when a different domain is used, that's not in the
     * allowed list of origins.
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckInvalidOrigin() throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "www.example.com");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * Tests for failure, when a different sub-domain is used, that's not in the
     * allowed list of origins.
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckInvalidOriginNotAllowedSubdomain()
            throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://commons.apache.org");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * PUT is not an allowed request method.
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckInvalidRequestMethod() throws ServletException,
            IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://tomcat.apache.org");
        request.setMethod("PUT");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * When requestMethod is null
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckNullRequestMethod() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://tomcat.apache.org");
        request.setMethod(null);
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    /**
     * "http://tomcat.apache.org" is an allowed origin and
     * "https://tomcat.apache.org" is not, because scheme doesn't match
     * 
     * @throws ServletException
     */
    @Test
    public void testCheckForSchemeVariance() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "https://tomcat.apache.org");
        request.setMethod("POST");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    /**
     * "http://tomcat.apache.org" is an allowed origin and
     * "http://tomcat.apache.org:8080" is not, because ports doesn't match
     * 
     * @throws ServletException
     * @throws IOException
     */
    @Test
    public void testCheckForPortVariance() throws ServletException, IOException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        MockHttpServletResponse response = new MockHttpServletResponse();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://tomcat.apache.org:8080");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getSpecificOriginFilterConfig());
        corsFilter.doFilter(request, response, filterChain);
        Assert.assertEquals(HttpServletResponse.SC_FORBIDDEN,
                response.getStatus());
    }

    /**
     * Tests for failure, when an invalid {@link HttpServletRequest} is
     * encountered.
     * 
     * @throws ServletException
     */
    @Test(expected = IllegalArgumentException.class)
    public void testCheckRequestTypeNull() throws ServletException {
        HttpServletRequest request = null;
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.checkRequestType(request);
    }

    @Test
    public void testJoin() {
        Set<String> elements = new LinkedHashSet<String>();
        String separator = ",";
        elements.add("world");
        elements.add("peace");
        String join = CORSFilter.join(elements, separator);
        Assert.assertTrue("world,peace".equals(join));
    }

    @Test
    public void testJoinSingleElement() {
        Set<String> elements = new LinkedHashSet<String>();
        String separator = ",";
        elements.add("world");
        String join = CORSFilter.join(elements, separator);
        Assert.assertTrue("world".equals(join));
    }

    @Test
    public void testJoinSepNull() {
        Set<String> elements = new LinkedHashSet<String>();
        String separator = null;
        elements.add("world");
        elements.add("peace");
        String join = CORSFilter.join(elements, separator);
        Assert.assertTrue("world,peace".equals(join));
    }

    @Test
    public void testJoinElementsNull() {
        Set<String> elements = null;
        String separator = ",";
        String join = CORSFilter.join(elements, separator);

        Assert.assertNull(join);
    }

    @Test
    public void testJoinOneNullElement() {
        Set<String> elements = new LinkedHashSet<String>();
        String separator = ",";
        elements.add(null);
        elements.add("peace");
        String join = CORSFilter.join(elements, separator);
        Assert.assertTrue(",peace".equals(join));
    }

    @Test
    public void testJoinAllNullElements() {
        Set<String> elements = new LinkedHashSet<String>();
        String separator = ",";
        elements.add(null);
        elements.add(null);
        String join = CORSFilter.join(elements, separator);
        Assert.assertTrue("".equals(join));
    }

    @Test
    public void testJoinAllEmptyElements() {
        Set<String> elements = new LinkedHashSet<String>();
        String separator = ",";
        elements.add("");
        elements.add("");
        String join = CORSFilter.join(elements, separator);
        Assert.assertTrue("".equals(join));
    }

    @Test
    public void testJoinPipeSeparator() {
        Set<String> elements = new LinkedHashSet<String>();
        String separator = "|";
        elements.add("world");
        elements.add("peace");
        String join = CORSFilter.join(elements, separator);
        Assert.assertTrue("world|peace".equals(join));
    }

    @Test
    public void testWithFilterConfig() throws ServletException {
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        Assert.assertTrue(corsFilter.getAllowedHttpHeaders().size() == 6);
        Assert.assertTrue(corsFilter.getAllowedHttpMethods().size() == 4);
        Assert.assertTrue(corsFilter.getAllowedOrigins().size() == 0);
        Assert.assertTrue(corsFilter.isAnyOriginAllowed());
        Assert.assertTrue(corsFilter.getExposedHeaders().size() == 0);
        Assert.assertTrue(corsFilter.isSupportsCredentials());
        Assert.assertTrue(corsFilter.getPreflightMaxAge() == 1800);
        Assert.assertTrue(!corsFilter.isLoggingEnabled());
    }

    @Test(expected = ServletException.class)
    public void testWithFilterConfigInvalidPreflightAge()
            throws ServletException {
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getFilterConfigInvalidMaxPreflightAge());
    }

    @Test
    public void testWithStringParserEmpty() throws ServletException {
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getEmptyFilterConfig());
        Assert.assertTrue(corsFilter.getAllowedHttpHeaders().size() == 0);
        Assert.assertTrue(corsFilter.getAllowedHttpMethods().size() == 0);
        Assert.assertTrue(corsFilter.getAllowedOrigins().size() == 0);
        Assert.assertTrue(corsFilter.getExposedHeaders().size() == 0);
        Assert.assertFalse(corsFilter.isSupportsCredentials());
        Assert.assertTrue(corsFilter.getPreflightMaxAge() == 0);
        Assert.assertTrue(!corsFilter.isLoggingEnabled());
    }

    /**
     * If an init param is null, it's default value will be used.
     * 
     * @throws ServletException
     */
    @Test
    public void testWithStringParserNull() throws ServletException {
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getNullFilterConfig());
        Assert.assertTrue(corsFilter.getAllowedHttpHeaders().size() == 6);
        Assert.assertTrue(corsFilter.getAllowedHttpMethods().size() == 4);
        Assert.assertTrue(corsFilter.getAllowedOrigins().size() == 0);
        Assert.assertTrue(corsFilter.isAnyOriginAllowed());
        Assert.assertTrue(corsFilter.getExposedHeaders().size() == 0);
        Assert.assertTrue(corsFilter.isSupportsCredentials());
        Assert.assertTrue(corsFilter.getPreflightMaxAge() == 1800);
        Assert.assertTrue(!corsFilter.isLoggingEnabled());
    }

    @Test
    public void testValidOrigin() {
        Assert.assertTrue(CORSFilter.isValidOrigin("http://www.w3.org"));
    }

    @Test
    public void testInValidOriginCRLF() {
        Assert.assertFalse(CORSFilter.isValidOrigin("http://www.w3.org\r\n"));
    }

    @Test
    public void testInValidOriginEncodedCRLF1() {
        Assert.assertFalse(CORSFilter.isValidOrigin("http://www.w3.org%0d%0a"));
    }

    @Test
    public void testInValidOriginEncodedCRLF2() {
        Assert.assertFalse(CORSFilter.isValidOrigin("http://www.w3.org%0D%0A"));
    }

    @Test
    public void testInValidOriginEncodedCRLF3() {
        Assert.assertFalse(CORSFilter
                .isValidOrigin("http://www.w3.org%0%0d%0ad%0%0d%0aa"));
    }

    @Test
    public void testCheckInvalidCRLF1() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://www.w3.org\r\n");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    @Test
    public void testCheckInvalidCRLF2() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://www.w3.org\r\n");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    @Test
    public void testCheckInvalidCRLF3() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://www.w3.org%0d%0a");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    @Test
    public void testCheckInvalidCRLF4() throws ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                "http://www.w3.org%0D%0A");
        request.setMethod("GET");
        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs
                .getDefaultFilterConfig());
        CORSFilter.CORSRequestType requestType =
                corsFilter.checkRequestType(request);
        Assert.assertEquals(CORSFilter.CORSRequestType.INVALID_CORS,
                requestType);
    }

    @Test
    public void testDecorateRequestDisabled() throws IOException,
            ServletException {
        MockHttpServletRequest request = new MockHttpServletRequest();
        request.setHeader(CORSFilter.REQUEST_HEADER_ORIGIN,
                MockFilterConfigs.HTTPS_WWW_APACHE_ORG);
        request.setMethod("GET");
        MockHttpServletResponse response = new MockHttpServletResponse();

        CORSFilter corsFilter = new CORSFilter();
        corsFilter.init(MockFilterConfigs.getFilterConfigDecorateRequestDisabled());
        corsFilter.doFilter(request, response, filterChain);

        Assert.assertTrue(response.getHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN).equals(
                "https://www.apache.org"));
        Assert.assertNull(request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST));
        Assert.assertNull(request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN));
        Assert.assertNull(request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS));
        Assert.assertNull(request
                .getAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE));
    }

    @Test
    public void testDestroy() {
        // Nothing to test.
        // NO-OP
    }
}
  + native




package org.apache.catalina.filters;

import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringWriter;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Locale;

import javax.servlet.ServletOutputStream;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;

public class MockHttpServletResponse implements HttpServletResponse {
    List headerNames = new ArrayList();
    List headerValues = new ArrayList();
    PrintWriter pw;
    int status;

    public String getCharacterEncoding() {

        throw new RuntimeException("Not implemented");
    }

    public String getContentType() {

        throw new RuntimeException("Not implemented");
    }

    public ServletOutputStream getOutputStream() throws IOException {

        throw new RuntimeException("Not implemented");
    }

    public PrintWriter getWriter() throws IOException {
        if (pw == null) {
            pw = new PrintWriter(new StringWriter());
        }
        return pw;
    }

    public void setCharacterEncoding(String charset) {
        throw new RuntimeException("Not implemented");
    }

    public void setContentLength(int len) {
        throw new RuntimeException("Not implemented");
    }

    public void setContentType(String type) {

    }

    public void setBufferSize(int size) {
        throw new RuntimeException("Not implemented");
    }

    public int getBufferSize() {
        throw new RuntimeException("Not implemented");
    }

    public void flushBuffer() throws IOException {
        throw new RuntimeException("Not implemented");
    }

    public void resetBuffer() {
    }

    public boolean isCommitted() {
        throw new RuntimeException("Not implemented");
    }

    public void reset() {

    }

    public void setLocale(Locale loc) {
        throw new RuntimeException("Not implemented");
    }

    public Locale getLocale() {

        throw new RuntimeException("Not implemented");
    }

    public void addCookie(Cookie cookie) {
        throw new RuntimeException("Not implemented");
    }

    public boolean containsHeader(String name) {
        throw new RuntimeException("Not implemented");
    }

