Refactor PathPatternMessageMatcher

Signed-off-by: Pat McCusker <[email protected]>

Author: pat-mccusker

config/src/test/java/org/springframework/security/config/annotation/web/socket/WebSocketMessageBrokerSecurityConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

messaging/src/main/java/org/springframework/security/messaging/access/intercept/MessageMatcherDelegatingAuthorizationManager.java

@@ -26,21 +26,23 @@
 import org.apache.commons.logging.LogFactory;
 
 import org.springframework.core.log.LogMessage;
+import org.springframework.http.server.PathContainer;
 import org.springframework.messaging.Message;
 import org.springframework.messaging.simp.SimpMessageType;
 import org.springframework.security.authorization.AuthenticatedAuthorizationManager;
 import org.springframework.security.authorization.AuthorityAuthorizationManager;
 import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.authorization.AuthorizationManager;
 import org.springframework.security.core.Authentication;
-import org.springframework.security.messaging.util.matcher.DestinationPathPatternMessageMatcher;
 import org.springframework.security.messaging.util.matcher.MessageMatcher;
+import org.springframework.security.messaging.util.matcher.PathPatternMessageMatcher;
 import org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher;
 import org.springframework.security.messaging.util.matcher.SimpMessageTypeMatcher;
 import org.springframework.util.AntPathMatcher;
 import org.springframework.util.Assert;
 import org.springframework.util.PathMatcher;
 import org.springframework.util.function.SingletonSupplier;
+import org.springframework.web.util.pattern.PathPatternParser;
 
 public final class MessageMatcherDelegatingAuthorizationManager implements AuthorizationManager<Message<?>> {
 
@@ -136,7 +138,7 @@ public Builder.Constraint anyMessage() {
 		 * @return the Expression to associate
 		 */
 		public Builder.Constraint nullDestMatcher() {
-			return matchers(DestinationPathPatternMessageMatcher.NULL_DESTINATION_MATCHER);
+			return matchers(PathPatternMessageMatcher.NULL_DESTINATION_MATCHER);
 		}
 
 		/**
@@ -172,9 +174,9 @@ public Builder.Constraint simpDestMatchers(String... patterns) {
 		 * destinations match the provided {@code patterns}.
 		 * <p>
 		 * The matching of each pattern is performed by a
-		 * {@link DestinationPathPatternMessageMatcher} instance that matches
-		 * irrespectively of {@link SimpMessageType}. If no destination is found on the
-		 * {@code Message}, then each {@code Matcher} returns false.
+		 * {@link PathPatternMessageMatcher} instance that matches irrespectively of
+		 * {@link SimpMessageType}. If no destination is found on the {@code Message},
+		 * then each {@code Matcher} returns false.
 		 * </p>
 		 * @param patterns the destination path patterns to which the security
 		 * {@code Constraint} will be applicable
@@ -204,10 +206,9 @@ public Builder.Constraint simpMessageDestMatchers(String... patterns) {
 		 * {@code patterns}.
 		 * <p>
 		 * The matching of each pattern is performed by a
-		 * {@link DestinationPathPatternMessageMatcher}. If no destination is found on the
+		 * {@link PathPatternMessageMatcher}. If no destination is found on the
 		 * {@code Message}, then each {@code Matcher} returns false.
-		 * @param patterns the patterns to create
-		 * {@link DestinationPathPatternMessageMatcher} from.
+		 * @param patterns the patterns to create {@link PathPatternMessageMatcher} from.
 		 * @since 6.5
 		 */
 		public Builder.Constraint simpTypeMessageDestinationPatterns(String... patterns) {
@@ -234,10 +235,9 @@ public Builder.Constraint simpSubscribeDestMatchers(String... patterns) {
 		 * provided {@code patterns}.
 		 * <p>
 		 * The matching of each pattern is performed by a
-		 * {@link DestinationPathPatternMessageMatcher}. If no destination is found on the
+		 * {@link PathPatternMessageMatcher}. If no destination is found on the
 		 * {@code Message}, then each {@code Matcher} returns false.
-		 * @param patterns the patterns to create
-		 * {@link DestinationPathPatternMessageMatcher} from.
+		 * @param patterns the patterns to create {@link PathPatternMessageMatcher} from.
 		 * @since 6.5
 		 */
 		public Builder.Constraint simpTypeSubscribeDestinationPatterns(String... patterns) {
@@ -272,13 +272,12 @@ private Builder.Constraint simpDestMatchers(SimpMessageType type, String... patt
 		 * {@code patterns}.
 		 * <p>
 		 * The matching of each pattern is performed by a
-		 * {@link DestinationPathPatternMessageMatcher}. If no destination is found on the
+		 * {@link PathPatternMessageMatcher}. If no destination is found on the
 		 * {@code Message}, then each {@code Matcher} returns false.
 		 * </p>
 		 * @param type the {@link SimpMessageType} to match on. If null, the
 		 * {@link SimpMessageType} is not considered for matching.
-		 * @param patterns the patterns to create
-		 * {@link DestinationPathPatternMessageMatcher} from.
+		 * @param patterns the patterns to create {@link PathPatternMessageMatcher} from.
 		 * @return the {@link Builder.Constraint} that is associated to the
 		 * {@link MessageMatcher}s
 		 * @since 6.5
@@ -515,19 +514,21 @@ Map<String, String> extractPathVariables(Message<?> message) {
 
 		private static final class LazySimpDestinationPatternMessageMatcher implements MessageMatcher<Object> {
 
