### Question:
CustomPageRequestModifier { public void forwardIfRequestIsAuthorized(final HttpServletRequest request, final HttpServletResponse response, final String apiPathShouldStartWith, final String apiPath) throws IOException, ServletException { try { URI uri = new URI(apiPath); if (!uri.normalize().toString().startsWith(apiPathShouldStartWith)) { final String message = "attempt to access unauthorized path " + apiPath; if (LOGGER.isLoggable(Level.FINE)) { LOGGER.log(Level.FINE, message); } response.sendError(HttpServletResponse.SC_FORBIDDEN, message); } else { request.getRequestDispatcher(apiPath).forward(request, response); } }catch (URISyntaxException e) { if (LOGGER.isLoggable(Level.FINE)) { LOGGER.log(Level.FINE, e.getMessage()); } response.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage()); } }  void redirectToValidPageUrl(final HttpServletRequest request, final HttpServletResponse response); void forwardIfRequestIsAuthorized(final HttpServletRequest request, final HttpServletResponse response, final String apiPathShouldStartWith, final String apiPath);  }### Answer:
@Test public void check_should_not_authorize_requests_to_other_paths() throws Exception { String apiPath = "/API/living/../../WEB-INF/web.xml"; CustomPageRequestModifier customPageRequestModifier = new CustomPageRequestModifier(); customPageRequestModifier.forwardIfRequestIsAuthorized(request, response, "/API", apiPath); verify(response).sendError(HttpServletResponse.SC_FORBIDDEN, "attempt to access unauthorized path " + apiPath); verify(request, never()).getRequestDispatcher(anyString()); }
@Test public void check_should_authorize_valid_requests() throws Exception { String apiPath = "/API/living/0"; when(request.getRequestDispatcher(apiPath)).thenReturn(requestDispatcher); CustomPageRequestModifier customPageRequestModifier = new CustomPageRequestModifier(); customPageRequestModifier.forwardIfRequestIsAuthorized(request, response, "/API", apiPath); verify(request).getRequestDispatcher(apiPath); verify(response, never()).sendError(anyInt(), anyString()); }