Skip to content

Commit 5f68d2c

Browse files
JunhyunnyJunhyunny
committed
Revert "Merge branch 'spring-projects:main' into csrf-docs"
This reverts commit 938ffe8, reversing changes made to 6e3ffd9.
1 parent 938ffe8 commit 5f68d2c

File tree

86 files changed

+1216
-3446
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

86 files changed

+1216
-3446
lines changed

‎.github/workflows/mark-duplicate-dependabot-prs.yml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,18 @@
1-
name: Mark Duplicate Dependabot PRs
1+
name: Mark Duplicate PRs
22

33
on:
44
pull_request:
55
types: [closed]
66

77
jobs:
8+
debug:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Debug Event Payload
12+
run: |
13+
echo "Merged: ${{ github.event.pull_request.merged }}"
14+
echo "User Login: ${{ github.event.pull_request.user.login }}"
15+
816
check_duplicate_prs:
917
runs-on: ubuntu-latest
1018
if: github.event.pull_request.merged == true && github.event.pull_request.user.login == 'dependabot[bot]'
@@ -25,7 +33,7 @@ jobs:
2533
DEPENDENCY_NAME: ${{ steps.extract.outputs.dependency_name }}
2634
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2735
run: |
28-
PRS=$(gh pr list --search 'milestone:${{ github.event.pull_request.milestone.title }} is:merged in:title "$DEPENDENCY_NAME"' --json number --jq 'map(.number) | join(",")')
36+
PRS=$(gh pr list --search "milestone:${{ github.event.pull_request.milestone.title }} is:merged $DEPENDENCY_NAME" --json number --jq 'map(.number) | join(",")')
2937
echo "prs=$PRS" >> $GITHUB_OUTPUT
3038
3139
- name: Label Duplicate PRs

‎aspects/src/test/java/org/springframework/security/authorization/method/aspectj/PreAuthorizeAspectTests.java

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,6 @@ public class PreAuthorizeAspectTests {
4747

4848
private PrePostSecured prePostSecured = new PrePostSecured();
4949

50-
private MultipleInterfaces multiple = new MultipleInterfaces();
51-
5250
@BeforeEach
5351
public final void setUp() {
5452
MockitoAnnotations.initMocks(this);
@@ -112,12 +110,6 @@ public void nestedDenyAllPreAuthorizeDeniesAccess() {
112110
.isThrownBy(() -> this.secured.myObject().denyAllMethod());
113111
}
114112

115-
@Test
116-
public void multipleInterfacesPreAuthorizeAllows() {
117-
// aspectj doesn't inherit annotations
118-
this.multiple.securedMethod();
119-
}
120-
121113
interface SecuredInterface {
122114

123115
@PreAuthorize("hasRole('X')")
@@ -185,19 +177,4 @@ void denyAllMethod() {
185177

186178
}
187179

188-
interface AnotherSecuredInterface {
189-
190-
@PreAuthorize("hasRole('Y')")
191-
void securedMethod();
192-
193-
}
194-
195-
static class MultipleInterfaces implements SecuredInterface, AnotherSecuredInterface {
196-
197-
@Override
198-
public void securedMethod() {
199-
}
200-
201-
}
202-
203180
}

‎config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,7 @@ private boolean isDispatcherServlet(ServletRegistration registration) {
315315
}
316316
}
317317

318-
private static String computeErrorMessage(Collection<? extends ServletRegistration> registrations) {
318+
private String computeErrorMessage(Collection<? extends ServletRegistration> registrations) {
319319
String template = "This method cannot decide whether these patterns are Spring MVC patterns or not. "
320320
+ "If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); "
321321
+ "otherwise, please use requestMatchers(AntPathRequestMatcher).\n\n"
@@ -509,7 +509,7 @@ static class DispatcherServletRequestMatcher implements RequestMatcher {
509509
public boolean matches(HttpServletRequest request) {
510510
String name = request.getHttpServletMapping().getServletName();
511511
ServletRegistration registration = this.servletContext.getServletRegistration(name);
512-
Assert.notNull(registration, computeErrorMessage(this.servletContext.getServletRegistrations().values()));
512+
Assert.notNull(name, "Failed to find servlet [" + name + "] in the servlet context");
513513
try {
514514
Class<?> clazz = Class.forName(registration.getClassName());
515515
return DispatcherServlet.class.isAssignableFrom(clazz);
@@ -551,12 +551,18 @@ RequestMatcher requestMatcher(HttpServletRequest request) {
551551