    public String encodeURL(String url) {

        throw new RuntimeException("Not implemented");
    }

    public String encodeRedirectURL(String url) {

        throw new RuntimeException("Not implemented");
    }

    public String encodeUrl(String url) {

        throw new RuntimeException("Not implemented");
    }

    public String encodeRedirectUrl(String url) {

        throw new RuntimeException("Not implemented");
    }

    public void sendError(int sc, String msg) throws IOException {

    }

    public void sendError(int sc) throws IOException {

    }

    public void sendRedirect(String location) throws IOException {
        throw new RuntimeException("Not implemented");
    }

    public void setDateHeader(String name, long date) {
        throw new RuntimeException("Not implemented");
    }

    public void addDateHeader(String name, long date) {
        throw new RuntimeException("Not implemented");
    }

    public String getHeader(String name) {
        int index = headerNames.indexOf(name);
        if (index != -1) {
            return (String) headerValues.get(index);
        }
        return null;
    }

    public void setHeader(String name, String value) {
        int index = headerNames.indexOf(name);
        if (index != -1) {
            headerValues.set(index, value);
        } else {
            headerNames.add(name);
            headerValues.add(value);
        }
    }

    public void addHeader(String name, String value) {
        headerNames.add(name);
        headerValues.add(value);
    }

    public void setIntHeader(String name, int value) {
        throw new RuntimeException("Not implemented");
    }

    public void addIntHeader(String name, int value) {
        throw new RuntimeException("Not implemented");
    }

    public void setStatus(int sc) {
        this.status = sc;
    }

    public int getStatus() {
        return this.status;
    }

    public void setStatus(int sc, String sm) {

    }

    @Override
    public void setContentLengthLong(long length) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Collection<String> getHeaders(String name) {
        throw new RuntimeException("Not implemented");
    }

    @Override
    public Collection<String> getHeaderNames() {
        throw new RuntimeException("Not implemented");
    }

}
  + native




package org.apache.catalina.filters;

import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.Arrays;
import java.util.Collection;
import java.util.HashSet;
import java.util.LinkedList;
import java.util.List;
import java.util.Set;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * <p>
 * A {@link Filter} that enable client-side cross-origin requests by
 * implementing W3C's CORS (<b>C</b>ross-<b>O</b>rigin <b>R</b>esource
 * <b>S</b>haring) specification for resources. Each {@link HttpServletRequest}
 * request is inspected as per specification, and appropriate response headers
 * are added to {@link HttpServletResponse}.
 * </p>
 * 
 * <p>
 * By default, it also sets following request attributes, that helps to
 * determine nature of request downstream.
 * <ul>
 * <li><b>cors.isCorsRequest:</b> Flag to determine if request is a CORS
 * request. Set to <code>true</code> if CORS request; <code>false</code>
 * otherwise.</li>
 * <li><b>cors.request.origin:</b> The Origin URL, i.e. the URL of the page from
 * where the request is originated.</li>
 * <li>
 * <b>cors.request.type:</b> Type of request. Possible values:
 * <ul>
 * <li>SIMPLE: A request which is not preceded by a pre-flight request.</li>
 * <li>ACTUAL: A request which is preceded by a pre-flight request.</li>
 * <li>PRE_FLIGHT: A pre-flight request.</li>
 * <li>NOT_CORS: A normal same-origin request.</li>
 * <li>INVALID_CORS: A cross-origin request, which is invalid.</li>
 * </ul>
 * </li>
 * <li><b>cors.request.headers:</b> Request headers sent as
 * 'Access-Control-Request-Headers' header, for pre-flight request.</li>
 * </ul>
 * </p>
 * 
 * @author Mohit Soni
 * @see <a href="http://www.w3.org/TR/cors/">CORS specification</a>
 * 
 */
public final class CORSFilter implements Filter {
    // ----------------------------------------------------- Instance variables
    /**
     * Holds filter configuration.
     */
    private FilterConfig filterConfig;

    /**
     * A {@link Collection} of origins consisting of zero or more origins that
     * are allowed access to the resource.
     */
    private final Collection<String> allowedOrigins;

    /**
     * Determines if any origin is allowed to make request.
     */
    private boolean anyOriginAllowed;

    /**
     * A {@link Collection} of methods consisting of zero or more methods that
     * are supported by the resource.
     */
    private final Collection<String> allowedHttpMethods;

    /**
     * A {@link Collection} of headers consisting of zero or more header field
     * names that are supported by the resource.
     */
    private final Collection<String> allowedHttpHeaders;

    /**
     * A {@link Collection} of exposed headers consisting of zero or more header
     * field names of headers other than the simple response headers that the
     * resource might use and can be exposed.
     */
    private final Collection<String> exposedHeaders;

    /**
     * A supports credentials flag that indicates whether the resource supports
     * user credentials in the request. It is true when the resource does and
     * false otherwise.
     */
    private boolean supportsCredentials;

    /**
     * Indicates (in seconds) how long the results of a pre-flight request can
     * be cached in a pre-flight result cache.
     */
    private long preflightMaxAge;

    /**
     * Controls access log logging.
     */
    private boolean loggingEnabled;

    /**
     * Determines if the request should be decorated or not.
     */
    private boolean decorateRequest;

    // --------------------------------------------------------- Constructor(s)
    public CORSFilter() {
        this.allowedOrigins = new HashSet<String>();
        this.allowedHttpMethods = new HashSet<String>();
        this.allowedHttpHeaders = new HashSet<String>();
        this.exposedHeaders = new HashSet<String>();
    }

    // --------------------------------------------------------- Public methods
    @Override
    public void doFilter(final ServletRequest servletRequest,
            final ServletResponse servletResponse, final FilterChain filterChain)
            throws IOException, ServletException {
        if (!(servletRequest instanceof HttpServletRequest)
                || !(servletResponse instanceof HttpServletResponse)) {
            String message = "CORS doesn't support non-HTTP request or response.";
            throw new ServletException(message);
        }

        // Safe to downcast at this point.
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;

        // Determines the CORS request type.
        CORSFilter.CORSRequestType requestType = checkRequestType(request);

        // Adds CORS specific attributes to request.
        if (decorateRequest) {
            CORSFilter.decorateCORSProperties(request, requestType);
        }
        switch (requestType) {
        case SIMPLE:
            // Handles a Simple CORS request.
            this.handleSimpleCORS(request, response, filterChain);
            break;
        case ACTUAL:
            // Handles an Actual CORS request.
            this.handleSimpleCORS(request, response, filterChain);
            break;
        case PRE_FLIGHT:
            // Handles a Pre-flight CORS request.
            this.handlePreflightCORS(request, response, filterChain);
            break;
        case NOT_CORS:
            // Handles a Normal request that is not a cross-origin request.
            this.handleNonCORS(request, response, filterChain);
            break;
        default:
            // Handles a CORS request that violates specification.
            this.handleInvalidCORS(request, response, filterChain);
            break;
        }
    }

    @Override
    public void init(final FilterConfig filterConfig) throws ServletException {
        // Initialize defaults
        parseAndStore(DEFAULT_ALLOWED_ORIGINS, DEFAULT_ALLOWED_HTTP_METHODS,
                DEFAULT_ALLOWED_HTTP_HEADERS, DEFAULT_EXPOSED_HEADERS,
                DEFAULT_SUPPORTS_CREDENTIALS, DEFAULT_PREFLIGHT_MAXAGE,
                DEFAULT_LOGGING_ENABLED, DEFAULT_DECORATE_REQUEST);

        this.filterConfig = filterConfig;
        this.loggingEnabled = false;

        if (filterConfig != null) {
            String configAllowedOrigins = filterConfig
                    .getInitParameter(PARAM_CORS_ALLOWED_ORIGINS);
            String configAllowedHttpMethods = filterConfig
                    .getInitParameter(PARAM_CORS_ALLOWED_METHODS);
            String configAllowedHttpHeaders = filterConfig
                    .getInitParameter(PARAM_CORS_ALLOWED_HEADERS);
            String configExposedHeaders = filterConfig
                    .getInitParameter(PARAM_CORS_EXPOSED_HEADERS);
            String configSupportsCredentials = filterConfig
                    .getInitParameter(PARAM_CORS_SUPPORT_CREDENTIALS);
            String configPreflightMaxAge = filterConfig
                    .getInitParameter(PARAM_CORS_PREFLIGHT_MAXAGE);
            String configLoggingEnabled = filterConfig
                    .getInitParameter(PARAM_CORS_LOGGING_ENABLED);
            String configDecorateRequest = filterConfig
                    .getInitParameter(PARAM_CORS_REQUEST_DECORATE);

            parseAndStore(configAllowedOrigins, configAllowedHttpMethods,
                    configAllowedHttpHeaders, configExposedHeaders,
                    configSupportsCredentials, configPreflightMaxAge,
                    configLoggingEnabled, configDecorateRequest);
        }
    }

    // --------------------------------------------------------------- Handlers
    /**
     * Handles a CORS request of type {@link CORSRequestType}.SIMPLE.
     * 
     * @param request
     *            The {@link HttpServletRequest} object.
     * @param response
     *            The {@link HttpServletResponse} object.
     * @param filterChain
     *            The {@link FilterChain} object.
     * @throws IOException
     * @throws ServletException
     * @see <a href="http://www.w3.org/TR/cors/#resource-requests">Simple
     *      Cross-Origin Request, Actual Request, and Redirects</a>
     */
    public void handleSimpleCORS(final HttpServletRequest request,
            final HttpServletResponse response, final FilterChain filterChain)
            throws IOException, ServletException {
        CORSFilter.CORSRequestType requestType = checkRequestType(request);
        if (!(requestType == CORSFilter.CORSRequestType.SIMPLE || requestType == CORSFilter.CORSRequestType.ACTUAL)) {
            String message = "Expects a HttpServletRequest object of type "
                    + CORSFilter.CORSRequestType.SIMPLE + " or "
                    + CORSFilter.CORSRequestType.ACTUAL;
            throw new IllegalArgumentException(message);
        }

        final String origin = request
                .getHeader(CORSFilter.REQUEST_HEADER_ORIGIN);
        final String method = request.getMethod();

        // Section 6.1.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response, filterChain);
            return;
        }

        if (!allowedHttpMethods.contains(method)) {
            handleInvalidCORS(request, response, filterChain);
            return;
        }

        // Section 6.1.3
        // Add a single Access-Control-Allow-Origin header.
        if (anyOriginAllowed && !supportsCredentials) {
            // If resource doesn't support credentials and if any origin is
            // allowed
            // to make CORS request, return header with '*'.
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN, "*");
        } else {
            // If the resource supports credentials add a single
            // Access-Control-Allow-Origin header, with the value of the Origin
            // header as value.
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
        }
        // Section 6.1.3
        // If the resource supports credentials, add a single
        // Access-Control-Allow-Credentials header with the case-sensitive
        // string "true" as value.
        if (supportsCredentials) {
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        }

