[SLING-10546] RequestParser#acceptTestName is too lenient

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: JUnit Core 1.0.6
• Fix Version/s: JUnit Core 1.1.6
• Component/s: JUnit Core, Testing
• Assignee: Julian Sedding
• Reporter: Julian Sedding
• Created: 24/Jun/21 15:15
• Updated: 27/Jun/21 14:29
• Resolved: 24/Jun/21 20:05

Description

RequestParser#acceptTestName(String) checks if the test-class name starts with the relevant URL path segment. This is desirable when listing test-classes restricted by java package names. However, the logic also allows inner classes to pass through.

This lenient check in combination with the TeleporterRule (actually ClientSideTeleporter#buildTestBundle) setting Sling-Test-Regexp to the fully qualified class-name of the test class followed by a wildcard (".*") causes inner classes of test-classes to be available as tests and their execution is also attempted (which most likely fails).