Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-25 11:43:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reconsider AntPathRequestMatcher matching logic

Browse Source 
Closes gh-9285
This commit is contained in:
Evgeniy Cheban 2020-12-21 04:27:16 +03:00 committed by Josh Cummings
parent f36e2fca59
commit 77484018bb
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
web/src/main/java/org/springframework/security/web/util/matcher/AntPathRequestMatcher.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2019 the original author or authors. * Copyright 2002-2021 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -48,6 +48,7 @@ import org.springframework.web.util.UrlPathHelper;
* @author Luke Taylor * @author Luke Taylor
* @author Rob Winch * @author Rob Winch
* @author Eddú Meléndez * @author Eddú Meléndez
* @author Evgeniy Cheban
* @since 3.1 * @since 3.1
* @see org.springframework.util.AntPathMatcher * @see org.springframework.util.AntPathMatcher
*/ */
@ -159,9 +160,12 @@ public final class AntPathRequestMatcher implements RequestMatcher, RequestVaria
@Override @Override
public MatchResult matcher(HttpServletRequest request) { public MatchResult matcher(HttpServletRequest request) {
if (this.matcher == null || !matches(request)) { if (!matches(request)) {
return MatchResult.notMatch(); return MatchResult.notMatch();
} }
if (this.matcher == null) {
return MatchResult.match();
}
String url = getRequestPath(request); String url = getRequestPath(request);
return MatchResult.match(this.matcher.extractUriTemplateVariables(url)); return MatchResult.match(this.matcher.extractUriTemplateVariables(url));
} }

11
web/src/test/java/org/springframework/security/web/util/matcher/AntPathRequestMatcherTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2016 the original author or authors. * Copyright 2002-2021 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -32,6 +32,7 @@ import static org.mockito.BDDMockito.given;
/** /**
* @author Luke Taylor * @author Luke Taylor
* @author Rob Winch * @author Rob Winch
* @author Evgeniy Cheban
*/ */
@RunWith(MockitoJUnitRunner.class) @RunWith(MockitoJUnitRunner.class)
public class AntPathRequestMatcherTests { public class AntPathRequestMatcherTests {
@ -196,6 +197,14 @@ public class AntPathRequestMatcherTests {
assertThat(matcher.matches(request)).isFalse(); assertThat(matcher.matches(request)).isFalse();
} }
// gh-9285
@Test
public void matcherWhenMatchAllPatternThenMatchResult() {
AntPathRequestMatcher matcher = new AntPathRequestMatcher("/**");
MockHttpServletRequest request = createRequest("/blah");
assertThat(matcher.matcher(request).isMatch()).isTrue();
}
private HttpServletRequest createRequestWithNullMethod(String path) { private HttpServletRequest createRequestWithNullMethod(String path) {
given(this.request.getServletPath()).willReturn(path); given(this.request.getServletPath()).willReturn(path);
return this.request; return this.request;