Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

AntRegexRequestMatcher Optimization 

Closes gh-11234
This commit is contained in:
Rob Winch 2022-05-12 20:14:03 -05:00
parent 6b823fb27e
commit ee28896f42
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java
View File

@ -43,7 +43,9 @@ import org.springframework.util.StringUtils;
*/ */
public final class RegexRequestMatcher implements RequestMatcher { public final class RegexRequestMatcher implements RequestMatcher {
private static final int DEFAULT = 0; private static final int DEFAULT = Pattern.DOTALL;
private static final int CASE_INSENSITIVE = DEFAULT | Pattern.CASE_INSENSITIVE;
private static final Log logger = LogFactory.getLog(RegexRequestMatcher.class); private static final Log logger = LogFactory.getLog(RegexRequestMatcher.class);
@ -68,7 +70,7 @@ public final class RegexRequestMatcher implements RequestMatcher {
* {@link Pattern#CASE_INSENSITIVE} flag set. * {@link Pattern#CASE_INSENSITIVE} flag set.
*/ */
public RegexRequestMatcher(String pattern, String httpMethod, boolean caseInsensitive) { public RegexRequestMatcher(String pattern, String httpMethod, boolean caseInsensitive) {
this.pattern = Pattern.compile(pattern, caseInsensitive ? Pattern.CASE_INSENSITIVE : DEFAULT); this.pattern = Pattern.compile(pattern, caseInsensitive ? CASE_INSENSITIVE : DEFAULT);
this.httpMethod = StringUtils.hasText(httpMethod) ? HttpMethod.valueOf(httpMethod) : null; this.httpMethod = StringUtils.hasText(httpMethod) ? HttpMethod.valueOf(httpMethod) : null;
} }

16
web/src/test/java/org/springframework/security/web/util/matcher/RegexRequestMatcherTests.java
View File

@ -101,6 +101,22 @@ public class RegexRequestMatcherTests {
assertThat(matcher.matches(request)).isFalse(); assertThat(matcher.matches(request)).isFalse();
} }
@Test
public void matchesWithCarriageReturn() {
RegexRequestMatcher matcher = new RegexRequestMatcher(".*", null);
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/blah%0a");
request.setServletPath("/blah\n");
assertThat(matcher.matches(request)).isTrue();
}
@Test
public void matchesWithLineFeed() {
RegexRequestMatcher matcher = new RegexRequestMatcher(".*", null);
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/blah%0d");
request.setServletPath("/blah\r");
assertThat(matcher.matches(request)).isTrue();
}
@Test @Test
public void toStringThenFormatted() { public void toStringThenFormatted() {
RegexRequestMatcher matcher = new RegexRequestMatcher("/blah", "GET"); RegexRequestMatcher matcher = new RegexRequestMatcher("/blah", "GET");