-			private final Supplier<DestinationPathPatternMessageMatcher> delegate;
+			private final Supplier<PathPatternMessageMatcher> delegate;
 
 			private LazySimpDestinationPatternMessageMatcher(String pattern, SimpMessageType type,
 					boolean useHttpPathSeparator) {
 				this.delegate = SingletonSupplier.of(() -> {
-					DestinationPathPatternMessageMatcher.Builder builder = (useHttpPathSeparator)
-							? DestinationPathPatternMessageMatcher.withDefaults()
-							: DestinationPathPatternMessageMatcher.messageRoute();
+					PathPatternParser dotSeparatedPathParser = new PathPatternParser();
+					dotSeparatedPathParser.setPathOptions(PathContainer.Options.MESSAGE_ROUTE);
+					PathPatternMessageMatcher.Builder builder = (useHttpPathSeparator)
+							? PathPatternMessageMatcher.withDefaults()
+							: PathPatternMessageMatcher.withPathPatternParser(dotSeparatedPathParser);
 					if (type == null) {
 						return builder.matcher(pattern);
 					}
 					if (SimpMessageType.MESSAGE == type || SimpMessageType.SUBSCRIBE == type) {
-						return builder.messageType(type).matcher(pattern);
+						return builder.matcher(pattern, type);
 					}
 					throw new IllegalStateException(type + " is not supported since it does not have a destination");
 				});
@@ -539,7 +540,8 @@ public boolean matches(Message<?> message) {
 			}
 
 			Map<String, String> extractPathVariables(Message<?> message) {
-				return this.delegate.get().extractPathVariables(message);
+				MatchResult matchResult = this.delegate.get().matcher(message);
+				return matchResult.getVariables();
 			}
 
 		}

messaging/src/main/java/org/springframework/security/messaging/util/matcher/MessageMatcher.java

@@ -16,6 +16,9 @@
 
 package org.springframework.security.messaging.util.matcher;
 
+import java.util.Collections;
+import java.util.Map;
+
 import org.springframework.messaging.Message;
 
 /**
@@ -50,4 +53,80 @@ public String toString() {
 	 */
 	boolean matches(Message<? extends T> message);
 
+	/**
+	 * Returns a {@link MatchResult} for this {@code MessageMatcher}. The default
+	 * implementation returns {@link Collections#emptyMap()} when
+	 * {@link MatchResult#getVariables()} is invoked.
+	 * @return the {@code MatchResult} from comparing this {@code MessageMatcher} against
+	 * the {@code Message}
+	 * @since 6.5
+	 */
+	default MatchResult matcher(Message<? extends T> message) {
+		boolean match = matches(message);
+		return new MatchResult(match, Collections.emptyMap());
+	}
+
+	/**
+	 * The result of matching against a {@code Message} contains the status, true or
+	 * false, of the match and if present, any variables extracted from the match
+	 *
+	 * @since 6.5
+	 */
+	class MatchResult {
+
+		private final boolean match;
+
+		private final Map<String, String> variables;
+
+		MatchResult(boolean match, Map<String, String> variables) {
+			this.match = match;
+			this.variables = variables;
+		}
+
+		/**
+		 * @return true if the comparison against the {@code Message} produced a
+		 * successful match
+		 */
+		public boolean isMatch() {
+			return this.match;
+		}
+
+		/**
+		 * Returns the extracted variable values where the key is the variable name and
+		 * the value is the variable value
+		 * @return a map containing key-value pairs representing extracted variable names
+		 * and variable values
+		 */
+		public Map<String, String> getVariables() {
+			return this.variables;
+		}
+
+		/**
+		 * Creates an instance of {@link MatchResult} that is a match with no variables
+		 * @return
+		 */
+		public static MatchResult match() {
+			return new MatchResult(true, Collections.emptyMap());
+		}
+
+		/**
+		 * Creates an instance of {@link MatchResult} that is a match with the specified
+		 * variables
+		 * @param variables
+		 * @return
+		 */
+		public static MatchResult match(Map<String, String> variables) {
+			return new MatchResult(true, variables);
+		}
+
+		/**
+		 * Creates an instance of {@link MatchResult} that is not a match.
+		 * @return a {@code MatchResult} with match set to false
+		 */
+		public static MatchResult notMatch() {
+			return new MatchResult(false, Collections.emptyMap());
+		}
+
+	}
+
 }