Index: oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/authorization/ReadTest.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/authorization/ReadTest.java	(revision 1653277)
+++ oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/authorization/ReadTest.java	(revision )
@@ -28,6 +28,7 @@
 import javax.jcr.security.Privilege;
 import javax.jcr.util.TraversingItemVisitor;
 
+import org.apache.jackrabbit.JcrConstants;
 import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager;
 import org.apache.jackrabbit.api.security.user.Group;
 import org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils;
@@ -456,6 +457,47 @@
         assertTrue(test.hasNode("a"));
         Node n2 = test.getNode("a");
         assertTrue(n.isSame(n2));
+    }
+
+    @Test
+    public void testEmptyGlobRestriction()throws Exception{
+        Node grandchild = superuser.getNode(childNPath).addNode("child");
+        String ccPath = grandchild.getPath();
+        superuser.save();
+
+        // first deny access to 'path' (read-access is granted in the test setup)
+        deny(path, readPrivileges);
+        assertFalse(testSession.nodeExists(path));
+        assertFalse(canGetNode(testSession, path));
+        assertFalse(testSession.nodeExists(childNPath));
+        assertFalse(canGetNode(testSession, childNPath));
+        assertFalse(testSession.nodeExists(ccPath));
+        assertFalse(canGetNode(testSession, ccPath));
+        assertFalse(testSession.propertyExists(childchildPPath));
+
+        allow(childNPath, readPrivileges, createGlobRestriction(""));
+        assertFalse(testSession.nodeExists(path));
+        assertFalse(canGetNode(testSession, path));
+        assertTrue(testSession.nodeExists(childNPath));
+        assertTrue(canGetNode(testSession, childNPath));
+        assertFalse(testSession.nodeExists(ccPath));
+        assertFalse(canGetNode(testSession, ccPath));
+        assertFalse(testSession.propertyExists(childchildPPath));
+        assertFalse(testSession.propertyExists(childNPath + '/' + JcrConstants.JCR_PRIMARYTYPE));
+
+        allow(ccPath, readPrivileges);
+        assertTrue(testSession.nodeExists(ccPath));
+        assertTrue(canGetNode(testSession, ccPath));
+        assertTrue(testSession.propertyExists(ccPath + '/' + JcrConstants.JCR_PRIMARYTYPE));
+    }
+
+    private static boolean canGetNode(Session session, String nodePath) throws RepositoryException {
+        try {
+            session.getNode(nodePath);
+            return true;
+        } catch (PathNotFoundException e) {
+            return false;
+        }
     }
 
     /**