### Question:
ResourceForwardingServlet extends HttpServlet { @Override protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { String path = req.getServletPath(); String resourcePath = req.getPathInfo() == null ? path : path.concat(req.getPathInfo()); String newResourcePath = resourcePath.replaceFirst("^/[^/]+/[^/]*", ""); String[] tokens = newResourcePath.split("/"); StringBuilder buff = new StringBuilder(); boolean allowForward = false; int pathTokenCount = 0; for (String t : tokens) { if (t.length() <= 0) continue; if (pathTokenCount >= this.maxTokens) break; buff.append("/"); buff.append(t); pathTokenCount++; String pathSubstr = buff.toString().toUpperCase(); if (forwardWhitelist.contains(pathSubstr)) { if (logger.isDebugEnabled()) logger.debug("Resource path " + newResourcePath + " was found in the whitelist due to " + pathSubstr + " entry."); allowForward = true; break; } } if (!allowForward) { logger.warn("Resource path " + newResourcePath + " forbidden, because it is not whitelisted."); resp.sendError(403); return; } if (logger.isDebugEnabled()) logger.debug("Forwarding resource path " + resourcePath + " to " + newResourcePath); if (req.getParameterMap() != null) { req.setAttribute(FORWARDED_PARAMETERS, req.getParameterMap()); } req.getRequestDispatcher(newResourcePath).forward(req, resp); }  @Override void init(ServletConfig config); static final String FORWARD_WHITELIST_PARAM; }### Answer:
@Test public void testForwardingHappens() throws Exception { when(requestMock.getPathInfo()).thenReturn(CONFIG_WHITELIST_ARR[0]); when(requestMock.getRequestDispatcher(CONFIG_WHITELIST_ARR[0])).thenReturn(requestDispatcher); resourceForwardingServlet.doGet(requestMock, responseMock); verify(responseMock, times(0)).sendError(403); verify(requestDispatcher, times(1)).forward(requestMock, responseMock); }
@Test public void testForwardingDoesNotHappen_403() throws Exception { when(requestMock.getPathInfo()).thenReturn(NOT_IN_WHITELIST_URI); resourceForwardingServlet.doGet(requestMock, responseMock); verify(requestDispatcher, times(0)).forward(requestMock, responseMock); verify(responseMock, times(1)).sendError(403); }