Skip to content

Commit de07b11

Browse files
jzheauxjzheaux
committed
Use PathPatternRequestMatcher in Web Components
This commit changes filters and resolvers that were using AntPathRequestMatcher as their default to using PathPatternRequestMatcher. Issue gh-16632
1 parent 50ad378 commit de07b11

File tree

29 files changed

+133
-113
lines changed

29 files changed

+133
-113
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcLogoutAuthenticationConverter.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -20,13 +20,14 @@
2020
import org.apache.commons.logging.Log;
2121
import org.apache.commons.logging.LogFactory;
2222

23+
import org.springframework.http.HttpMethod;
2324
import org.springframework.security.core.Authentication;
2425
import org.springframework.security.oauth2.client.registration.ClientRegistration;
2526
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
2627
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
2728
import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
2829
import org.springframework.security.web.authentication.AuthenticationConverter;
29-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
30+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3031
import org.springframework.security.web.util.matcher.RequestMatcher;
3132
import org.springframework.util.Assert;
3233

@@ -45,7 +46,8 @@ final class OidcLogoutAuthenticationConverter implements AuthenticationConverter
4546

4647
private final ClientRegistrationRepository clientRegistrationRepository;
4748

48-
private RequestMatcher requestMatcher = new AntPathRequestMatcher(DEFAULT_LOGOUT_URI, "POST");
49+
private RequestMatcher requestMatcher = PathPatternRequestMatcher.withDefaults()
50+
.matcher(HttpMethod.POST, DEFAULT_LOGOUT_URI);
4951

5052
OidcLogoutAuthenticationConverter(ClientRegistrationRepository clientRegistrationRepository) {
5153
Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/DefaultOAuth2AuthorizationRequestResolver.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,9 @@
3636
import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
3737
import org.springframework.security.oauth2.core.oidc.OidcScopes;
3838
import org.springframework.security.oauth2.core.oidc.endpoint.OidcParameterNames;
39+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3940
import org.springframework.security.web.util.UrlUtils;
40-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
41+
import org.springframework.security.web.util.matcher.RequestMatcher;
4142
import org.springframework.util.Assert;
4243
import org.springframework.util.CollectionUtils;
4344
import org.springframework.util.StringUtils;
@@ -80,7 +81,7 @@ public final class DefaultOAuth2AuthorizationRequestResolver implements OAuth2Au
8081

8182
private final ClientRegistrationRepository clientRegistrationRepository;
8283

83-
private final AntPathRequestMatcher authorizationRequestMatcher;
84+
private final RequestMatcher authorizationRequestMatcher;
8485

8586
private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer = (customizer) -> {
8687
};
@@ -97,8 +98,8 @@ public DefaultOAuth2AuthorizationRequestResolver(ClientRegistrationRepository cl
9798
Assert.notNull(clientRegistrationRepository, "clientRegistrationRepository cannot be null");
9899
Assert.hasText(authorizationRequestBaseUri, "authorizationRequestBaseUri cannot be empty");
99100
this.clientRegistrationRepository = clientRegistrationRepository;
100-
this.authorizationRequestMatcher = new AntPathRequestMatcher(
101-
authorizationRequestBaseUri + "/{" + REGISTRATION_ID_URI_VARIABLE_NAME + "}");
101+
this.authorizationRequestMatcher = PathPatternRequestMatcher.withDefaults()
102+
.matcher(authorizationRequestBaseUri + "/{" + REGISTRATION_ID_URI_VARIABLE_NAME + "}");
102103
}
103104

104105
@Override

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/BaseOpenSamlAuthenticationTokenConverter.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@
3131
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
3232
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
3333
import org.springframework.security.web.authentication.AuthenticationConverter;
34-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
34+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3535
import org.springframework.security.web.util.matcher.OrRequestMatcher;
3636
import org.springframework.security.web.util.matcher.RequestMatcher;
3737
import org.springframework.util.Assert;
@@ -47,8 +47,8 @@ final class BaseOpenSamlAuthenticationTokenConverter implements AuthenticationCo
4747
private final RelyingPartyRegistrationRepository registrations;
4848

4949
private RequestMatcher requestMatcher = new OrRequestMatcher(
50-
new AntPathRequestMatcher("/login/saml2/sso/{registrationId}"),
51-
new AntPathRequestMatcher("/login/saml2/sso"));
50+
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso/{registrationId}"),
51+
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso"));
5252

5353
private Saml2AuthenticationRequestRepository<?> authenticationRequests = new HttpSessionSaml2AuthenticationRequestRepository();
5454

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/DefaultRelyingPartyRegistrationResolver.java‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,15 +16,18 @@
1616

1717
package org.springframework.security.saml2.provider.service.web;
1818

19+
import java.util.Map;
20+
1921
import jakarta.servlet.http.HttpServletRequest;
2022
import org.apache.commons.logging.Log;
2123
import org.apache.commons.logging.LogFactory;
2224

2325
import org.springframework.core.convert.converter.Converter;
26+
import org.springframework.http.server.PathContainer;
27+
import org.springframework.http.server.RequestPath;
2428
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
2529
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
2630
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
27-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
2831
import org.springframework.security.web.util.matcher.RequestMatcher;
2932
import org.springframework.util.Assert;
3033

@@ -43,7 +46,25 @@ public final class DefaultRelyingPartyRegistrationResolver
4346

4447
private final RelyingPartyRegistrationRepository relyingPartyRegistrationRepository;
4548