552552
@Override
553553
public boolean matches(HttpServletRequest request) {
554-
return requestMatcher(request).matches(request);
554+
if (this.dispatcherServlet.matches(request)) {
555+
return this.mvc.matches(request);
556+
}
557+
return this.ant.matches(request);
555558
}
556559

557560
@Override
558561
public MatchResult matcher(HttpServletRequest request) {
559-
return requestMatcher(request).matcher(request);
562+
if (this.dispatcherServlet.matches(request)) {
563+
return this.mvc.matcher(request);
564+
}
565+
return this.ant.matcher(request);
560566
}
561567

562568
@Override

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java

Lines changed: 12 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,9 @@
1616

1717
package org.springframework.security.config.annotation.web.configurers.saml2;
1818

19-
import java.util.ArrayList;
2019
import java.util.LinkedHashMap;
21-
import java.util.List;
2220
import java.util.Map;
2321

24-
import jakarta.servlet.http.HttpServletRequest;
25-
2622
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
2723
import org.springframework.context.ApplicationContext;
2824
import org.springframework.security.authentication.AuthenticationManager;
@@ -37,7 +33,6 @@
3733
import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider;
3834
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
3935
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
40-
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrations;
4136
import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository;
4237
import org.springframework.security.saml2.provider.service.web.OpenSamlAuthenticationTokenConverter;
4338
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository;
@@ -55,7 +50,6 @@
5550
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
5651
import org.springframework.security.web.util.matcher.NegatedRequestMatcher;
5752
import org.springframework.security.web.util.matcher.OrRequestMatcher;
58-
import org.springframework.security.web.util.matcher.ParameterRequestMatcher;
5953
import org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher;
6054
import org.springframework.security.web.util.matcher.RequestMatcher;
6155
import org.springframework.security.web.util.matcher.RequestMatchers;
@@ -117,13 +111,7 @@ public final class Saml2LoginConfigurer<B extends HttpSecurityBuilder<B>>
117111

118112
private String loginPage;
119113

120-
private String authenticationRequestUri = "/saml2/authenticate";
121-
122-
private String[] authenticationRequestParams = { "registrationId={registrationId}" };
123-
124-
private RequestMatcher authenticationRequestMatcher = RequestMatchers.anyOf(
125-
new AntPathRequestMatcher(Saml2AuthenticationRequestResolver.DEFAULT_AUTHENTICATION_REQUEST_URI),
126-
new AntPathQueryRequestMatcher(this.authenticationRequestUri, this.authenticationRequestParams));
114+
private String authenticationRequestUri = Saml2AuthenticationRequestResolver.DEFAULT_AUTHENTICATION_REQUEST_URI;
127115

128116
private Saml2AuthenticationRequestResolver authenticationRequestResolver;
129117