        // Section 6.1.4
        // If the list of exposed headers is not empty add one or more
        // Access-Control-Expose-Headers headers, with as values the header
        // field names given in the list of exposed headers.
        if ((exposedHeaders != null) && (exposedHeaders.size() > 0)) {
            String exposedHeadersString = join(exposedHeaders, ",");
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS,
                    exposedHeadersString);
        }

        // Forward the request down the filter chain.
        filterChain.doFilter(request, response);
    }

    /**
     * Handles CORS pre-flight request.
     * 
     * @param request
     *            The {@link HttpServletRequest} object.
     * @param response
     *            The {@link HttpServletResponse} object.
     * @param filterChain
     *            The {@link FilterChain} object.
     * @throws IOException
     * @throws ServletException
     */
    public void handlePreflightCORS(final HttpServletRequest request,
            final HttpServletResponse response, final FilterChain filterChain)
            throws IOException, ServletException {
        CORSRequestType requestType = checkRequestType(request);
        if (requestType != CORSRequestType.PRE_FLIGHT) {
            throw new IllegalArgumentException(
                    "Expects a HttpServletRequest object of type "
                            + CORSRequestType.PRE_FLIGHT.name().toLowerCase());
        }

        final String origin = request
                .getHeader(CORSFilter.REQUEST_HEADER_ORIGIN);

        // Section 6.2.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response, filterChain);
            return;
        }

        // Section 6.2.3
        String accessControlRequestMethod = request
                .getHeader(CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD);
        if (accessControlRequestMethod == null
                || (!HTTP_METHODS.contains(accessControlRequestMethod.trim()))) {
            handleInvalidCORS(request, response, filterChain);
            return;
        } else {
            accessControlRequestMethod = accessControlRequestMethod.trim();
        }

        // Section 6.2.4
        String accessControlRequestHeadersHeader = request
                .getHeader(CORSFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);
        List<String> accessControlRequestHeaders = new LinkedList<String>();
        if (accessControlRequestHeadersHeader != null
                && !accessControlRequestHeadersHeader.trim().isEmpty()) {
            String[] headers = accessControlRequestHeadersHeader.trim().split(
                    ",");
            for (String header : headers) {
                accessControlRequestHeaders.add(header.trim().toLowerCase());
            }
        }

        // Section 6.2.5
        if (!allowedHttpMethods.contains(accessControlRequestMethod)) {
            handleInvalidCORS(request, response, filterChain);
            return;
        }

        // Section 6.2.6
        if (!accessControlRequestHeaders.isEmpty()) {
            for (String header : accessControlRequestHeaders) {
                if (!allowedHttpHeaders.contains(header)) {
                    handleInvalidCORS(request, response, filterChain);
                    return;
                }
            }
        }

        // Section 6.2.7
        if (supportsCredentials) {
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        } else {
            if (anyOriginAllowed) {
                response.addHeader(
                        CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        "*");
            } else {
                response.addHeader(
                        CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        origin);
            }
        }

        // Section 6.2.8
        if (preflightMaxAge > 0) {
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE,
                    String.valueOf(preflightMaxAge));
        }

        // Section 6.2.9
        response.addHeader(
                CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
                accessControlRequestMethod);

        // Section 6.2.10
        if ((allowedHttpHeaders != null) && (!allowedHttpHeaders.isEmpty())) {
            response.addHeader(
                    CORSFilter.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS,
                    join(allowedHttpHeaders, ","));
        }

        // Do not forward the request down the filter chain.
    }

    /**
     * Handles a request, that's not a CORS request, but is a valid request i.e.
     * it is not a cross-origin request. This implementation, just forwards the
     * request down the filter chain.
     * 
     * @param request
     *            The {@link HttpServletRequest} object.
     * @param response
     *            The {@link HttpServletResponse} object.
     * @param filterChain
     *            The {@link FilterChain} object.
     * @throws IOException
     * @throws ServletException
     */
    public void handleNonCORS(final HttpServletRequest request,
            final HttpServletResponse response, final FilterChain filterChain)
            throws IOException, ServletException {
        // Let request pass.
        filterChain.doFilter(request, response);
    }

    /**
     * Handles a CORS request that violates specification.
     * 
     * @param request
     *            The {@link HttpServletRequest} object.
     * @param response
     *            The {@link HttpServletResponse} object.
     * @param filterChain
     *            The {@link FilterChain} object.
     * @throws IOException
     * @throws ServletException
     */
    public void handleInvalidCORS(final HttpServletRequest request,
            final HttpServletResponse response, final FilterChain filterChain) {
        String origin = request.getHeader(CORSFilter.REQUEST_HEADER_ORIGIN);
        String method = request.getMethod();
        String accessControlRequestHeaders = request
                .getHeader(REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);

        String message = "Invalid CORS request; Origin=" + origin + ";Method="
                + method;
        if (accessControlRequestHeaders != null) {
            message = message + ";Access-Control-Request-Headers="
                    + accessControlRequestHeaders;
        }
        response.setContentType("text/plain");
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.resetBuffer();

        log(message);
    }

    @Override
    public void destroy() {
        // NOOP
    }

    // -------------------------------------------------------- Utility methods
    /**
     * Decorates the {@link HttpServletRequest}, with CORS attributes.
     * <ul>
     * <li><b>cors.isCorsRequest:</b> Flag to determine if request is a CORS
     * request. Set to <code>true</code> if CORS request; <code>false</code>
     * otherwise.</li>
     * <li><b>cors.request.origin:</b> The Origin URL.</li>
     * <li><b>cors.request.type:</b> Type of request. Values:
     * <code>simple</code> or <code>preflight</code> or <code>not_cors</code> or
     * <code>invalid_cors</code></li>
     * <li><b>cors.request.headers:</b> Request headers sent as
     * 'Access-Control-Request-Headers' header, for pre-flight request.</li>
     * </ul>
     * 
     * @param request
     *            The {@link HttpServletRequest} object.
     * @param corsRequestType
     *            The {@link CORSRequestType} object.
     */
    public static void decorateCORSProperties(final HttpServletRequest request,
            final CORSRequestType corsRequestType) {
        if (request == null) {
            throw new IllegalArgumentException(
                    "HttpServletRequest object is null");
        }

        if (corsRequestType == null) {
            throw new IllegalArgumentException("CORSRequestType object is null");
        }

        switch (corsRequestType) {
        case SIMPLE:
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST, true);
            request.setAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN,
                    request.getHeader(CORSFilter.REQUEST_HEADER_ORIGIN));
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE,
                    corsRequestType.name().toLowerCase());
            break;
        case ACTUAL:
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST, true);
            request.setAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN,
                    request.getHeader(CORSFilter.REQUEST_HEADER_ORIGIN));
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE,
                    corsRequestType.name().toLowerCase());
            break;
        case PRE_FLIGHT:
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST, true);
            request.setAttribute(CORSFilter.HTTP_REQUEST_ATTRIBUTE_ORIGIN,
                    request.getHeader(CORSFilter.REQUEST_HEADER_ORIGIN));
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE,
                    corsRequestType.name().toLowerCase());
            String headers = request
                    .getHeader(REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);
            if (headers == null) {
                headers = "";
            }
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS, headers);
            break;
        case NOT_CORS:
            request.setAttribute(
                    CORSFilter.HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST, false);
            break;
        default:
            // Don't set any attributes
            break;
        }
    }

    /**
     * Joins elements of {@link Set} into a string, where each element is
     * separated by the provided separator.
     * 
     * @param elements
     *            The {@link Set} containing elements to join together.
     * @param joinSeparator
     *            The character to be used for separating elements.
     * @return The joined {@link String}; <code>null</code> if elements
     *         {@link Set} is null.
     */
    public static String join(final Collection<String> elements,
            final String joinSeparator) {
        String separator = ",";
        if (elements == null) {
            return null;
        }
        if (joinSeparator != null) {
            separator = joinSeparator;
        }
        StringBuilder buffer = new StringBuilder();
        boolean isFirst = true;
        for (String element : elements) {
            if (!isFirst) {
                buffer.append(separator);
            } else {
                isFirst = false;
            }

            if (element != null) {
                buffer.append(element);
            }
        }

        return buffer.toString();
    }

    /**
     * Determines the request type.
     * 
     * @param request
     * @return
     */
    public CORSRequestType checkRequestType(final HttpServletRequest request) {
        CORSRequestType requestType = CORSRequestType.INVALID_CORS;
        if (request == null) {
            throw new IllegalArgumentException(
                    "HttpServletRequest object is null");
        }
        String originHeader = request.getHeader(REQUEST_HEADER_ORIGIN);
        // Section 6.1.1 and Section 6.2.1
        if (originHeader != null) {
            if (originHeader.isEmpty()) {
                requestType = CORSRequestType.INVALID_CORS;
            } else if (!isValidOrigin(originHeader)) {
                requestType = CORSRequestType.INVALID_CORS;
            } else {
                String method = request.getMethod();
                if (method != null && HTTP_METHODS.contains(method)) {
                    if ("OPTIONS".equals(method)) {
                        String accessControlRequestMethodHeader = request
                                .getHeader(REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD);
                        if (accessControlRequestMethodHeader != null
                                && !accessControlRequestMethodHeader.isEmpty()) {
                            requestType = CORSRequestType.PRE_FLIGHT;
                        } else if (accessControlRequestMethodHeader != null
                                && accessControlRequestMethodHeader.isEmpty()) {
                            requestType = CORSRequestType.INVALID_CORS;
                        } else {
                            requestType = CORSRequestType.ACTUAL;
                        }
                    } else if ("GET".equals(method) || "HEAD".equals(method)) {
                        requestType = CORSRequestType.SIMPLE;
                    } else if ("POST".equals(method)) {
                        String contentType = request.getContentType();
                        if (contentType != null) {
                            contentType = contentType.toLowerCase().trim();
                            if (SIMPLE_HTTP_REQUEST_CONTENT_TYPE_VALUES
                                    .contains(contentType)) {
                                requestType = CORSRequestType.SIMPLE;
                            } else {
                                requestType = CORSRequestType.ACTUAL;
                            }
                        }
                    } else if (COMPLEX_HTTP_METHODS.contains(method)) {
                        requestType = CORSRequestType.ACTUAL;
                    }
                }
            }
        } else {
            requestType = CORSRequestType.NOT_CORS;
        }

        return requestType;
    }

    /**
     * Checks if the Origin is allowed to make a CORS request.
     * 
     * @param origin
     *            The Origin.
     * @return <code>true</code> if origin is allowed; <code>false</code>
     *         otherwise.
     */
    private boolean isOriginAllowed(final String origin) {
        if (anyOriginAllowed) {
            return true;
        }

