Merge branch 'main' into gh-16038

jonah1und1 · jonah1und1 · commit 0aa03fc0c3dc · 2024-11-05T11:03:26.000+01:00
# Conflicts:
#	oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java
#	oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/authentication/ServerBearerTokenAuthenticationConverter.java
#	oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java b/config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java
@@ -199,6 +199,12 @@ public C requestMatchers(RequestMatcher... requestMatchers) {
 	 * @since 5.8
 	 */
 	public C requestMatchers(HttpMethod method, String... patterns) {
+		if (anyPathsDontStartWithLeadingSlash(patterns)) {
+			this.logger.warn("One of the patterns in " + Arrays.toString(patterns)
+					+ " is missing a leading slash. This is discouraged; please include the "
+					+ "leading slash in all your request matcher patterns. In future versions of "
+					+ "Spring Security, leaving out the leading slash will result in an exception.");
+		}
 		if (!mvcPresent) {
 			return requestMatchers(RequestMatchers.antMatchersAsArray(method, patterns));
 		}
@@ -219,6 +225,15 @@ public C requestMatchers(HttpMethod method, String... patterns) {
 		return requestMatchers(matchers.toArray(new RequestMatcher[0]));
 	}
 
+	private boolean anyPathsDontStartWithLeadingSlash(String... patterns) {
+		for (String pattern : patterns) {
+			if (!pattern.startsWith("/")) {
+				return true;
+			}
+		}
+		return false;
+	}
+
 	private RequestMatcher resolve(AntPathRequestMatcher ant, MvcRequestMatcher mvc, ServletContext servletContext) {
 		Map<String, ? extends ServletRegistration> registrations = mappableServletRegistrations(servletContext);
 		if (registrations.isEmpty()) {
diff --git a/docs/modules/ROOT/pages/servlet/saml2/login/authentication.adoc b/docs/modules/ROOT/pages/servlet/saml2/login/authentication.adoc
@@ -139,7 +139,7 @@ public class SecurityConfig {
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         OpenSaml4AuthenticationProvider authenticationProvider = new OpenSaml4AuthenticationProvider();
         authenticationProvider.setAssertionValidator(OpenSaml4AuthenticationProvider
-                .createDefaultAssertionValidator(assertionToken -> {
+                .createDefaultAssertionValidatorWithParameters(assertionToken -> {
                     Map<String, Object> params = new HashMap<>();
                     params.put(CLOCK_SKEW, Duration.ofMinutes(10).toMillis());
                     // ... other validation parameters
@@ -171,7 +171,7 @@ open class SecurityConfig {
         val authenticationProvider = OpenSaml4AuthenticationProvider()
         authenticationProvider.setAssertionValidator(
             OpenSaml4AuthenticationProvider
-                .createDefaultAssertionValidator(Converter<OpenSaml4AuthenticationProvider.AssertionToken, ValidationContext> {
+                .createDefaultAssertionValidatorWithParameters(Converter<OpenSaml4AuthenticationProvider.AssertionToken, ValidationContext> {
                     val params: MutableMap<String, Any> = HashMap()
                     params[CLOCK_SKEW] =
                         Duration.ofMinutes(10).toMillis()
diff --git a/docs/package.json b/docs/package.json
@@ -2,7 +2,7 @@
   "dependencies": {
     "antora": "3.2.0-alpha.6",
     "@antora/atlas-extension": "1.0.0-alpha.2",
-    "@antora/collector-extension": "1.0.0-beta.3",
+    "@antora/collector-extension": "1.0.0-beta.4",
     "@asciidoctor/tabs": "1.0.0-beta.6",
     "@springio/antora-extensions": "1.14.2",
     "@springio/asciidoctor-extensions": "1.0.0-alpha.14"
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -7,7 +7,7 @@ jakarta-websocket = "2.2.0"
 org-apache-directory-server = "1.5.5"
 org-apache-maven-resolver = "1.9.22"
 org-aspectj = "1.9.22.1"
-org-bouncycastle = "1.78.1"
+org-bouncycastle = "1.79"
 org-eclipse-jetty = "11.0.24"
 org-jetbrains-kotlin = "1.9.25"
 org-jetbrains-kotlinx = "1.9.0"
@@ -71,7 +71,7 @@ org-eclipse-jetty-jetty-server = { module = "org.eclipse.jetty:jetty-server", ve
 org-eclipse-jetty-jetty-servlet = { module = "org.eclipse.jetty:jetty-servlet", version.ref = "org-eclipse-jetty" }
 org-hamcrest = "org.hamcrest:hamcrest:2.2"
 org-hibernate-orm-hibernate-core = "org.hibernate.orm:hibernate-core:6.6.1.Final"
-org-hsqldb = "org.hsqldb:hsqldb:2.7.3"
+org-hsqldb = "org.hsqldb:hsqldb:2.7.4"
 org-jetbrains-kotlin-kotlin-bom = { module = "org.jetbrains.kotlin:kotlin-bom", version.ref = "org-jetbrains-kotlin" }
 org-jetbrains-kotlin-kotlin-gradle-plugin = "org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25"
 org-jetbrains-kotlinx-kotlinx-coroutines-bom = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-bom", version.ref = "org-jetbrains-kotlinx" }
@@ -83,7 +83,7 @@ org-opensaml-opensaml5-saml-api = { module = "org.opensaml:opensaml-saml-api", v
 org-opensaml-opensaml5-saml-impl = { module = "org.opensaml:opensaml-saml-impl", version.ref = "org-opensaml5" }
 org-python-jython = { module = "org.python:jython", version = "2.5.3" }
 org-seleniumhq-selenium-htmlunit-driver = "org.seleniumhq.selenium:htmlunit3-driver:4.25.0"
-org-seleniumhq-selenium-selenium-java = "org.seleniumhq.selenium:selenium-java:4.25.0"
+org-seleniumhq-selenium-selenium-java = "org.seleniumhq.selenium:selenium-java:4.26.0"
 org-seleniumhq-selenium-selenium-support = "org.seleniumhq.selenium:selenium-support:3.141.59"
 org-skyscreamer-jsonassert = "org.skyscreamer:jsonassert:1.5.3"
 org-slf4j-log4j-over-slf4j = "org.slf4j:log4j-over-slf4j:1.7.36"
@@ -107,7 +107,7 @@ org-jfrog-buildinfo-build-info-extractor-gradle = "org.jfrog.buildinfo:build-inf
 org-sonarsource-scanner-gradle-sonarqube-gradle-plugin = "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.8.0.1969"
 org-instancio-instancio-junit = "org.instancio:instancio-junit:3.7.1"
 