@@ -208,31 +196,11 @@ public Saml2LoginConfigurer<B> authenticationRequestResolver(
208196
* Request
209197
* @return the {@link Saml2LoginConfigurer} for further configuration
210198
* @since 6.0
211-
* @deprecated Use {@link #authenticationRequestUriQuery} instead
212199
*/
213200
public Saml2LoginConfigurer<B> authenticationRequestUri(String authenticationRequestUri) {
214-
return authenticationRequestUriQuery(authenticationRequestUri);
215-
}
216-
217-
/**
218-
* Customize the URL that the SAML Authentication Request will be sent to. This method
219-
* also supports query parameters like so: <pre>
220-
* authenticationRequestUriQuery("/saml/authenticate?registrationId={registrationId}")
221-
* </pre> {@link RelyingPartyRegistrations}
222-
* @param authenticationRequestUriQuery the URI and query to use for the SAML 2.0
223-
* Authentication Request
224-
* @return the {@link Saml2LoginConfigurer} for further configuration
225-
* @since 6.0
226-
*/
227-
public Saml2LoginConfigurer<B> authenticationRequestUriQuery(String authenticationRequestUriQuery) {
228-
Assert.state(authenticationRequestUriQuery.contains("{registrationId}"),
229-
"authenticationRequestUri must contain {registrationId} path variable or query value");
230-
String[] parts = authenticationRequestUriQuery.split("[?&]");
231-
this.authenticationRequestUri = parts[0];
232-
this.authenticationRequestParams = new String[parts.length - 1];
233-
System.arraycopy(parts, 1, this.authenticationRequestParams, 0, parts.length - 1);
234-
this.authenticationRequestMatcher = new AntPathQueryRequestMatcher(this.authenticationRequestUri,
235-
this.authenticationRequestParams);
201+
Assert.state(authenticationRequestUri.contains("{registrationId}"),
202+
"authenticationRequestUri must contain {registrationId} path variable");
203+
this.authenticationRequestUri = authenticationRequestUri;
236204
return this;
237205
}
238206

@@ -287,7 +255,7 @@ public void init(B http) throws Exception {
287255
}
288256
else {
289257
Map<String, String> providerUrlMap = getIdentityProviderUrlMap(this.authenticationRequestUri,
290-
this.authenticationRequestParams, this.relyingPartyRegistrationRepository);
258+
this.relyingPartyRegistrationRepository);
291259
boolean singleProvider = providerUrlMap.size() == 1;
292260
if (singleProvider) {
293261
// Setup auto-redirect to provider login page
@@ -368,7 +336,8 @@ private Saml2AuthenticationRequestResolver getAuthenticationRequestResolver(B ht
368336
}
369337
OpenSaml4AuthenticationRequestResolver openSaml4AuthenticationRequestResolver = new OpenSaml4AuthenticationRequestResolver(
370338
relyingPartyRegistrationRepository(http));
371-
openSaml4AuthenticationRequestResolver.setRequestMatcher(this.authenticationRequestMatcher);
339+
openSaml4AuthenticationRequestResolver
340+
.setRequestMatcher(new AntPathRequestMatcher(this.authenticationRequestUri));
372341
return openSaml4AuthenticationRequestResolver;
373342
}
374343

@@ -413,28 +382,20 @@ private void initDefaultLoginFilter(B http) {
413382
return;
414383
}
415384
loginPageGeneratingFilter.setSaml2LoginEnabled(true);
416-
loginPageGeneratingFilter
417-
.setSaml2AuthenticationUrlToProviderName(this.getIdentityProviderUrlMap(this.authenticationRequestUri,
418-
this.authenticationRequestParams, this.relyingPartyRegistrationRepository));
385+
loginPageGeneratingFilter.setSaml2AuthenticationUrlToProviderName(
386+
this.getIdentityProviderUrlMap(this.authenticationRequestUri, this.relyingPartyRegistrationRepository));
419387
loginPageGeneratingFilter.setLoginPageUrl(this.getLoginPage());
420388
loginPageGeneratingFilter.setFailureUrl(this.getFailureUrl());
421389
}
422390

423391
@SuppressWarnings("unchecked")
424-
private Map<String, String> getIdentityProviderUrlMap(String authRequestPrefixUrl, String[] authRequestQueryParams,
392+
private Map<String, String> getIdentityProviderUrlMap(String authRequestPrefixUrl,
425393
RelyingPartyRegistrationRepository idpRepo) {
426394
Map<String, String> idps = new LinkedHashMap<>();
427395
if (idpRepo instanceof Iterable) {
428396
Iterable<RelyingPartyRegistration> repo = (Iterable<RelyingPartyRegistration>) idpRepo;
429-
StringBuilder authRequestQuery = new StringBuilder("?");
430-
for (String authRequestQueryParam : authRequestQueryParams) {
431-
authRequestQuery.append(authRequestQueryParam + "&");
432-
}
433-
authRequestQuery.deleteCharAt(authRequestQuery.length() - 1);
434-
String authenticationRequestUriQuery = authRequestPrefixUrl + authRequestQuery;
435-
repo.forEach(
436-
(p) -> idps.put(authenticationRequestUriQuery.replace("{registrationId}", p.getRegistrationId()),
437-
p.getRegistrationId()));
397+
repo.forEach((p) -> idps.put(authRequestPrefixUrl.replace("{registrationId}", p.getRegistrationId()),
398+
p.getRegistrationId()));
438399
}
439400
return idps;
440401
}
@@ -476,35 +437,4 @@ private <C> void setSharedObject(B http, Class<C> clazz, C object) {
476437
}
477438
}
478439