        // If 'Origin' header is a case-sensitive match of any of allowed
        // origins, then return true, else return false.
        return allowedOrigins.contains(origin);
    }

    private void log(String message) {
        if (loggingEnabled) {
            filterConfig.getServletContext().log(message);
        }
    }

    /**
     * Parses each param-value and populates configuration variables. If a param
     * is provided, it overrides the default.
     * 
     * @param allowedOrigins
     *            A {@link String} of comma separated origins.
     * @param allowedHttpMethods
     *            A {@link String} of comma separated HTTP methods.
     * @param allowedHttpHeaders
     *            A {@link String} of comma separated HTTP headers.
     * @param exposedHeaders
     *            A {@link String} of comma separated headers that needs to be
     *            exposed.
     * @param supportsCredentials
     *            "true" if support credentials needs to be enabled.
     * @param preflightMaxAge
     *            The amount of seconds the user agent is allowed to cache the
     *            result of the pre-flight request.
     * @param loggingEnabled
     *            Flag to control logging to access log.
     * @throws ServletException
     */
    private void parseAndStore(final String allowedOrigins,
            final String allowedHttpMethods, final String allowedHttpHeaders,
            final String exposedHeaders, final String supportsCredentials,
            final String preflightMaxAge, final String loggingEnabled,
            final String decorateRequest) throws ServletException {
        if (allowedOrigins != null) {
            if (allowedOrigins.trim().equals("*")) {
                this.anyOriginAllowed = true;
            } else {
                this.anyOriginAllowed = false;
                Set<String> setAllowedOrigins = parseStringToSet(allowedOrigins);
                this.allowedOrigins.clear();
                this.allowedOrigins.addAll(setAllowedOrigins);
            }
        }

        if (allowedHttpMethods != null) {
            Set<String> setAllowedHttpMethods = parseStringToSet(allowedHttpMethods);
            this.allowedHttpMethods.clear();
            this.allowedHttpMethods.addAll(setAllowedHttpMethods);
        }

        if (allowedHttpHeaders != null) {
            Set<String> setAllowedHttpHeaders = parseStringToSet(allowedHttpHeaders);
            Set<String> lowerCaseHeaders = new HashSet<String>();
            for (String header : setAllowedHttpHeaders) {
                String lowerCase = header.toLowerCase();
                lowerCaseHeaders.add(lowerCase);
            }
            this.allowedHttpHeaders.clear();
            this.allowedHttpHeaders.addAll(lowerCaseHeaders);
        }

        if (exposedHeaders != null) {
            Set<String> setExposedHeaders = parseStringToSet(exposedHeaders);
            this.exposedHeaders.clear();
            this.exposedHeaders.addAll(setExposedHeaders);
        }

        if (supportsCredentials != null) {
            // For any value other then 'true' this will be false.
            this.supportsCredentials = Boolean
                    .parseBoolean(supportsCredentials);
        }

        if (preflightMaxAge != null) {
            try {
                if (!preflightMaxAge.isEmpty()) {
                    this.preflightMaxAge = Long.parseLong(preflightMaxAge);
                } else {
                    this.preflightMaxAge = 0L;
                }
            } catch (NumberFormatException e) {
                throw new ServletException("Unable to parse preflightMaxAge", e);
            }
        }

        if (loggingEnabled != null) {
            // For any value other then 'true' this will be false.
            this.loggingEnabled = Boolean.parseBoolean(loggingEnabled);
        }

        if (decorateRequest != null) {
            // For any value other then 'true' this will be false.
            this.decorateRequest = Boolean.parseBoolean(decorateRequest);
        }
    }

    /**
     * Takes a comma separated list and returns a Set<String>.
     * 
     * @param data
     *            A comma separated list of strings.
     * @return Set<String>
     */
    private Set<String> parseStringToSet(final String data) {
        String[] splits;

        if (data != null && data.length() > 0) {
            splits = data.split(",");
        } else {
            splits = new String[] {};
        }

        Set<String> set = new HashSet<String>();
        if (splits.length > 0) {
            for (String split : splits) {
                set.add(split.trim());
            }
        }

        return set;
    }

    /**
     * Checks if a given origin is valid or not. Criteria:
     * <ul>
     * <li>If an encoded character is present in origin, it's not valid.</li>
     * <li>Origin should be a valid {@link URI}</li>
     * </ul>
     * 
     * @param origin
     * @see <a href="http://tools.ietf.org/html/rfc952">RFC952</a>
     * @return
     */
    public static boolean isValidOrigin(String origin) {
        // Checks for encoded characters. Helps prevent CRLF injection.
        if (origin.contains("%")) {
            return false;
        }

        URI originURI;

        try {
            originURI = new URI(origin);
        } catch (URISyntaxException e) {
            return false;
        }
        // If scheme for URI is null, return false. Return true otherwise.
        return originURI.getScheme() != null;

    }

    // -------------------------------------------------------------- Accessors
    /**
     * Determines if logging is enabled or not.
     * 
     * @return <code>true</code> if it's enabled; false otherwise.
     */
    public boolean isLoggingEnabled() {
        return loggingEnabled;
    }

    /**
     * Determines if any origin is allowed to make CORS request.
     * 
     * @return <code>true</code> if it's enabled; false otherwise.
     */
    public boolean isAnyOriginAllowed() {
        return anyOriginAllowed;
    }

    /**
     * Returns a {@link Set} of headers that should be exposed by browser.
     * 
     * @return
     */
    public Collection<String> getExposedHeaders() {
        return exposedHeaders;
    }

    /**
     * Determines is supports credentials is enabled
     * 
     * @return
     */
    public boolean isSupportsCredentials() {
        return supportsCredentials;
    }

    /**
     * Returns the preflight response cache time in seconds.
     * 
     * @return Time to cache in seconds.
     */
    public long getPreflightMaxAge() {
        return preflightMaxAge;
    }

    /**
     * Returns the {@link Set} of allowed origins that are allowed to make
     * requests.
     * 
     * @return {@link Set}
     */
    public Collection<String> getAllowedOrigins() {
        return allowedOrigins;
    }

    /**
     * Returns a {@link Set} of HTTP methods that are allowed to make requests.
     * 
     * @return {@link Set}
     */
    public Collection<String> getAllowedHttpMethods() {
        return allowedHttpMethods;
    }

    /**
     * Returns a {@link Set} of headers support by resource.
     * 
     * @return {@link Set}
     */
    public Collection<String> getAllowedHttpHeaders() {
        return allowedHttpHeaders;
    }

    // -------------------------------------------------- CORS Response Headers
    /**
     * The Access-Control-Allow-Origin header indicates whether a resource can
     * be shared based by returning the value of the Origin request header in
     * the response.
     */
    public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";

    /**
     * The Access-Control-Allow-Credentials header indicates whether the
     * response to request can be exposed when the omit credentials flag is
     * unset. When part of the response to a preflight request it indicates that
     * the actual request can include user credentials.
     */
    public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";

    /**
     * The Access-Control-Expose-Headers header indicates which headers are safe
     * to expose to the API of a CORS API specification
     */
    public static final String RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers";

    /**
     * The Access-Control-Max-Age header indicates how long the results of a
     * preflight request can be cached in a preflight result cache.
     */
    public static final String RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age";

    /**
     * The Access-Control-Allow-Methods header indicates, as part of the
     * response to a preflight request, which methods can be used during the
     * actual request.
     */
    public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";

    /**
     * The Access-Control-Allow-Headers header indicates, as part of the
     * response to a preflight request, which header field names can be used
     * during the actual request.
     */
    public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";

    // -------------------------------------------------- CORS Request Headers
    /**
     * The Origin header indicates where the cross-origin request or preflight
     * request originates from.
     */
    public static final String REQUEST_HEADER_ORIGIN = "Origin";

    /**
     * The Access-Control-Request-Method header indicates which method will be
     * used in the actual request as part of the preflight request.
     */
    public static final String REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method";

    /**
     * The Access-Control-Request-Headers header indicates which headers will be
     * used in the actual request as part of the preflight request.
     */
    public static final String REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers";

    // ----------------------------------------------------- Request attributes
    /**
     * The prefix to a CORS request attribute.
     */
    public static final String HTTP_REQUEST_ATTRIBUTE_PREFIX = "cors.";

    /**
     * Attribute that contains the origin of the request.
     */
    public static final String HTTP_REQUEST_ATTRIBUTE_ORIGIN = HTTP_REQUEST_ATTRIBUTE_PREFIX
            + "request.origin";

    /**
     * Boolean value, suggesting if the request is a CORS request or not.
     */
    public static final String HTTP_REQUEST_ATTRIBUTE_IS_CORS_REQUEST = HTTP_REQUEST_ATTRIBUTE_PREFIX
            + "isCorsRequest";

    /**
     * Type of CORS request, of type {@link CORSRequestType}.
     */
    public static final String HTTP_REQUEST_ATTRIBUTE_REQUEST_TYPE = HTTP_REQUEST_ATTRIBUTE_PREFIX
            + "request.type";

    /**
     * Request headers sent as 'Access-Control-Request-Headers' header, for
     * pre-flight request.
     */
    public static final String HTTP_REQUEST_ATTRIBUTE_REQUEST_HEADERS = HTTP_REQUEST_ATTRIBUTE_PREFIX
            + "request.headers";

    // -------------------------------------------------------------- Constants
    /**
     * Enumerates varies types of CORS requests. Also, provides utility methods
     * to determine the request type.
     */
    public static enum CORSRequestType {
        /**
         * A simple HTTP request, i.e. it shouldn't be pre-flighted.
         */
        SIMPLE,
        /**
         * A HTTP request that needs to be pre-flighted.
         */
        ACTUAL,
        /**
         * A pre-flight CORS request, to get meta information, before a
         * non-simple HTTP request is sent.
         */
        PRE_FLIGHT,
        /**
         * Not a CORS request, but a normal request.
         */
        NOT_CORS,
        /**
         * An invalid CORS request, i.e. it qualifies to be a CORS request, but
         * fails to be a valid one.
         */
        INVALID_CORS
    }

