String servletClassName = servlet.getServletClass();
Class<?> cls = bundle.loadClass(servletClassName);
if (!Servlet.class.isAssignableFrom(cls)) {
continue;
}
ServletSecurity servletSecurity = cls.getAnnotation(ServletSecurity.class);
if (servletSecurity == null) {
continue;
}
if (servletSecurity.httpMethodConstraints().length > 0) {
for (HttpMethodConstraint httpMethodConstraint : servletSecurity.httpMethodConstraints()) {
String httpMethod = httpMethodConstraint.value();
if (httpMethod == null || httpMethod.trim().isEmpty()) {
throw new DeploymentException("HTTP protocol method could not be null or empty string in the ServletSecurity annotation of the class " + servletClassName);
}
httpMethod = httpMethod.trim();
if (!WebDeploymentValidationUtils.isValidHTTPMethod(httpMethod)) {
throw new DeploymentException("Invalid HTTP method value is found in the ServletSecurity annotation of the class " + servletClassName);
}
}
} else {
HttpConstraint httpConstraint = servletSecurity.value();
if (httpConstraint.rolesAllowed().length > 0 && httpConstraint.value().equals(ServletSecurity.EmptyRoleSemantic.DENY)) {
throw new DeploymentException("EmptyRoleSemantic with value DENY is not allowed in combination with a non-empty rolesAllowed list in the class " + servletClassName);
}
}
}