Index: jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/ReadTest.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/ReadTest.java	(revision 1653534)
+++ jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/ReadTest.java	(revision )
@@ -16,14 +16,17 @@
  */
 package org.apache.jackrabbit.core.security.authorization.acl;
 
+import org.apache.jackrabbit.JcrConstants;
 import org.apache.jackrabbit.api.JackrabbitSession;
 import org.apache.jackrabbit.api.security.JackrabbitAccessControlList;
 import org.apache.jackrabbit.core.security.authorization.AbstractEvaluationTest;
 import org.apache.jackrabbit.core.security.authorization.AccessControlConstants;
 import org.apache.jackrabbit.test.NotExecutableException;
+import org.junit.Test;
 
 import javax.jcr.AccessDeniedException;
 import javax.jcr.Node;
+import javax.jcr.PathNotFoundException;
 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
 import javax.jcr.Value;
@@ -337,6 +340,84 @@
         propPath = childNPath + "/" + jcrPrimaryType;
         assertFalse(testSession.hasPermission(propPath, javax.jcr.Session.ACTION_READ));
         assertFalse(testSession.propertyExists(propPath));
+    }
+
+    @Test
+    public void testEmptyGlobRestriction()throws Exception{
+        Node grandchild = superuser.getNode(childNPath).addNode("child");
+        String ccPath = grandchild.getPath();
+        superuser.save();
+
+        // first deny access to 'path' (read-access is granted in the test setup)
+        Privilege[] read = privilegesFromName(Privilege.JCR_READ);
+        withdrawPrivileges(path, read, Collections.EMPTY_MAP);
+
+        Session testSession = getTestSession();
+        assertFalse(testSession.nodeExists(path));
+        assertFalse(canGetNode(testSession, path));
+        assertFalse(testSession.nodeExists(childNPath));
+        assertFalse(canGetNode(testSession, childNPath));
+        assertFalse(testSession.nodeExists(ccPath));
+        assertFalse(canGetNode(testSession, ccPath));
+        assertFalse(testSession.propertyExists(childNPath + '/' + JcrConstants.JCR_PRIMARYTYPE));
+
+        Map<String, Value> emptyStringRestriction = new HashMap<String, Value>(getRestrictions(superuser, childNPath));
+        emptyStringRestriction.put(AccessControlConstants.P_GLOB.toString(), vf.createValue(""));
+
+        givePrivileges(childNPath, read, emptyStringRestriction);
+        assertFalse(testSession.nodeExists(path));
+        assertFalse(canGetNode(testSession, path));
+        assertTrue(testSession.nodeExists(childNPath));
+        assertTrue(canGetNode(testSession, childNPath));
+        assertFalse(testSession.nodeExists(ccPath));
+        assertFalse(canGetNode(testSession, ccPath));
+        assertFalse(testSession.propertyExists(childNPath + '/' + JcrConstants.JCR_PRIMARYTYPE));
+
+        givePrivileges(ccPath, read, Collections.EMPTY_MAP);
+        assertTrue(testSession.nodeExists(ccPath));
+        assertTrue(canGetNode(testSession, ccPath));
+        assertTrue(testSession.propertyExists(ccPath + '/' + JcrConstants.JCR_PRIMARYTYPE));
+    }
+
+    @Test
+    public void testEmptyGlobRestriction2()throws Exception{
+        Node grandchild = superuser.getNode(childNPath).addNode("child");
+        String ccPath = grandchild.getPath();
+        superuser.save();
+
+        // first deny access to 'path' (read-access is granted in the test setup)
+        Privilege[] read = privilegesFromName(Privilege.JCR_READ);
+        withdrawPrivileges(path, read, Collections.EMPTY_MAP);
+
+        Session testSession = getTestSession();
+        assertFalse(testSession.nodeExists(path));
+        assertFalse(canGetNode(testSession, path));
+        assertFalse(testSession.nodeExists(childNPath));
+        assertFalse(canGetNode(testSession, childNPath));
+        assertFalse(testSession.nodeExists(ccPath));
+        assertFalse(canGetNode(testSession, ccPath));
+        assertFalse(testSession.propertyExists(childNPath + '/' + JcrConstants.JCR_PRIMARYTYPE));
+
+        Map<String, Value> emptyStringRestriction = new HashMap<String, Value>(getRestrictions(superuser, path));
+        emptyStringRestriction.put(AccessControlConstants.P_GLOB.toString(), vf.createValue(""));
+
+        givePrivileges(path, read, emptyStringRestriction);
+        assertTrue(testSession.nodeExists(path));
+        assertTrue(canGetNode(testSession, path));
+        assertFalse(testSession.nodeExists(childNPath));
+        assertFalse(canGetNode(testSession, childNPath));
+        assertFalse(testSession.nodeExists(ccPath));
+        assertFalse(canGetNode(testSession, ccPath));
+        assertFalse(testSession.propertyExists(childNPath + '/' + JcrConstants.JCR_PRIMARYTYPE));
+    }
+
+    private static boolean canGetNode(Session session, String nodePath) throws RepositoryException {
+        try {
+            session.getNode(nodePath);
+            return true;
+        } catch (PathNotFoundException e) {
+            return false;
+        }
     }
 
     public void testRemoveMixin() throws Exception {
\ No newline at end of file