    /**
     * {@link Collection} of HTTP methods. Case sensitive.
     * 
     * @see http://tools.ietf.org/html/rfc2616#section-5.1.1
     */
    public static final Collection<String> HTTP_METHODS = new HashSet<String>(
            Arrays.asList("OPTIONS", "GET", "HEAD", "POST", "PUT", "DELETE",
                    "TRACE", "CONNECT"));
    /**
     * {@link Collection} of non-simple HTTP methods. Case sensitive.
     */
    public static final Collection<String> COMPLEX_HTTP_METHODS = new HashSet<String>(
            Arrays.asList("PUT", "DELETE", "TRACE", "CONNECT"));
    /**
     * {@link Collection} of Simple HTTP methods. Case sensitive.
     * 
     * @see http://www.w3.org/TR/cors/#terminology
     */
    public static final Collection<String> SIMPLE_HTTP_METHODS = new HashSet<String>(
            Arrays.asList("GET", "POST", "HEAD"));

    /**
     * {@link Collection} of Simple HTTP request headers. Case in-sensitive.
     * 
     * @see http://www.w3.org/TR/cors/#terminology
     */
    public static final Collection<String> SIMPLE_HTTP_REQUEST_HEADERS = new HashSet<String>(
            Arrays.asList("Accept", "Accept-Language", "Content-Language"));

    /**
     * {@link Collection} of Simple HTTP request headers. Case in-sensitive.
     * 
     * @see http://www.w3.org/TR/cors/#terminology
     */
    public static final Collection<String> SIMPLE_HTTP_RESPONSE_HEADERS = new HashSet<String>(
            Arrays.asList("Cache-Control", "Content-Language", "Content-Type",
                    "Expires", "Last-Modified", "Pragma"));

    /**
     * {@link Collection} of Simple HTTP request headers. Case in-sensitive.
     * 
     * @see http://www.w3.org/TR/cors/#terminology
     */
    public static final Collection<String> SIMPLE_HTTP_REQUEST_CONTENT_TYPE_VALUES = new HashSet<String>(
            Arrays.asList("application/x-www-form-urlencoded",
                    "multipart/form-data", "text/plain"));

    // ------------------------------------------------ Configuration Defaults
    /**
     * By default, all origins are allowed to make requests.
     */
    public static final String DEFAULT_ALLOWED_ORIGINS = "*";

    /**
     * By default, following methods are supported: GET, POST, HEAD and OPTIONS.
     */
    public static final String DEFAULT_ALLOWED_HTTP_METHODS = "GET,POST,HEAD,OPTIONS";

    /**
     * By default, time duration to cache pre-flight response is 30 mins.
     */
    public static final String DEFAULT_PREFLIGHT_MAXAGE = "1800";

    /**
     * By default, support credentials is turned on.
     */
    public static final String DEFAULT_SUPPORTS_CREDENTIALS = "true";

    /**
     * By default, following headers are supported:
     * Origin,Accept,X-Requested-With, Content-Type,
     * Access-Control-Request-Method, and Access-Control-Request-Headers.
     */
    public static final String DEFAULT_ALLOWED_HTTP_HEADERS = "Origin,Accept,X-Requested-With,Content-Type,"
            + "Access-Control-Request-Method,Access-Control-Request-Headers";

    /**
     * By default, none of the headers are exposed in response.
     */
    public static final String DEFAULT_EXPOSED_HEADERS = "";

    /**
     * By default, access log logging is turned off
     */
    public static final String DEFAULT_LOGGING_ENABLED = "false";

    /**
     * By default, request is decorated with CORS attributes.
     */
    public static final String DEFAULT_DECORATE_REQUEST = "true";

    // ----------------------------------------Filter Config Init param-name(s)
    /**
     * Key to retrieve allowed origins from {@link FilterConfig}.
     */
    public static final String PARAM_CORS_ALLOWED_ORIGINS = "cors.allowed.origins";

    /**
     * Key to retrieve support credentials from {@link FilterConfig}.
     */
    public static final String PARAM_CORS_SUPPORT_CREDENTIALS = "cors.support.credentials";

    /**
     * Key to retrieve exposed headers from {@link FilterConfig}.
     */
    public static final String PARAM_CORS_EXPOSED_HEADERS = "cors.exposed.headers";

    /**
     * Key to retrieve allowed headers from {@link FilterConfig}.
     */
    public static final String PARAM_CORS_ALLOWED_HEADERS = "cors.allowed.headers";

    /**
     * Key to retrieve allowed methods from {@link FilterConfig}.
     */
    public static final String PARAM_CORS_ALLOWED_METHODS = "cors.allowed.methods";

    /**
     * Key to retrieve preflight max age from {@link FilterConfig}.
     */
    public static final String PARAM_CORS_PREFLIGHT_MAXAGE = "cors.preflight.maxage";

    /**
     * Key to retrieve access log logging flag.
     */
    public static final String PARAM_CORS_LOGGING_ENABLED = "cors.logging.enabled";

    /**
     * Key to determine if request should be decorated.
     */
    public static final String PARAM_CORS_REQUEST_DECORATE = "cors.request.decorate";
}
  + native





</section>

<section name="CORS Filter">
  <subsection name="Introduction">
    <p>This filter is an implementation of W3C's CORS (Cross-Origin Resource Sharing) <a href="http://www.w3.org/TR/cors/">specification</a>, which is a mechanism that enables cross-origin requests.</p>
    <p>The filter works by adding required <code>Access-Control-*</code> headers to HttpServletResponse object. The filter also protects against HTTP response splitting. If request is invalid, or is not permitted, then request is rejected with HTTP status code 403 (Forbidden). A flowchart that demonstrate request processing by this filter is available <a href="../images/cors-flowchart.png">here</a>.</p>
    <p>The minimal configuration required to use this filter is:</p>
    <source>
&lt;filter&gt;
  &lt;filter-name&gt;CORSFilter&lt;/filter-name&gt;
  &lt;filter-class&gt;org.apache.catalina.filters.CORSFilter&lt;/filter-class&gt;
&lt;/filter&gt;
&lt;filter-mapping&gt;
  &lt;filter-name>CORSFilter&lt;/filter-name&gt;
  &lt;url-pattern>/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;
    </source>
  </subsection>
  <subsection name="Filter Class Name">
    <p>The filter class name for the CORS Filter is <strong><code>org.apache.catalina.filters.CORSFilter</code></strong>.</p>
  </subsection>
  <subsection name="Initialisation parameters">
    <p>The CORS Filter supports following initialisation parameters:</p>
    <attributes>
      <attribute name="cors.allowed.origins" required="false">
        <p>A list of <a href="http://tools.ietf.org/html/rfc6454">origins</a> that are allowed to access the resource. A <code>'*'</code> can be specified to enable access to resource from any origin. Otherwise, a whitelist of comma separated origins can be provided. Ex: http://www.w3.org, https://www.apache.org. <strong>Defaults:</strong> <code>*</code> (Any origin is allowed to access the resource).</p>
      </attribute>
      <attribute name="cors.allowed.methods" required="false">
        <p>A comma separated list of HTTP methods that can be used to access the resource, using cross-origin requests. These are the methods which will also be included as part of 'Access-Control-Allow-Methods' header in a pre-flight response. Ex: <code>GET,POST</code>. <strong>Defaults:</strong> <code>GET,POST,HEAD,OPTIONS</code></p>
      </attribute>
      <attribute name="cors.allowed.headers" required="false">
        <p>A comma separated list of request headers that can be used when making an actual request. These header will also be returned as part of <code>'Access-Control-Allow-Headers'</code> header in a pre-flight response. Ex: <code>Origin,Accept</code>. <strong>Defaults:</strong> <code>Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers</code></p>
      </attribute>
      <attribute name="cors.exposed.headers" required="false">
        <p>A comma separated list of headers other than the simple response headers that browsers are allowed to access. These are the headers which will also be included as part of 'Access-Control-Expose-Headers' header in the pre-flight response. Ex: <code>X-CUSTOM-HEADER-PING,X-CUSTOM-HEADER-PONG</code>. <strong>Default:</strong> None. Non-simple headers are not exposed by default.</p>
      </attribute>
      <attribute name="cors.preflight.maxage" required="false">
        <p>The amount of seconds, browser is allowed to cache the result of the pre-flight request. This will be included as part of <code>'Access-Control-Max-Age'</code> header in the pre-flight response. A negative value will prevent CORS Filter from adding this response header from pre-flight response. <strong>Defaults:</strong> <code>1800</code></p>
      </attribute>
      <attribute name="cors.support.credentials" required="false">
        <p>A flag that indicates whether the resource supports user credentials. This flag is exposed as part of <code>'Access-Control-Allow-Credentials'</code> header in a pre-flight response. It helps browser determine whether or not an actual request can be made using credentials. <strong>Defaults:</strong> <code>true</code></p>
      </attribute>
      <attribute name="cors.logging.enabled" required="false">
        <p>A flag to control logging to container logs. <strong>Defaults:</strong> <code>false</code></p>
      </attribute>
      <attribute name="cors.request.decorate" required="false">
        <p>A flag to control if CORS specific attributes should be added to HttpServletRequest object or not. <strong>Defaults:</strong> <code>true</code></p>
      </attribute>
    </attributes>
    <p>Here's an example of a more advanced configuration, that overrides defaults:</p>
    <source>
&lt;filter&gt;
  &lt;filter-name&gt;CORSFilter&lt;/filter-name&gt;
  &lt;filter-class&gt;org.apache.catalina.filters.CORSFilter&lt;/filter-class&gt;
  &lt;init-param&gt;
    &lt;description&gt;A comma separated list of allowed origins&lt;/description&gt;
    &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
    &lt;param-value&gt;*&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;description&gt;A comma separated list of HTTP verbs, using which a cross-origin request can be made.&lt;/description&gt;
    &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
    &lt;param-value&gt;GET,POST,HEAD,OPTIONS,PUT&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;description&gt;A comma separated list of allowed headers when making a non simple cross-origin request.&lt;/description&gt;
    &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
    &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;description&gt;A comma separated list of non-standard response headers that will be exposed to XMLHttpRequest object.&lt;/description&gt;
    &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
    &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;description&gt;A flag that suggests if a cross-origin request is supported with cookies, BASIC Authentication, etc.&lt;/description&gt;
    &lt;param-name&gt;cors.support.credentials&lt;/param-name&gt;
    &lt;param-value&gt;true&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;description&gt;A flag control logging&lt;/description&gt;
    &lt;param-name&gt;cors.logging.enabled&lt;/param-name&gt;
    &lt;param-value&gt;true&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;description&gt;Indicates how long (in seconds) the results of a preflight request can be cached in a preflight result cache.&lt;/description&gt;
    &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
    &lt;param-value&gt;10&lt;/param-value&gt;
  &lt;/init-param&gt;
&lt;/filter&gt;
&lt;filter-mapping&gt;
  &lt;filter-name&gt;CORS Filter&lt;/filter-name&gt;
  &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;
    </source>
  </subsection>
  <subsection name="CORS Filter and HttpServletRequest attributes" required="false">
    <p>CORS Filter adds information about a request, in the HttpServletRequest object, for consumption downstream. Following attributes are set, if <code>cors.request.decorate</code> initialisation parameter is <code>true</code>:</p>
    <ul>
      <li><strong>cors.isCorsRequest:</strong> Flag to determine if a request is a CORS request.</li>
      <li><strong>cors.request.origin:</strong> The Origin URL, i.e. the URL of the page from where the request is originated.</li>
      <li><strong>cors.request.type:</strong> Type of CORS request. Possible values: 
        <ul>
          <li><code>SIMPLE</code>: A request which is not preceded by a pre-flight request.</li>
          <li><code>ACTUAL</code>: A request which is preceded by a pre-flight request.</li>
          <li><code>PRE_FLIGHT</code>: A pre-flight request.</li>
          <li><code>NOT_CORS</code>: A normal same-origin request.</li>
          <li><code>INVALID_CORS</code>: A cross-origin request, which is invalid.</li>
        </ul>
      </li>
      <li><strong>cors.request.headers:</strong> Request headers sent as 'Access-Control-Request-Headers' header, for a pre-flight request.</li>
    </ul>
  </subsection>
</section>