-webauthn4j-core = 'com.webauthn4j:webauthn4j-core:0.27.0.RELEASE'
+webauthn4j-core = 'com.webauthn4j:webauthn4j-core:0.28.0.RELEASE'
 
 [plugins]
 
diff --git a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolver.java
@@ -57,12 +57,17 @@ public String resolve(final HttpServletRequest request) {
 				? resolveFromRequestParameters(request) : null;
 		if (authorizationHeaderToken != null) {
 			if (parameterToken != null) {
-				final BearerTokenError error = BearerTokenErrors
+				BearerTokenError error = BearerTokenErrors
 					.invalidRequest("Found multiple bearer tokens in the request");
 				throw new OAuth2AuthenticationException(error);
 			}
 			return authorizationHeaderToken;
 		}
+		if (parameterToken != null && !StringUtils.hasText(parameterToken)) {
+			BearerTokenError error = BearerTokenErrors
+											 .invalidRequest("The requested token parameter is an empty string");
+			throw new OAuth2AuthenticationException(error);
+		}
 		return parameterToken;
 	}
 
diff --git a/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/authentication/ServerBearerTokenAuthenticationConverter.java b/oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/web/server/authentication/ServerBearerTokenAuthenticationConverter.java
@@ -77,6 +77,11 @@ private String token(ServerHttpRequest request) {
 			}
 			return authorizationHeaderToken;
 		}
+		if (parameterToken != null && !StringUtils.hasText(parameterToken)) {
+			BearerTokenError error = BearerTokenErrors
+											 .invalidRequest("The requested token parameter is an empty string");
+			throw new OAuth2AuthenticationException(error);
+		}
 		return parameterToken;
 	}
 
diff --git a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/DefaultBearerTokenResolverTests.java
@@ -21,8 +21,11 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
+import org.springframework.security.oauth2.server.resource.BearerTokenError;
+import org.springframework.security.oauth2.server.resource.BearerTokenErrorCodes;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -285,4 +288,35 @@ void resolveWhenRequestContainsTwoAccessTokenQueryParameterAndSupportIsDisabledT
 		assertThat(this.resolver.resolve(request)).isNull();
 	}
 
