<commit_before>package org.stripesstuff.plugin.security;

import java.lang.reflect.Method;
import javax.servlet.http.HttpServletResponse;

import net.sourceforge.stripes.action.*;
import net.sourceforge.stripes.config.*;
import net.sourceforge.stripes.controller.*;
import net.sourceforge.stripes.exception.StripesRuntimeException;
import net.sourceforge.stripes.util.Log;
import net.sourceforge.stripes.util.ReflectUtil;


/**
 * Security interceptor for the Stripes framework. Determines if handling the event for the current execution context
 * is allowed. Execution is allowed if there is no security manager, or if the security manager allows it. See the
 * documentation of the SecurityManager interface for more information.
 * <p>
 * The security manager is invoked between binding&amp;validation and event handling, in a way to ensure annotations
 * like @DontValidate and @DontBind work as intended.
 *
 * @author <a href="mailto:<EMAIL>"><NAME> - Kind</a>
 * @author <a href="mailto:<EMAIL>"><NAME></a>
 * @version $Id: SecurityInterceptor.java 203 2007-04-27 18:42:44Z oscar $
 * @see SecurityManager
 * @see SecurityHandler
 */
@Intercepts({LifecycleStage.BindingAndValidation, LifecycleStage.CustomValidation, LifecycleStage.EventHandling, LifecycleStage.ResolutionExecution})
public class SecurityInterceptor
		implements Interceptor, ConfigurableComponent
{
	/**
	 * Key used to lookup the name of the SecurityManager class in the Stripes configuration.
	 * This class must have a no-arg constructor and implement StipesSecurityManager.
	 */
	public static final String SECURITY_MANAGER_CLASS = "SecurityManager.Class";
	/**
	 * Key used to store the security manager in the request before processing resolutions.
	 */
	public static final String SECURITY_MANAGER = java.lang.SecurityManager.class.getName();
	/**
	 * Logger for this class.
	 */
	private static final Log LOG = Log.getInstance(SecurityInterceptor.class);
	/**
	 * The configured security manager.
	 */
	private SecurityManager securityManager;


	/**
	 * Initialize the interceptor.
	 *
	 * @param configuration the configuration being used by Stripes
	 * @throws StripesRuntimeException if the security manager cannot be created
	 */
	public void init(Configuration configuration)
			throws StripesRuntimeException
	{
		BootstrapPropertyResolver resolver = configuration.getBootstrapPropertyResolver();

		// Instantiate the security manager.

		String securityMangerClassName = resolver.getProperty(SECURITY_MANAGER_CLASS);
		if (securityMangerClassName != null)
		{
			try
			{
				// Use the reflection utility class instead of Class#forname(String).
				// This is more flexible, and can load classes if this class uses a different classloader than the class
				// implementing the security manager. This is especially useful if the security manager is defined in
				// your application, while this interceptor is in a library. Without this, the security manager cannot
				// be found.

				Class clazz = ReflectUtil.findClass(securityMangerClassName);
				securityManager = (SecurityManager)clazz.newInstance();
			}
			catch (Exception e)
			{
				String msg = "Failed to configure the SecurityManager: instantiation failed.";
				throw new StripesRuntimeException(msg, e);
			}
		}
//		else // Optional: delete this block to allow all access if no security manager is defined.
//		{
//			String msg = "Failed to configure the SecurityManager: no class specified in the property \"" +
//			             SECURITY_MANAGER_CLASS + "\".";
//			throw new StripesRuntimeException(msg);
//		}

		if (securityManager != null)
		{
			LOG.info("Initialized the SecurityInterceptor with the SecurityManager: " + securityManager.toString());
		}
		else
		{
			LOG.info("Initialized the SecurityInterceptor without a SecurityManager (all access will be allowed).");
		}
	}