</body>


Return to bug 55046

Line 0 Link Here

(-)test/org/apache/catalina/filters/MockHttpServletResponse.java (+193 lines)
		1	package org.apache.catalina.filters;
		2
		3	import java.io.IOException;
		4	import java.io.PrintWriter;
		5	import java.io.StringWriter;
		6	import java.util.ArrayList;
		7	import java.util.Collection;
		8	import java.util.List;
		9	import java.util.Locale;
		10
		11	import javax.servlet.ServletOutputStream;
		12	import javax.servlet.http.Cookie;
		13	import javax.servlet.http.HttpServletResponse;
		14
		15	public class MockHttpServletResponse implements HttpServletResponse {
		16	List headerNames = new ArrayList();
		17	List headerValues = new ArrayList();
		18	PrintWriter pw;
		19	int status;
		20
		21	public String getCharacterEncoding() {
		22
		23	throw new RuntimeException("Not implemented");
		24	}
		25
		26	public String getContentType() {
		27
		28	throw new RuntimeException("Not implemented");
		29	}
		30
		31	public ServletOutputStream getOutputStream() throws IOException {
		32
		33	throw new RuntimeException("Not implemented");
		34	}
		35
		36	public PrintWriter getWriter() throws IOException {
		37	if (pw == null) {
		38	pw = new PrintWriter(new StringWriter());
		39	}
		40	return pw;
		41	}
		42
		43	public void setCharacterEncoding(String charset) {
		44	throw new RuntimeException("Not implemented");
		45	}
		46
		47	public void setContentLength(int len) {
		48	throw new RuntimeException("Not implemented");
		49	}
		50
		51	public void setContentType(String type) {
		52
		53	}
		54
		55	public void setBufferSize(int size) {
		56	throw new RuntimeException("Not implemented");
		57	}
		58
		59	public int getBufferSize() {
		60	throw new RuntimeException("Not implemented");
		61	}
		62
		63	public void flushBuffer() throws IOException {
		64	throw new RuntimeException("Not implemented");
65	}
66
67	public void resetBuffer() {
68	}
69
70	public boolean isCommitted() {
71	throw new RuntimeException("Not implemented");
72	}
73
74	public void reset() {
75
76	}
77
78	public void setLocale(Locale loc) {
79	throw new RuntimeException("Not implemented");
80	}
81
82	public Locale getLocale() {
83
84	throw new RuntimeException("Not implemented");
85	}
86
87	public void addCookie(Cookie cookie) {
88	throw new RuntimeException("Not implemented");
89	}
90
91	public boolean containsHeader(String name) {
92	throw new RuntimeException("Not implemented");
93	}
94
95	public String encodeURL(String url) {
96
97	throw new RuntimeException("Not implemented");
98	}
99
100	public String encodeRedirectURL(String url) {
101
102	throw new RuntimeException("Not implemented");
103	}
104
105	public String encodeUrl(String url) {
106
107	throw new RuntimeException("Not implemented");
108	}
109
110	public String encodeRedirectUrl(String url) {
111
112	throw new RuntimeException("Not implemented");
113	}
114
115	public void sendError(int sc, String msg) throws IOException {
116
117	}
118
119	public void sendError(int sc) throws IOException {
120
121	}
122
123	public void sendRedirect(String location) throws IOException {
124	throw new RuntimeException("Not implemented");
125	}
126
127	public void setDateHeader(String name, long date) {
128	throw new RuntimeException("Not implemented");
129	}
130
131	public void addDateHeader(String name, long date) {
132	throw new RuntimeException("Not implemented");
133	}
134
135	public String getHeader(String name) {
136	int index = headerNames.indexOf(name);
137	if (index != -1) {
138	return (String) headerValues.get(index);
139	}
140	return null;
141	}
142
143	public void setHeader(String name, String value) {
144	int index = headerNames.indexOf(name);
145	if (index != -1) {
146	headerValues.set(index, value);
147	} else {
148	headerNames.add(name);
149	headerValues.add(value);
150	}
151	}
152
153	public void addHeader(String name, String value) {
154	headerNames.add(name);
155	headerValues.add(value);
156	}
157
158	public void setIntHeader(String name, int value) {
159	throw new RuntimeException("Not implemented");
160	}
161
162	public void addIntHeader(String name, int value) {
163	throw new RuntimeException("Not implemented");
164	}
165
166	public void setStatus(int sc) {
167	this.status = sc;
168	}
169
170	public int getStatus() {
171	return this.status;
172	}
173
174	public void setStatus(int sc, String sm) {
175
176	}
177
178	@Override
179	public void setContentLengthLong(long length) {
180	throw new RuntimeException("Not implemented");
181	}
182
183	@Override
184	public Collection<String> getHeaders(String name) {
185	throw new RuntimeException("Not implemented");
186	}
187
188	@Override
189	public Collection<String> getHeaderNames() {
190	throw new RuntimeException("Not implemented");
191	}
192
193	}
0	+ native	194	+ native

Lines 1309-1314 Link Here

(-)webapps/docs/config/filter.xml (+112 lines)
1309		1309
1310	</section>	1310	</section>
1311		1311
		1312	<section name="CORS Filter">
		1313	<subsection name="Introduction">
		1314	<p>This filter is an implementation of W3C's CORS (Cross-Origin Resource Sharing) <a href="http://www.w3.org/TR/cors/">specification</a>, which is a mechanism that enables cross-origin requests.</p>
		1315	<p>The filter works by adding required <code>Access-Control-*</code> headers to HttpServletResponse object. The filter also protects against HTTP response splitting. If request is invalid, or is not permitted, then request is rejected with HTTP status code 403 (Forbidden). A flowchart that demonstrate request processing by this filter is available <a href="../images/cors-flowchart.png">here</a>.</p>
		1316	<p>The minimal configuration required to use this filter is:</p>
		1317	<source>
		1318	<filter>
		1319	<filter-name>CORSFilter</filter-name>
		1320	<filter-class>org.apache.catalina.filters.CORSFilter</filter-class>
		1321	</filter>
		1322	<filter-mapping>
		1323	<filter-name>CORSFilter</filter-name>
		1324	<url-pattern>/*</url-pattern>
		1325	</filter-mapping>
		1326	</source>
		1327	</subsection>
		1328	<subsection name="Filter Class Name">
		1329	<p>The filter class name for the CORS Filter is <strong><code>org.apache.catalina.filters.CORSFilter</code></strong>.</p>
		1330	</subsection>
		1331	<subsection name="Initialisation parameters">
		1332	<p>The CORS Filter supports following initialisation parameters:</p>
		1333	<attributes>
		1334	<attribute name="cors.allowed.origins" required="false">
		1335	<p>A list of <a href="http://tools.ietf.org/html/rfc6454">origins</a> that are allowed to access the resource. A <code>''</code> can be specified to enable access to resource from any origin. Otherwise, a whitelist of comma separated origins can be provided. Ex: http://www.w3.org, https://www.apache.org. <strong>Defaults:</strong> <code></code> (Any origin is allowed to access the resource).</p>
		1336	</attribute>
		1337	<attribute name="cors.allowed.methods" required="false">
		1338	<p>A comma separated list of HTTP methods that can be used to access the resource, using cross-origin requests. These are the methods which will also be included as part of 'Access-Control-Allow-Methods' header in a pre-flight response. Ex: <code>GET,POST</code>. <strong>Defaults:</strong> <code>GET,POST,HEAD,OPTIONS</code></p>
		1339	</attribute>
		1340	<attribute name="cors.allowed.headers" required="false">
		1341	<p>A comma separated list of request headers that can be used when making an actual request. These header will also be returned as part of <code>'Access-Control-Allow-Headers'</code> header in a pre-flight response. Ex: <code>Origin,Accept</code>. <strong>Defaults:</strong> <code>Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers</code></p>
		1342	</attribute>
		1343	<attribute name="cors.exposed.headers" required="false">
		1344	<p>A comma separated list of headers other than the simple response headers that browsers are allowed to access. These are the headers which will also be included as part of 'Access-Control-Expose-Headers' header in the pre-flight response. Ex: <code>X-CUSTOM-HEADER-PING,X-CUSTOM-HEADER-PONG</code>. <strong>Default:</strong> None. Non-simple headers are not exposed by default.</p>
		1345	</attribute>
		1346	<attribute name="cors.preflight.maxage" required="false">
		1347	<p>The amount of seconds, browser is allowed to cache the result of the pre-flight request. This will be included as part of <code>'Access-Control-Max-Age'</code> header in the pre-flight response. A negative value will prevent CORS Filter from adding this response header from pre-flight response. <strong>Defaults:</strong> <code>1800</code></p>
		1348	</attribute>
		1349	<attribute name="cors.support.credentials" required="false">
		1350	<p>A flag that indicates whether the resource supports user credentials. This flag is exposed as part of <code>'Access-Control-Allow-Credentials'</code> header in a pre-flight response. It helps browser determine whether or not an actual request can be made using credentials. <strong>Defaults:</strong> <code>true</code></p>
		1351	</attribute>
		1352	<attribute name="cors.logging.enabled" required="false">
		1353	<p>A flag to control logging to container logs. <strong>Defaults:</strong> <code>false</code></p>
		1354	</attribute>
		1355	<attribute name="cors.request.decorate" required="false">
		1356	<p>A flag to control if CORS specific attributes should be added to HttpServletRequest object or not. <strong>Defaults:</strong> <code>true</code></p>
		1357	</attribute>
		1358	</attributes>
		1359	<p>Here's an example of a more advanced configuration, that overrides defaults:</p>
		1360	<source>
		1361	<filter>
		1362	<filter-name>CORSFilter</filter-name>
		1363	<filter-class>org.apache.catalina.filters.CORSFilter</filter-class>
		1364	<init-param>
		1365	<description>A comma separated list of allowed origins</description>
		1366	<param-name>cors.allowed.origins</param-name>
		1367	<param-value>*</param-value>
		1368	</init-param>
		1369	<init-param>
		1370	<description>A comma separated list of HTTP verbs, using which a cross-origin request can be made.</description>
		1371	<param-name>cors.allowed.methods</param-name>
		1372	<param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
		1373	</init-param>
		1374	<init-param>
		1375	<description>A comma separated list of allowed headers when making a non simple cross-origin request.</description>
1376	<param-name>cors.allowed.headers</param-name>
1377	<param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
1378	</init-param>
1379	<init-param>
1380	<description>A comma separated list of non-standard response headers that will be exposed to XMLHttpRequest object.</description>
1381	<param-name>cors.exposed.headers</param-name>
1382	<param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
1383	</init-param>
1384	<init-param>
1385	<description>A flag that suggests if a cross-origin request is supported with cookies, BASIC Authentication, etc.</description>
1386	<param-name>cors.support.credentials</param-name>
1387	<param-value>true</param-value>
1388	</init-param>
1389	<init-param>
1390	<description>A flag control logging</description>
1391	<param-name>cors.logging.enabled</param-name>
1392	<param-value>true</param-value>
1393	</init-param>
1394	<init-param>
1395	<description>Indicates how long (in seconds) the results of a preflight request can be cached in a preflight result cache.</description>
1396	<param-name>cors.preflight.maxage</param-name>
1397	<param-value>10</param-value>
1398	</init-param>
1399	</filter>
1400	<filter-mapping>
1401	<filter-name>CORS Filter</filter-name>
1402	<url-pattern>/*</url-pattern>
1403	</filter-mapping>
1404	</source>
1405	</subsection>
1406	<subsection name="CORS Filter and HttpServletRequest attributes" required="false">
1407	<p>CORS Filter adds information about a request, in the HttpServletRequest object, for consumption downstream. Following attributes are set, if <code>cors.request.decorate</code> initialisation parameter is <code>true</code>:</p>
1408	<ul>
1409	<li><strong>cors.isCorsRequest:</strong> Flag to determine if a request is a CORS request.</li>
1410	<li><strong>cors.request.origin:</strong> The Origin URL, i.e. the URL of the page from where the request is originated.</li>
1411	<li><strong>cors.request.type:</strong> Type of CORS request. Possible values:
1412	<ul>
1413	<li><code>SIMPLE</code>: A request which is not preceded by a pre-flight request.</li>
1414	<li><code>ACTUAL</code>: A request which is preceded by a pre-flight request.</li>
1415	<li><code>PRE_FLIGHT</code>: A pre-flight request.</li>
1416	<li><code>NOT_CORS</code>: A normal same-origin request.</li>
1417	<li><code>INVALID_CORS</code>: A cross-origin request, which is invalid.</li>
1418	</ul>
1419	</li>
1420	<li><strong>cors.request.headers:</strong> Request headers sent as 'Access-Control-Request-Headers' header, for a pre-flight request.</li>
1421	</ul>
1422	</subsection>
1423	</section>
1312		1424
1313	</body>	1425	</body>
1314		1426

