Skip to content

Commit 53bcf0d

Browse files
jzheauxjzheaux
committed
Fix Servlet Path Application
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
1 parent 438c783 commit 53bcf0d

8 files changed

Lines changed: 223 additions & 1 deletion

‎config/src/main/java/org/springframework/security/config/http/PathPatternRequestMatcherFactoryBean.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public void setApplicationContext(ApplicationContext context) throws BeansExcept
7070
@Override
7171
public void afterPropertiesSet() throws Exception {
7272
if (this.basePath != null) {
73-
this.builder.basePath(this.basePath);
73+
this.builder = this.builder.basePath(this.basePath);
7474
}
7575
}
7676

‎config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,78 @@ public void configureWhenUsingDefaultMatcherAndServletPathAndAuthorizationManage
314314
.autowire());
315315
}
316316

317+
@Test
318+
public void requestWhenUsingDefaultMatcherAndServletPathThenAuthorizesRequestsAccordingly() throws Exception {
319+
this.spring.configLocations(this.xml("DefaultMatcherServletPath")).autowire();
320+
// @formatter:off
321+
this.mvc.perform(get("/spring/path").with(userCredentials()))
322+
.andExpect(status().isForbidden());
323+
this.mvc.perform(get("/path").with(userCredentials()))
324+
.andExpect(status().isOk());
325+
// @formatter:on
326+
}
327+
328+
@Test
329+
public void requestWhenUsingDefaultMatcherAndServletPathAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
330+
throws Exception {
331+
this.spring.configLocations(this.xml("DefaultMatcherServletPathAuthorizationManager")).autowire();
332+
// @formatter:off
333+
this.mvc.perform(get("/spring/path").with(userCredentials()))
334+
.andExpect(status().isForbidden());
335+
this.mvc.perform(get("/path").with(userCredentials()))
336+
.andExpect(status().isOk());
337+
// @formatter:on
338+
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
339+
}
340+
341+
@Test
342+
public void requestWhenUsingRegexMatcherThenAuthorizesRequestsAccordingly() throws Exception {
343+
this.spring.configLocations(this.xml("RegexMatcher")).autowire();
344+
// @formatter:off
345+
this.mvc.perform(get("/path").with(userCredentials()))
346+
.andExpect(status().isForbidden());
347+
this.mvc.perform(get("/other").with(userCredentials()))
348+
.andExpect(status().isNotFound());
349+
// @formatter:on
350+
}
351+
352+
@Test
353+
public void requestWhenUsingRegexMatcherAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
354+
throws Exception {
355+
this.spring.configLocations(this.xml("RegexMatcherAuthorizationManager")).autowire();
356+
// @formatter:off
357+
this.mvc.perform(get("/path").with(userCredentials()))
358+
.andExpect(status().isForbidden());
359+
this.mvc.perform(get("/other").with(userCredentials()))
360+
.andExpect(status().isNotFound());
361+
// @formatter:on
362+
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
363+
}
364+
365+
@Test
366+
public void requestWhenUsingCiRegexMatcherThenAuthorizesRequestsAccordingly() throws Exception {
367+
this.spring.configLocations(this.xml("CiRegexMatcher")).autowire();
368+
// @formatter:off
369+
this.mvc.perform(get("/path").with(userCredentials()))
370+
.andExpect(status().isForbidden());
371+
this.mvc.perform(get("/PATH").with(userCredentials()))
372+
.andExpect(status().isForbidden());
373+
// @formatter:on
374+
}
375+
376+
@Test
377+
public void requestWhenUsingCiRegexMatcherAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
378+
throws Exception {
379+
this.spring.configLocations(this.xml("CiRegexMatcherAuthorizationManager")).autowire();
380+
// @formatter:off
381+
this.mvc.perform(get("/path").with(userCredentials()))
382+
.andExpect(status().isForbidden());
383+
this.mvc.perform(get("/PATH").with(userCredentials()))
384+
.andExpect(status().isForbidden());
385+
// @formatter:on
386+
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
387+
}
388+
317389
@Test
318390
public void requestWhenUsingFilterAllDispatcherTypesAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
319391
throws Exception {

‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-CiRegexMatcher.xml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2004-present the original author or authors.
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ https://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xmlns="http://www.springframework.org/schema/security"
21+
xsi:schemaLocation="
22+
http://www.springframework.org/schema/security
23+
https://www.springframework.org/schema/security/spring-security.xsd
24+
http://www.springframework.org/schema/beans
25+
https://www.springframework.org/schema/beans/spring-beans.xsd">
26+
27+
<http request-matcher="ciRegex" use-authorization-manager="false">
28+
<intercept-url pattern="\A/PATH\Z" access="denyAll"/>
29+
<intercept-url pattern="\A/.*\Z" access="permitAll"/>
30+
<http-basic/>
31+
</http>
32+
33+
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
34+
35+
<b:import resource="userservice.xml"/>
36+
</b:beans>

‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-CiRegexMatcherAuthorizationManager.xml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2004-present the original author or authors.
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ https://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xmlns="http://www.springframework.org/schema/security"
21+
xsi:schemaLocation="
22+
http://www.springframework.org/schema/security
23+
https://www.springframework.org/schema/security/spring-security.xsd
24+
http://www.springframework.org/schema/beans
25+
https://www.springframework.org/schema/beans/spring-beans.xsd">
26+
27+
<http request-matcher="ciRegex">
28+
<intercept-url pattern="\A/PATH\Z" access="denyAll"/>
29+
<intercept-url pattern="\A/.*\Z" access="permitAll"/>
30+
<http-basic/>
31+
</http>
32+
33+
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
34+
35+
<b:import resource="userservice.xml"/>
36+
</b:beans>

‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-DefaultMatcherServletPath.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,11 @@
2626

2727
<http use-authorization-manager="false">
2828
<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
29+
<intercept-url pattern="/**" access="permitAll"/>
2930
<http-basic/>
3031
</http>
3132

33+
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
34+
3235
<b:import resource="userservice.xml"/>
3336
</b:beans>

‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-DefaultMatcherServletPathAuthorizationManager.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,11 @@
2626

2727
<http>
2828
<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
29+
<intercept-url pattern="/**" access="permitAll"/>
2930
<http-basic/>
3031
</http>
3132

33+
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
34+
3235
<b:import resource="userservice.xml"/>
3336
</b:beans>

‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-RegexMatcher.xml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2004-present the original author or authors.
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ https://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xmlns="http://www.springframework.org/schema/security"
21+
xsi:schemaLocation="
22+
http://www.springframework.org/schema/security
23+
https://www.springframework.org/schema/security/spring-security.xsd
24+
http://www.springframework.org/schema/beans
25+
https://www.springframework.org/schema/beans/spring-beans.xsd">
26+
27+
<http request-matcher="regex" use-authorization-manager="false">
28+
<intercept-url pattern="\A/path\Z" access="denyAll"/>
29+
<intercept-url pattern="\A/.*\Z" access="permitAll"/>
30+
<http-basic/>
31+
</http>
32+
33+
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
34+
35+
<b:import resource="userservice.xml"/>
36+
</b:beans>

‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-RegexMatcherAuthorizationManager.xml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2004-present the original author or authors.
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ https://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xmlns="http://www.springframework.org/schema/security"
21+
xsi:schemaLocation="
22+
http://www.springframework.org/schema/security
23+
https://www.springframework.org/schema/security/spring-security.xsd
24+
http://www.springframework.org/schema/beans
25+
https://www.springframework.org/schema/beans/spring-beans.xsd">
26+
27+
<http request-matcher="regex">
28+
<intercept-url pattern="\A/path\Z" access="denyAll"/>
29+
<intercept-url pattern="\A/.*\Z" access="permitAll"/>
30+
<http-basic/>
31+
</http>
32+
33+
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
34+
35+
<b:import resource="userservice.xml"/>
36+
</b:beans>

0 commit comments

Comments
 (0)