	/**
	 * Intercept execution.
	 *
	 * @param executionContext the context of the execution being intercepted
	 * @return the resulting {@link Resolution}; returns {@link ExecutionContext#proceed()} if all is well
	 * @throws Exception on error
	 */
	public Resolution intercept(ExecutionContext executionContext)
			throws Exception
	{
		Resolution resolution;

		if (securityManager != null)
		{<commit_msg>a subclass of SecurityManager will now be auto-discovered if it is in a package listed in Extension.Packages in web.xml<commit_after>package org.stripesstuff.plugin.security;

import java.lang.reflect.Method;

import javax.servlet.http.HttpServletResponse;

import net.sourceforge.stripes.action.ActionBean;
import net.sourceforge.stripes.action.ErrorResolution;
import net.sourceforge.stripes.action.Resolution;
import net.sourceforge.stripes.config.BootstrapPropertyResolver;
import net.sourceforge.stripes.config.ConfigurableComponent;
import net.sourceforge.stripes.config.Configuration;
import net.sourceforge.stripes.controller.ExecutionContext;
import net.sourceforge.stripes.controller.Interceptor;
import net.sourceforge.stripes.controller.Intercepts;
import net.sourceforge.stripes.controller.LifecycleStage;
import net.sourceforge.stripes.exception.StripesRuntimeException;
import net.sourceforge.stripes.util.Log;


/**
 * Security interceptor for the Stripes framework. Determines if handling the event for the current execution context
 * is allowed. Execution is allowed if there is no security manager, or if the security manager allows it. See the
 * documentation of the SecurityManager interface for more information.
 * <p>
 * The security manager is invoked between binding&amp;validation and event handling, in a way to ensure annotations
 * like @DontValidate and @DontBind work as intended.
 *
 * @author <a href="mailto:<EMAIL>"><NAME> - Kind</a>
 * @author <a href="mailto:<EMAIL>"><NAME></a>
 * @version $Id: SecurityInterceptor.java 203 2007-04-27 18:42:44Z oscar $
 * @see SecurityManager
 * @see SecurityHandler
 */
@Intercepts({LifecycleStage.BindingAndValidation, LifecycleStage.CustomValidation, LifecycleStage.EventHandling, LifecycleStage.ResolutionExecution})
public class SecurityInterceptor
		implements Interceptor, ConfigurableComponent
{
	/**
	 * Key used to lookup the name of the SecurityManager class in the Stripes configuration.
	 * This class must have a no-arg constructor and implement StipesSecurityManager.
	 */
	public static final String SECURITY_MANAGER_CLASS = "SecurityManager.Class";
	/**
	 * Key used to store the security manager in the request before processing resolutions.
	 */
	public static final String SECURITY_MANAGER = java.lang.SecurityManager.class.getName();
	/**
	 * Logger for this class.
	 */
	private static final Log LOG = Log.getInstance(SecurityInterceptor.class);
	/**
	 * The configured security manager.
	 */
	private SecurityManager securityManager;


	/**
	 * Initialize the interceptor.
	 *
	 * @param configuration the configuration being used by Stripes
	 * @throws StripesRuntimeException if the security manager cannot be created
	 */
	public void init(Configuration configuration)
			throws StripesRuntimeException
	{
		BootstrapPropertyResolver resolver = configuration.getBootstrapPropertyResolver();

		// Instantiate the security manager.

		try
		{
			// Ask the BootstrapPropertyResolver for a subclass of SecurityManager.
			// BootstrapPropertyResolver will look in web.xml first then scan the
			// classpath if the class wasn't specified in web.xml
			
			Class<? extends SecurityManager> clazz = resolver.getClassProperty(SECURITY_MANAGER_CLASS, SecurityManager.class);

			if (clazz != null)
				securityManager = (SecurityManager) clazz.newInstance();
		}
		catch (Exception e)
		{
			String msg = "Failed to configure the SecurityManager: instantiation failed.";
			throw new StripesRuntimeException(msg, e);
		}

		if (securityManager != null)
		{
			LOG.info("Initialized the SecurityInterceptor with the SecurityManager: " + securityManager.toString());
		}
		else
		{
			LOG.info("Initialized the SecurityInterceptor without a SecurityManager (all access will be allowed).");
		}
	}


	/**
	 * Intercept execution.
	 *
	 * @param executionContext the context of the execution being intercepted
	 * @return the resulting {@link Resolution}; returns {@link ExecutionContext#proceed()} if all is well
	 * @throws Exception on error
	 */
	public Resolution intercept(ExecutionContext executionContext)
			throws Exception
	{
		Resolution resolution;

		if (securityManager != null)
		{
{'fraction_non_alphanumeric': 0.08364884051112163, 'fraction_numerical': 0.0040227165168007575, 'mean_word_length': 4.583223249669749, 'pattern_counts': {'":': 0, '<': 22, '<?xml version=': 0, '>': 22, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 3}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4154890', 'n_tokens_mistral': 2415, 'n_tokens_neox': 2168, 'n_words': 751}