Line 0 Link Here

(-)test/org/apache/catalina/filters/MockServletContext.java (+279 lines)
		1	package org.apache.catalina.filters;
		2
		3	import java.io.InputStream;
		4	import java.net.MalformedURLException;
		5	import java.net.URL;
		6	import java.util.Enumeration;
		7	import java.util.EventListener;
		8	import java.util.Map;
		9	import java.util.Set;
		10
		11	import javax.servlet.Filter;
		12	import javax.servlet.FilterRegistration;
		13	import javax.servlet.RequestDispatcher;
		14	import javax.servlet.Servlet;
		15	import javax.servlet.ServletContext;
		16	import javax.servlet.ServletException;
		17	import javax.servlet.ServletRegistration;
		18	import javax.servlet.ServletRegistration.Dynamic;
		19	import javax.servlet.SessionCookieConfig;
		20	import javax.servlet.SessionTrackingMode;
		21	import javax.servlet.descriptor.JspConfigDescriptor;
		22
		23	public class MockServletContext implements ServletContext {
		24
		25	public String getContextPath() {
		26	throw new RuntimeException("Not implemented");
		27	}
		28
		29	public ServletContext getContext(String uripath) {
		30	throw new RuntimeException("Not implemented");
		31	}
		32
		33	public int getMajorVersion() {
		34	throw new RuntimeException("Not implemented");
		35	}
		36
		37	public int getMinorVersion() {
		38	throw new RuntimeException("Not implemented");
		39	}
		40
		41	public String getMimeType(String file) {
		42	throw new RuntimeException("Not implemented");
		43	}
		44
		45	public Set getResourcePaths(String path) {
		46	throw new RuntimeException("Not implemented");
		47	}
		48
		49	public URL getResource(String path) throws MalformedURLException {
		50	throw new RuntimeException("Not implemented");
		51	}
		52
		53	public InputStream getResourceAsStream(String path) {
		54	throw new RuntimeException("Not implemented");
		55	}
		56
		57	public RequestDispatcher getRequestDispatcher(String path) {
		58
		59	throw new RuntimeException("Not implemented");
		60	}
		61
		62	public RequestDispatcher getNamedDispatcher(String name) {
		63
		64	throw new RuntimeException("Not implemented");
65	}
66
67	public Servlet getServlet(String name) throws ServletException {
68
69	throw new RuntimeException("Not implemented");
70	}
71
72	public Enumeration getServlets() {
73
74	throw new RuntimeException("Not implemented");
75	}
76
77	public Enumeration getServletNames() {
78
79	throw new RuntimeException("Not implemented");
80	}
81
82	public void log(String msg) {
83	// NOOP
84	}
85
86	public void log(Exception exception, String msg) {
87	// NOOP
88	}
89
90	public void log(String message, Throwable throwable) {
91	// NOOP
92	}
93
94	public String getRealPath(String path) {
95
96	throw new RuntimeException("Not implemented");
97	}
98
99	public String getServerInfo() {
100
101	throw new RuntimeException("Not implemented");
102	}
103
104	public String getInitParameter(String name) {
105
106	throw new RuntimeException("Not implemented");
107	}
108
109	public Enumeration getInitParameterNames() {
110
111	throw new RuntimeException("Not implemented");
112	}
113
114	public Object getAttribute(String name) {
115
116	throw new RuntimeException("Not implemented");
117	}
118
119	public Enumeration getAttributeNames() {
120
121	throw new RuntimeException("Not implemented");
122	}
123
124	public void setAttribute(String name, Object object) {
125	throw new RuntimeException("Not implemented");
126	}
127
128	public void removeAttribute(String name) {
129	throw new RuntimeException("Not implemented");
130	}
131
132	public String getServletContextName() {
133	throw new RuntimeException("Not implemented");
134	}
135
136	@Override
137	public int getEffectiveMajorVersion() {
138	throw new RuntimeException("Not implemented");
139	}
140
141	@Override
142	public int getEffectiveMinorVersion() {
143	throw new RuntimeException("Not implemented");
144	}
145
146	@Override
147	public boolean setInitParameter(String name, String value) {
148	throw new RuntimeException("Not implemented");
149	}
150
151	@Override
152	public Dynamic addServlet(String servletName, String className) {
153	throw new RuntimeException("Not implemented");
154	}
155
156	@Override
157	public Dynamic addServlet(String servletName, Servlet servlet) {
158	throw new RuntimeException("Not implemented");
159	}
160
161	@Override
162	public Dynamic addServlet(String servletName,
163	Class<? extends Servlet> servletClass) {
164	throw new RuntimeException("Not implemented");
165	}
166
167	@Override
168	public <T extends Servlet> T createServlet(Class<T> c)
169	throws ServletException {
170	throw new RuntimeException("Not implemented");
171	}
172
173	@Override
174	public ServletRegistration getServletRegistration(String servletName) {
175	throw new RuntimeException("Not implemented");
176	}
177
178	@Override
179	public Map<String, ? extends ServletRegistration> getServletRegistrations() {
180	throw new RuntimeException("Not implemented");
181	}
182
183	@Override
184	public javax.servlet.FilterRegistration.Dynamic addFilter(
185	String filterName, String className) {
186	throw new RuntimeException("Not implemented");
187	}
188
189	@Override
190	public javax.servlet.FilterRegistration.Dynamic addFilter(
191	String filterName, Filter filter) {
192	throw new RuntimeException("Not implemented");
193	}
194
195	@Override
196	public javax.servlet.FilterRegistration.Dynamic addFilter(
197	String filterName, Class<? extends Filter> filterClass) {
198	throw new RuntimeException("Not implemented");
199	}
200
201	@Override
202	public <T extends Filter> T createFilter(Class<T> c)
203	throws ServletException {
204	throw new RuntimeException("Not implemented");
205	}
206
207	@Override
208	public FilterRegistration getFilterRegistration(String filterName) {
209	throw new RuntimeException("Not implemented");
210	}
211
212	@Override
213	public Map<String, ? extends FilterRegistration> getFilterRegistrations() {
214	throw new RuntimeException("Not implemented");
215	}
216
217	@Override
218	public SessionCookieConfig getSessionCookieConfig() {
219	throw new RuntimeException("Not implemented");
220	}
221
222	@Override
223	public void setSessionTrackingModes(
224	Set<SessionTrackingMode> sessionTrackingModes) {
225	throw new RuntimeException("Not implemented");
226	}
227
228	@Override
229	public Set<SessionTrackingMode> getDefaultSessionTrackingModes() {
230	throw new RuntimeException("Not implemented");
231	}
232
233	@Override
234	public Set<SessionTrackingMode> getEffectiveSessionTrackingModes() {
235	throw new RuntimeException("Not implemented");
236	}
237
238	@Override
239	public void addListener(String className) {
240	throw new RuntimeException("Not implemented");
241	}
242
243	@Override
244	public <T extends EventListener> void addListener(T t) {
245	throw new RuntimeException("Not implemented");
246	}
247
248	@Override
249	public void addListener(Class<? extends EventListener> listenerClass) {
250	throw new RuntimeException("Not implemented");
251	}
252
253	@Override
254	public <T extends EventListener> T createListener(Class<T> c)
255	throws ServletException {
256	throw new RuntimeException("Not implemented");
257	}
258
259	@Override
260	public JspConfigDescriptor getJspConfigDescriptor() {
261	throw new RuntimeException("Not implemented");
262	}
263
264	@Override
265	public ClassLoader getClassLoader() {
266	throw new RuntimeException("Not implemented");
267	}
268
269	@Override
270	public void declareRoles(String... roleNames) {
271	throw new RuntimeException("Not implemented");
272	}
273
274	@Override
275	public String getVirtualServerName() {
276	throw new RuntimeException("Not implemented");
277	}
278
279	}
0	+ native	280	+ native