479-
static class AntPathQueryRequestMatcher implements RequestMatcher {
480-
481-
private final RequestMatcher matcher;
482-
483-
AntPathQueryRequestMatcher(String path, String... params) {
484-
List<RequestMatcher> matchers = new ArrayList<>();
485-
matchers.add(new AntPathRequestMatcher(path));
486-
for (String param : params) {
487-
String[] parts = param.split("=");
488-
if (parts.length == 1) {
489-
matchers.add(new ParameterRequestMatcher(parts[0]));
490-
}
491-
else {
492-
matchers.add(new ParameterRequestMatcher(parts[0], parts[1]));
493-
}
494-
}
495-
this.matcher = new AndRequestMatcher(matchers);
496-
}
497-
498-
@Override
499-
public boolean matches(HttpServletRequest request) {
500-
return matcher(request).isMatch();
501-
}
502-
503-
@Override
504-
public MatchResult matcher(HttpServletRequest request) {
505-
return this.matcher.matcher(request);
506-
}
507-
508-
}
509-
510440
}

‎config/src/main/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParser.java

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@
3939
import org.springframework.core.io.ResourceLoader;
4040
import org.springframework.security.converter.RsaKeyConverters;
4141
import org.springframework.security.saml2.core.Saml2X509Credential;
42-
import org.springframework.security.saml2.provider.service.registration.AssertingPartyMetadata;
4342
import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository;
4443
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
4544
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrations;
@@ -154,7 +153,7 @@ private static Map<String, Map<String, Object>> getAssertingParties(Element elem
154153
}
155154

156155
private static void addVerificationCredentials(Map<String, Object> assertingParty,
157-
AssertingPartyMetadata.Builder<?> builder) {
156+
RelyingPartyRegistration.AssertingPartyDetails.Builder builder) {
158157
List<String> verificationCertificateLocations = (List<String>) assertingParty.get(ELT_VERIFICATION_CREDENTIAL);
159158
List<Saml2X509Credential> verificationCredentials = new ArrayList<>();
160159
for (String certificateLocation : verificationCertificateLocations) {
@@ -164,7 +163,7 @@ private static void addVerificationCredentials(Map<String, Object> assertingPart
164163
}
165164

166165
private static void addEncryptionCredentials(Map<String, Object> assertingParty,
167-
AssertingPartyMetadata.Builder<?> builder) {
166+
RelyingPartyRegistration.AssertingPartyDetails.Builder builder) {
168167
List<String> encryptionCertificateLocations = (List<String>) assertingParty.get(ELT_ENCRYPTION_CREDENTIAL);
169168
List<Saml2X509Credential> encryptionCredentials = new ArrayList<>();
170169
for (String certificateLocation : encryptionCertificateLocations) {
@@ -221,8 +220,8 @@ private static RelyingPartyRegistration.Builder getBuilderFromMetadataLocationIf
221220
}
222221
else {
223222
builder = RelyingPartyRegistration.withRegistrationId(registrationId)
224-
.assertingPartyMetadata((apBuilder) -> buildAssertingParty(relyingPartyRegistrationElt,
225-
assertingParties, apBuilder, parserContext));
223+
.assertingPartyDetails((apBuilder) -> buildAssertingParty(relyingPartyRegistrationElt, assertingParties,
224+
apBuilder, parserContext));
226225
}
227226
addRemainingProperties(relyingPartyRegistrationElt, builder);
228227
return builder;
@@ -261,7 +260,7 @@ private static void addRemainingProperties(Element relyingPartyRegistrationElt,
261260
}
262261

