### Question:
ApplicationResourceServlet extends HttpServlet { protected long getTenantID(final HttpServletRequest request) throws NoCredentialsInSessionException { final HttpSession httpSession = request.getSession(); final APISession aAPISession = (APISession) httpSession.getAttribute(SessionUtil.API_SESSION_PARAM_KEY); return aAPISession.getTenantId(); }   static final String PROCESS_ID_PARAM; static final String WEB_RESOURCES_DIR; static final String RESOURCE_PATH_PARAM; static final String API_SESSION_PARAM_KEY; static final String USER_SESSION_PARAM_KEY; }### Answer:
@Test public void should_verify_authorisation_for_the_given_location_param() throws Exception { final ApplicationResourceServlet applicationResourceServlet = spy(new ApplicationResourceServlet()); when(req.getParameter("process")).thenReturn("processUUIDStr"); when(req.getParameter("location")).thenReturn("../../../file.txt"); when(req.getMethod()).thenReturn("GET"); when(req.getSession()).thenReturn(httpSession); when(httpSession.getAttribute("apiSession")).thenReturn(session); when(session.getTenantId()).thenReturn(1L); when(req.getParameter("tenant")).thenReturn("1"); when(applicationResourceServlet.getTenantID(req)).thenReturn(1L); final File process = new File(WebBonitaConstantsUtils.getInstance(1L).getFormsWorkFolder().getAbsolutePath(), "processUUIDStr"); process.mkdirs(); final File processDeployement = new File(process.getAbsolutePath(), "1"); processDeployement.mkdirs(); try { applicationResourceServlet.service(req, res); } catch (final ServletException e) { assertTrue(e.getCause().getMessage().startsWith("For security reasons, access to this file paths")); } }