+	@Test
+	public void resolveWhenQueryParameterIsPresentAndEmptyStringThenTokenIsNotResolved() {
+		this.resolver.setAllowUriQueryParameter(true);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setMethod("GET");
+		request.addParameter("access_token", "");
+		assertThatExceptionOfType(OAuth2AuthenticationException.class).isThrownBy(() -> this.resolver.resolve(request))
+			.withMessageContaining("The requested token parameter is an empty string")
+			.satisfies((e) -> {
+				BearerTokenError error = (BearerTokenError) e.getError();
+				assertThat(error.getErrorCode()).isEqualTo(BearerTokenErrorCodes.INVALID_REQUEST);
+				assertThat(error.getHttpStatus()).isEqualTo(HttpStatus.BAD_REQUEST);
+			});
+	}
+
+	@Test
+	public void resolveWhenFormParameterIsPresentAndEmptyStringThenTokenIsNotResolved() {
+		this.resolver.setAllowFormEncodedBodyParameter(true);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setMethod("POST");
+		request.setContentType("application/x-www-form-urlencoded");
+		request.addParameter("access_token", "");
+		assertThatExceptionOfType(OAuth2AuthenticationException.class).isThrownBy(() -> this.resolver.resolve(request))
+			.withMessageContaining("The requested token parameter is an empty string")
+			.satisfies((e) -> {
+				BearerTokenError error = (BearerTokenError) e.getError();
+				assertThat(error.getErrorCode()).isEqualTo(BearerTokenErrorCodes.INVALID_REQUEST);
+				assertThat(error.getHttpStatus()).isEqualTo(HttpStatus.BAD_REQUEST);
+			});
+	}
+
 }
diff --git a/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/server/authentication/ServerBearerTokenAuthenticationConverterTests.java b/oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/web/server/authentication/ServerBearerTokenAuthenticationConverterTests.java
@@ -188,9 +188,9 @@ public void resolveWhenQueryParameterIsEmptyAndSupportedThenOAuth2Authentication
 				.isThrownBy(() -> convertToToken(request))
 				.satisfies((ex) -> {
 					BearerTokenError error = (BearerTokenError) ex.getError();
-					assertThat(error.getErrorCode()).isEqualTo(BearerTokenErrorCodes.INVALID_TOKEN);
+					assertThat(error.getErrorCode()).isEqualTo(BearerTokenErrorCodes.INVALID_REQUEST);
 					assertThat(error.getUri()).isEqualTo("https://tools.ietf.org/html/rfc6750#section-3.1");
-					assertThat(error.getHttpStatus()).isEqualTo(HttpStatus.UNAUTHORIZED);
+					assertThat(error.getHttpStatus()).isEqualTo(HttpStatus.BAD_REQUEST);
 				});
 		// @formatter:on
 	}
diff --git a/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java
@@ -338,7 +338,7 @@ protected void successfulAuthentication(HttpServletRequest request, HttpServletR
 	 * <ol>
 	 * <li>Clears the {@link SecurityContextHolder}</li>
 	 * <li>Stores the exception in the session (if it exists or
-	 * <tt>allowSesssionCreation</tt> is set to <tt>true</tt>)</li>
+	 * <tt>allowSessionCreation</tt> is set to <tt>true</tt>)</li>
 	 * <li>Informs the configured <tt>RememberMeServices</tt> of the failed login</li>
 	 * <li>Delegates additional behaviour to the
 	 * {@link AuthenticationFailureHandler}.</li>
diff --git a/web/src/main/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategy.java b/web/src/main/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategy.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -174,7 +174,7 @@ public void setExceptionIfMaximumExceeded(boolean exceptionIfMaximumExceeded) {
 	/**
 	 * Sets the <tt>maxSessions</tt> property. The default value is 1. Use -1 for
 	 * unlimited sessions.
-	 * @param maximumSessions the maximimum number of permitted sessions a user can have
+	 * @param maximumSessions the maximum number of permitted sessions a user can have
 	 * open simultaneously.
 	 */
 	public void setMaximumSessions(int maximumSessions) {
diff --git a/web/src/main/java/org/springframework/security/web/context/AbstractSecurityWebApplicationInitializer.java b/web/src/main/java/org/springframework/security/web/context/AbstractSecurityWebApplicationInitializer.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -285,9 +285,9 @@ protected EnumSet<DispatcherType> getSecurityDispatcherTypes() {
 	}
 