263262
private static void buildAssertingParty(Element relyingPartyElt, Map<String, Map<String, Object>> assertingParties,
264-
AssertingPartyMetadata.Builder<?> builder, ParserContext parserContext) {
263+
RelyingPartyRegistration.AssertingPartyDetails.Builder builder, ParserContext parserContext) {
265264
String assertingPartyId = relyingPartyElt.getAttribute(ATT_ASSERTING_PARTY_ID);
266265
if (!assertingParties.containsKey(assertingPartyId)) {
267266
Object source = parserContext.extractSource(relyingPartyElt);
@@ -294,7 +293,7 @@ private static void buildAssertingParty(Element relyingPartyElt, Map<String, Map
294293
}
295294

296295
private static void addSigningAlgorithms(Map<String, Object> assertingParty,
297-
AssertingPartyMetadata.Builder<?> builder) {
296+
RelyingPartyRegistration.AssertingPartyDetails.Builder builder) {
298297
String signingAlgorithmsAttr = getAsString(assertingParty, ATT_SIGNING_ALGORITHMS);
299298
if (StringUtils.hasText(signingAlgorithmsAttr)) {
300299
List<String> signingAlgorithms = Arrays.asList(signingAlgorithmsAttr.split(","));

‎config/src/main/kotlin/org/springframework/security/config/annotation/web/Saml2Dsl.kt

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ import org.springframework.security.web.authentication.AuthenticationSuccessHand
4848
class Saml2Dsl {
4949
var relyingPartyRegistrationRepository: RelyingPartyRegistrationRepository? = null
5050
var loginPage: String? = null
51-
var authenticationRequestUriQuery: String? = null
5251
var authenticationSuccessHandler: AuthenticationSuccessHandler? = null
5352
var authenticationFailureHandler: AuthenticationFailureHandler? = null
5453
var failureUrl: String? = null
@@ -89,9 +88,6 @@ class Saml2Dsl {
8988
defaultSuccessUrlOption?.also {
9089
saml2Login.defaultSuccessUrl(defaultSuccessUrlOption!!.first, defaultSuccessUrlOption!!.second)
9190
}
92-
authenticationRequestUriQuery?.also {
93-
saml2Login.authenticationRequestUriQuery(authenticationRequestUriQuery)
94-
}
9591
authenticationSuccessHandler?.also { saml2Login.successHandler(authenticationSuccessHandler) }
9692
authenticationFailureHandler?.also { saml2Login.failureHandler(authenticationFailureHandler) }
9793
authenticationManager?.also { saml2Login.authenticationManager(authenticationManager) }

‎config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryTests.java

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -341,19 +341,6 @@ public void matchesWhenDispatcherServletThenMvc() {
341341
verifyNoMoreInteractions(mvc);
342342
}
343343

344-
@Test
345-
public void matchesWhenNoMappingThenException() {
346-
MockServletContext servletContext = new MockServletContext();
347-
servletContext.addServlet("default", DispatcherServlet.class).addMapping("/");
348-
servletContext.addServlet("path", Servlet.class).addMapping("/services/*");
349-
MvcRequestMatcher mvc = mock(MvcRequestMatcher.class);
350-
AntPathRequestMatcher ant = mock(AntPathRequestMatcher.class);
351-
DispatcherServletDelegatingRequestMatcher requestMatcher = new DispatcherServletDelegatingRequestMatcher(ant,
352-
mvc, servletContext);
353-
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/endpoint");
354-
assertThatExceptionOfType(IllegalArgumentException.class).isThrownBy(() -> requestMatcher.matcher(request));
355-
}
356-
357344
private void mockMvcIntrospector(boolean isPresent) {
358345
ApplicationContext context = this.matcherRegistry.getApplicationContext();
359346
given(context.containsBean("mvcHandlerMappingIntrospector")).willReturn(isPresent);

0 commit comments

Comments
 (0)