Line 0 Link Here

(-)test/org/apache/catalina/filters/MockHttpServletRequest.java (+397 lines)
		1	package org.apache.catalina.filters;
		2
		3	import java.io.BufferedReader;
		4	import java.io.IOException;
		5	import java.io.UnsupportedEncodingException;
		6	import java.security.Principal;
		7	import java.util.ArrayList;
		8	import java.util.Collection;
		9	import java.util.Collections;
		10	import java.util.Enumeration;
		11	import java.util.HashMap;
		12	import java.util.HashSet;
		13	import java.util.List;
		14	import java.util.Locale;
		15	import java.util.Map;
		16
		17	import javax.servlet.AsyncContext;
		18	import javax.servlet.DispatcherType;
		19	import javax.servlet.RequestDispatcher;
		20	import javax.servlet.ServletContext;
		21	import javax.servlet.ServletException;
		22	import javax.servlet.ServletInputStream;
		23	import javax.servlet.ServletRequest;
		24	import javax.servlet.ServletResponse;
		25	import javax.servlet.http.Cookie;
		26	import javax.servlet.http.HttpServletRequest;
		27	import javax.servlet.http.HttpServletResponse;
		28	import javax.servlet.http.HttpSession;
		29	import javax.servlet.http.HttpUpgradeHandler;
		30	import javax.servlet.http.Part;
		31
		32	public class MockHttpServletRequest implements HttpServletRequest {
		33
		34	private Map<String, Object> attributes = new HashMap<String, Object>();
		35	private Map<String, List<String>> headers = new HashMap<String, List<String>>();
		36	private String method;
		37	private String contentType;
		38
		39	public Object getAttribute(String name) {
		40	return attributes.get(name);
		41	}
		42
		43	public Enumeration getAttributeNames() {
		44	return Collections.enumeration(attributes.keySet());
		45	}
		46
		47	public String getCharacterEncoding() {
		48
		49	throw new RuntimeException("Not implemented");
		50	}
		51
		52	public void setCharacterEncoding(String env)
		53	throws UnsupportedEncodingException {
		54
		55	}
		56
		57	public int getContentLength() {
		58
		59	throw new RuntimeException("Not implemented");
		60	}
		61
		62	public String getContentType() {
		63	return this.contentType;
		64	}
65
66	public void setContentType(String contentType) {
67	this.contentType = contentType;
68	}
69
70	public ServletInputStream getInputStream() throws IOException {
71
72	throw new RuntimeException("Not implemented");
73	}
74
75	public String getParameter(String name) {
76
77	throw new RuntimeException("Not implemented");
78	}
79
80	public Enumeration getParameterNames() {
81
82	throw new RuntimeException("Not implemented");
83	}
84
85	public String[] getParameterValues(String name) {
86
87	throw new RuntimeException("Not implemented");
88	}
89
90	public Map getParameterMap() {
91
92	throw new RuntimeException("Not implemented");
93	}
94
95	public String getProtocol() {
96
97	throw new RuntimeException("Not implemented");
98	}
99
100	public String getScheme() {
101
102	throw new RuntimeException("Not implemented");
103	}
104
105	public String getServerName() {
106
107	throw new RuntimeException("Not implemented");
108	}
109
110	public int getServerPort() {
111
112	throw new RuntimeException("Not implemented");
113	}
114
115	public BufferedReader getReader() throws IOException {
116
117	throw new RuntimeException("Not implemented");
118	}
119
120	public String getRemoteAddr() {
121
122	throw new RuntimeException("Not implemented");
123	}
124
125	public String getRemoteHost() {
126
127	throw new RuntimeException("Not implemented");
128	}
129
130	public void setAttribute(String name, Object o) {
131	attributes.put(name, o);
132	}
133
134	public void removeAttribute(String name) {
135	attributes.remove(name);
136	}
137
138	public Locale getLocale() {
139
140	throw new RuntimeException("Not implemented");
141	}
142
143	public Enumeration getLocales() {
144
145	throw new RuntimeException("Not implemented");
146	}
147
148	public boolean isSecure() {
149
150	throw new RuntimeException("Not implemented");
151	}
152
153	public RequestDispatcher getRequestDispatcher(String path) {
154
155	throw new RuntimeException("Not implemented");
156	}
157
158	public String getRealPath(String path) {
159
160	throw new RuntimeException("Not implemented");
161	}
162
163	public int getRemotePort() {
164
165	throw new RuntimeException("Not implemented");
166	}
167
168	public String getLocalName() {
169
170	throw new RuntimeException("Not implemented");
171	}
172
173	public String getLocalAddr() {
174
175	throw new RuntimeException("Not implemented");
176	}
177
178	public int getLocalPort() {
179
180	throw new RuntimeException("Not implemented");
181	}
182
183	public String getAuthType() {
184
185	throw new RuntimeException("Not implemented");
186	}
187
188	public Cookie[] getCookies() {
189
190	throw new RuntimeException("Not implemented");
191	}
192
193	public long getDateHeader(String name) {
194
195	throw new RuntimeException("Not implemented");
196	}
197
198	public String getHeader(String name) {
199	List<String> list = headers.get(name);
200	if (list != null) {
201	return CORSFilter.join(new HashSet<String>(list), ",");
202	}
203	return null;
204	}
205
206	public void setHeader(String name, String value) {
207	List<String> values = new ArrayList<String>();
208	values.add(value);
209	headers.put(name, values);
210	}
211
212	public Enumeration getHeaders(String name) {
213
214	throw new RuntimeException("Not implemented");
215	}
216
217	public Enumeration getHeaderNames() {
218	return Collections.enumeration(headers.keySet());
219	}
220
221	public int getIntHeader(String name) {
222
223	throw new RuntimeException("Not implemented");
224	}
225
226	public String getMethod() {
227	return method;
228	}
229
230	public void setMethod(String method) {
231	this.method = method;
232	}
233
234	public String getPathInfo() {
235
236	throw new RuntimeException("Not implemented");
237	}
238
239	public String getPathTranslated() {
240
241	throw new RuntimeException("Not implemented");
242	}
243
244	public String getContextPath() {
245
246	throw new RuntimeException("Not implemented");
247	}
248
249	public String getQueryString() {
250
251	throw new RuntimeException("Not implemented");
252	}
253
254	public String getRemoteUser() {
255
256	throw new RuntimeException("Not implemented");
257	}
258
259	public boolean isUserInRole(String role) {
260
261	throw new RuntimeException("Not implemented");
262	}
263
264	public Principal getUserPrincipal() {
265
266	throw new RuntimeException("Not implemented");
267	}
268
269	public String getRequestedSessionId() {
270
271	throw new RuntimeException("Not implemented");
272	}
273
274	public String getRequestURI() {
275
276	throw new RuntimeException("Not implemented");
277	}
278
279	public StringBuffer getRequestURL() {
280
281	throw new RuntimeException("Not implemented");
282	}
283
284	public String getServletPath() {
285
286	throw new RuntimeException("Not implemented");
287	}
288
289	public HttpSession getSession(boolean create) {
290
291	throw new RuntimeException("Not implemented");
292	}
293
294	public HttpSession getSession() {
295
296	throw new RuntimeException("Not implemented");
297	}
298
299	public boolean isRequestedSessionIdValid() {
300
301	throw new RuntimeException("Not implemented");
302	}
303
304	public boolean isRequestedSessionIdFromCookie() {
305
306	throw new RuntimeException("Not implemented");
307	}
308
309	public boolean isRequestedSessionIdFromURL() {
310
311	throw new RuntimeException("Not implemented");
312	}
313
314	public boolean isRequestedSessionIdFromUrl() {
315
316	throw new RuntimeException("Not implemented");
317	}
318
319	@Override
320	public long getContentLengthLong() {
321	throw new RuntimeException("Not implemented");
322	}
323
324	@Override
325	public ServletContext getServletContext() {
326	throw new RuntimeException("Not implemented");
327	}
328
329	@Override
330	public AsyncContext startAsync() throws IllegalStateException {
331	throw new RuntimeException("Not implemented");
332	}
333
334	@Override
335	public AsyncContext startAsync(ServletRequest servletRequest,
336	ServletResponse servletResponse) throws IllegalStateException {
337	throw new RuntimeException("Not implemented");
338	}
339
340	@Override
341	public boolean isAsyncStarted() {
342	throw new RuntimeException("Not implemented");
343	}
344
345	@Override
346	public boolean isAsyncSupported() {
347	throw new RuntimeException("Not implemented");
348	}
349
350	@Override
351	public AsyncContext getAsyncContext() {
352	throw new RuntimeException("Not implemented");
353	}
354
355	@Override
356	public DispatcherType getDispatcherType() {
357	throw new RuntimeException("Not implemented");
358	}
359
360	@Override
361	public String changeSessionId() {
362	throw new RuntimeException("Not implemented");
363	}
364
365	@Override
366	public boolean authenticate(HttpServletResponse response)
367	throws IOException, ServletException {
368	throw new RuntimeException("Not implemented");
369	}
370
371	@Override
372	public void login(String username, String password) throws ServletException {
373	throw new RuntimeException("Not implemented");
374	}
375
376	@Override
377	public void logout() throws ServletException {
378	throw new RuntimeException("Not implemented");
379	}
380
381	@Override
382	public Collection<Part> getParts() throws IOException, ServletException {
383	throw new RuntimeException("Not implemented");
384	}
385
386	@Override
387	public Part getPart(String name) throws IOException, ServletException {
388	throw new RuntimeException("Not implemented");
389	}
390
391	@Override
392	public <T extends HttpUpgradeHandler> T upgrade(
393	Class<T> httpUpgradeHandlerClass) throws IOException {
394	throw new RuntimeException("Not implemented");
395	}
396
397	}
0	+ native	398	+ native