 	/**
-	 * Determine if the springSecurityFilterChain should be marked as supporting asynch.
+	 * Determine if the springSecurityFilterChain should be marked as supporting async.
 	 * Default is true.
-	 * @return true if springSecurityFilterChain should be marked as supporting asynch
+	 * @return true if springSecurityFilterChain should be marked as supporting async
 	 */
 	protected boolean isAsyncSecuritySupported() {
 		return true;
diff --git a/web/src/main/java/org/springframework/security/web/server/header/ClearSiteDataServerHttpHeadersWriter.java b/web/src/main/java/org/springframework/security/web/server/header/ClearSiteDataServerHttpHeadersWriter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,7 +27,7 @@
  * </p>
  *
  * <p>
- * For further details pleaes consult <a href="https://www.w3.org/TR/clear-site-data/">W3C
+ * For further details please consult <a href="https://www.w3.org/TR/clear-site-data/">W3C
  * Documentation</a>.
  * </p>
  *
diff --git a/web/src/main/java/org/springframework/security/web/server/header/ContentSecurityPolicyServerHttpHeadersWriter.java b/web/src/main/java/org/springframework/security/web/server/header/ContentSecurityPolicyServerHttpHeadersWriter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2018 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,7 +23,7 @@
 import org.springframework.web.server.ServerWebExchange;
 
 /**
- * Writes the {@code Contet-Security-Policy} response header with configured policy
+ * Writes the {@code Content-Security-Policy} response header with configured policy
  * directives.
  *
  * @author Vedran Pavic
diff --git a/web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorSelectionCriteria.java b/web/src/main/java/org/springframework/security/web/webauthn/api/AuthenticatorSelectionCriteria.java
@@ -25,7 +25,7 @@
  *
  * There is no <a href=
  * "https://www.w3.org/TR/webauthn-3/#dom-authenticatorselectioncriteria-requireresidentkey">requireResidentKey</a>
- * property because it is only for backwards compatability with WebAuthn Level 1.
+ * property because it is only for backwards compatibility with WebAuthn Level 1.
  *
  * @author Rob Winch
  * @since 6.4
@@ -40,7 +40,7 @@ public final class AuthenticatorSelectionCriteria {
 	private final UserVerificationRequirement userVerification;
 
 	// NOTE: There is no requireResidentKey property because it is only for backward
-	// compatability with WebAuthn Level 1
+	// compatibility with WebAuthn Level 1
 
 	/**
 	 * Creates a new instance
@@ -79,7 +79,7 @@ public AuthenticatorAttachment getAuthenticatorAttachment() {
 	 * to create a <a href=
 	 * "https://www.w3.org/TR/webauthn-3/#client-side-discoverable-credential">client-side
 	 * discoverable credential</a>.
-	 * @return the residenty key requirement
+	 * @return the resident key requirement
 	 */
 	public ResidentKeyRequirement getResidentKey() {
 		return this.residentKey;

Original file line number	Diff line number	Diff line change
`@@ -57,12 +57,17 @@ public String resolve(final HttpServletRequest request) {`
`57`	`57`	`? resolveFromRequestParameters(request) : null;`
`58`	`58`	`if (authorizationHeaderToken != null) {`
`59`	`59`	`if (parameterToken != null) {`
`60`		`- final BearerTokenError error = BearerTokenErrors`
	`60`	`+ BearerTokenError error = BearerTokenErrors`
`61`	`61`	`.invalidRequest("Found multiple bearer tokens in the request");`
`62`	`62`	`throw new OAuth2AuthenticationException(error);`
`63`	`63`	`}`
`64`	`64`	`return authorizationHeaderToken;`
`65`	`65`	`}`
	`66`	`+ if (parameterToken != null && !StringUtils.hasText(parameterToken)) {`
	`67`	`+ BearerTokenError error = BearerTokenErrors`
	`68`	`+ .invalidRequest("The requested token parameter is an empty string");`
	`69`	`+ throw new OAuth2AuthenticationException(error);`
	`70`	`+ }`
`66`	`71`	`return parameterToken;`
`67`	`72`	`}`
`68`	`73`
Original file line number	Diff line number	Diff line change
`@@ -77,6 +77,11 @@ private String token(ServerHttpRequest request) {`
`77`	`77`	`}`
`78`	`78`	`return authorizationHeaderToken;`
`79`	`79`	`}`
	`80`	`+ if (parameterToken != null && !StringUtils.hasText(parameterToken)) {`
	`81`	`+ BearerTokenError error = BearerTokenErrors`
	`82`	`+ .invalidRequest("The requested token parameter is an empty string");`
	`83`	`+ throw new OAuth2AuthenticationException(error);`
	`84`	`+ }`
`80`	`85`	`return parameterToken;`
`81`	`86`	`}`
`82`	`87`