Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Default to shouldFilterAllDispatcherTypes=true in XML 

Closes gh-11970
This commit is contained in:
Marcus Da Coregio 2022-10-07 11:46:20 -03:00
parent 146d3269bc
commit 9fd195d419
7 changed files with 84 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java
View File

@ -85,8 +85,8 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
BeanDefinitionBuilder filterBuilder = BeanDefinitionBuilder.rootBeanDefinition(AuthorizationFilter.class);
filterBuilder.getRawBeanDefinition().setSource(parserContext.extractSource(element));
filterBuilder.addConstructorArgReference(this.authorizationManagerRef);
if ("true".equals(element.getAttribute(ATT_FILTER_ALL_DISPATCHER_TYPES))) {
filterBuilder.addPropertyValue("shouldFilterAllDispatcherTypes", Boolean.TRUE);
if ("false".equals(element.getAttribute(ATT_FILTER_ALL_DISPATCHER_TYPES))) {
filterBuilder.addPropertyValue("shouldFilterAllDispatcherTypes", Boolean.FALSE);
}
BeanDefinition filter = filterBuilder
.addPropertyValue("securityContextHolderStrategy", this.securityContextHolderStrategy)

2
config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
View File

@ -386,7 +386,7 @@ http.attlist &=
## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "false"
attribute once-per-request {xsd:boolean}?
http.attlist &=
## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not work when use-authorization-manager=false. Defaults to "false".
## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not work when use-authorization-manager=false. Defaults to "true".
attribute filter-all-dispatcher-types {xsd:boolean}?
http.attlist &=
## Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true" (rewriting is disabled).

2
config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
View File

@ -1366,7 +1366,7 @@
<xs:attribute name="filter-all-dispatcher-types" type="xs:boolean">
<xs:annotation>
<xs:documentation>Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not
work when use-authorization-manager=false. Defaults to "false".
work when use-authorization-manager=false. Defaults to "true".
</xs:documentation>
</xs:annotation>
</xs:attribute>

22
config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java
View File

@ -406,6 +406,28 @@ public class InterceptUrlConfigTests {
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
}
@Test
public void requestWhenUsingFilterAllDispatcherTypesFalseThenAuthorizesRequestsAccordingly() throws Exception {
this.spring.configLocations(this.xml("FilterAllDispatcherTypesFalse")).autowire();
// @formatter:off
this.mvc.perform(get("/path").with(userCredentials()))
.andExpect(status().isOk());
this.mvc.perform(get("/path").with(adminCredentials()))
.andExpect(status().isForbidden());
this.mvc.perform(get("/error").with((request) -> {
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error");
request.setDispatcherType(DispatcherType.ERROR);
return request;
})).andExpect(status().isOk());
this.mvc.perform(get("/path").with((request) -> {
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/path");
request.setDispatcherType(DispatcherType.ERROR);
return request;
})).andExpect(status().isOk());
// @formatter:on
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
}
private static RequestPostProcessor adminCredentials() {
return httpBasic("admin", "password");
}

2
config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml
View File

@ -24,7 +24,7 @@
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
<http auto-config="true" use-authorization-manager="true" filter-all-dispatcher-types="true">
<http auto-config="true">
<intercept-url request-matcher-ref="pathErrorRequestMatcher" access="permitAll()" />
<intercept-url request-matcher-ref="errorRequestMatcher" access="authenticated" />
<intercept-url pattern="/**" access="hasRole('USER')"/>

55
config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml Normal file
View File

@ -0,0 +1,55 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Copyright 2002-2022 the original author or authors.
~
~ Licensed under the Apache License, Version 2.0 (the "License");
~ you may not use this file except in compliance with the License.
~ You may obtain a copy of the License at
~
~ https://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing, software
~ distributed under the License is distributed on an "AS IS" BASIS,
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
~ See the License for the specific language governing permissions and
~ limitations under the License.
-->
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xsi:schemaLocation="
http://www.springframework.org/schema/security
https://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
<http auto-config="true" filter-all-dispatcher-types="false">
<intercept-url request-matcher-ref="pathErrorRequestMatcher" access="permitAll()" />
<intercept-url request-matcher-ref="errorRequestMatcher" access="authenticated" />
<intercept-url pattern="/**" access="hasRole('USER')"/>
<http-basic/>
</http>
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
<b:bean name="error" class="org.springframework.security.config.http.InterceptUrlConfigTests.ErrorController"/>
<b:bean name="errorRequestMatcher" class="org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher">
<b:constructor-arg value="ERROR"/>
</b:bean>
<b:bean name="errorPathRequestMatcher" class="org.springframework.security.web.util.matcher.AntPathRequestMatcher">
<b:constructor-arg value="/error"/>
</b:bean>
<b:bean name="pathErrorRequestMatcher" class="org.springframework.security.web.util.matcher.AndRequestMatcher">
<b:constructor-arg>
<b:list>
<b:ref bean="errorRequestMatcher"/>
<b:ref bean="errorPathRequestMatcher"/>
</b:list>
</b:constructor-arg>
</b:bean>
<b:import resource="userservice.xml"/>
</b:beans>

4
docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc
View File

@ -99,8 +99,8 @@ Defaults to `false`.
[[nsa-http-filter-all-dispatcher-types]]
* **filter-all-dispatcher-types**
Corresponds to the `shouldFilterAllDispatcherTypes` property of the `AuthorizationFilter`. Only works when `use-authorization-manager=true`.
Defaults to `false`.
Corresponds to the `shouldFilterAllDispatcherTypes` property of the `AuthorizationFilter`. Does not work when `use-authorization-manager=false`.
Defaults to `true`.
[[nsa-http-pattern]]