46-
private final RequestMatcher registrationRequestMatcher = new AntPathRequestMatcher("/**/{registrationId}");
49+
private final RequestMatcher registrationRequestMatcher = new RequestMatcher() {
50+
@Override
51+
public boolean matches(HttpServletRequest request) {
52+
return matcher(request).isMatch();
53+
}
54+
55+
@Override
56+
public MatchResult matcher(HttpServletRequest request) {
57+
RequestPath path = RequestPath.parse(request.getRequestURI(), request.getContextPath());
58+
PathContainer contextPath = path.contextPath();
59+
PathContainer relativePath = path.subPath(contextPath.elements().size());
60+
int size = relativePath.elements().size();
61+
if (size > 0) {
62+
return RequestMatcher.MatchResult
63+
.match(Map.of("registrationId", relativePath.elements().get(size - 1).value()));
64+
}
65+
return RequestMatcher.MatchResult.notMatch();
66+
}
67+
};
4768

4869
public DefaultRelyingPartyRegistrationResolver(
4970
RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) {

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2MetadataFilter.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -32,7 +32,7 @@
3232
import org.springframework.security.saml2.provider.service.metadata.Saml2MetadataResponseResolver;
3333
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
3434
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
35-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
35+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3636
import org.springframework.security.web.util.matcher.RequestMatcher;
3737
import org.springframework.util.Assert;
3838
import org.springframework.web.filter.OncePerRequestFilter;
@@ -146,8 +146,8 @@ private static final class Saml2MetadataResponseResolverAdapter implements Saml2
146146

147147
private final RelyingPartyRegistrationResolver registrations;
148148

149-
private RequestMatcher requestMatcher = new AntPathRequestMatcher(
150-
"/saml2/service-provider-metadata/{registrationId}");
149+
private RequestMatcher requestMatcher = PathPatternRequestMatcher.withDefaults()
150+
.matcher("/saml2/service-provider-metadata/{registrationId}");
151151

152152
private final Saml2MetadataResolver metadataResolver;
153153

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/BaseOpenSamlAuthenticationRequestResolver.java‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -50,8 +50,8 @@
5050
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers;
5151
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
5252
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
53+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
5354
import org.springframework.security.web.util.matcher.AndRequestMatcher;
54-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
5555
import org.springframework.security.web.util.matcher.ParameterRequestMatcher;
5656
import org.springframework.security.web.util.matcher.RequestMatcher;
5757
import org.springframework.security.web.util.matcher.RequestMatchers;
@@ -82,8 +82,9 @@ class BaseOpenSamlAuthenticationRequestResolver implements Saml2AuthenticationRe
8282
private final NameIDPolicyBuilder nameIdPolicyBuilder;
8383

8484
private RequestMatcher requestMatcher = RequestMatchers.anyOf(
85-
new AntPathRequestMatcher(Saml2AuthenticationRequestResolver.DEFAULT_AUTHENTICATION_REQUEST_URI),
86-
new AntPathQueryRequestMatcher("/saml2/authenticate", "registrationId={registrationId}"));
85+
PathPatternRequestMatcher.withDefaults()
86+
.matcher(Saml2AuthenticationRequestResolver.DEFAULT_AUTHENTICATION_REQUEST_URI),
87+
new PathPatternQueryRequestMatcher("/saml2/authenticate", "registrationId={registrationId}"));
8788

8889
private Clock clock = Clock.systemUTC();
8990

@@ -215,13 +216,13 @@ private String serialize(AuthnRequest authnRequest) {
215216
return this.saml.serialize(authnRequest).serialize();
216217
}
217218

218-
private static final class AntPathQueryRequestMatcher implements RequestMatcher {
219+
private static final class PathPatternQueryRequestMatcher implements RequestMatcher {
219220

220221
private final RequestMatcher matcher;
221222

222-
AntPathQueryRequestMatcher(String path, String... params) {
223+
PathPatternQueryRequestMatcher(String path, String... params) {
223224
List<RequestMatcher> matchers = new ArrayList<>();
224-
matchers.add(new AntPathRequestMatcher(path));
225+
matchers.add(PathPatternRequestMatcher.withDefaults().matcher(path));
225226
for (String param : params) {
226227
String[] parts = param.split("=");
227228
if (parts.length == 1) {

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2WebSsoAuthenticationFilter.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -35,7 +35,7 @@
3535
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
3636
import org.springframework.security.web.authentication.AuthenticationConverter;
3737
import org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy;
38-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
38+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3939
import org.springframework.security.web.util.matcher.OrRequestMatcher;
4040
import org.springframework.security.web.util.matcher.RequestMatcher;
4141
import org.springframework.util.Assert;
@@ -48,7 +48,8 @@ public class Saml2WebSsoAuthenticationFilter extends AbstractAuthenticationProce
4848
public static final String DEFAULT_FILTER_PROCESSES_URI = "/login/saml2/sso/{registrationId}";
4949

5050
private static final RequestMatcher DEFAULT_REQUEST_MATCHER = new OrRequestMatcher(
51-
new AntPathRequestMatcher(DEFAULT_FILTER_PROCESSES_URI), new AntPathRequestMatcher("/login/saml2/sso"));
51+
PathPatternRequestMatcher.withDefaults().matcher(DEFAULT_FILTER_PROCESSES_URI),
52+
PathPatternRequestMatcher.withDefaults().matcher("/login/saml2/sso"));
5253

5354
private final AuthenticationConverter authenticationConverter;
5455

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/BaseOpenSamlLogoutRequestValidatorParametersResolver.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -33,7 +33,7 @@
3333
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
3434
import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
3535
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers;
36-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
36+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3737
import org.springframework.security.web.util.matcher.OrRequestMatcher;
3838
import org.springframework.security.web.util.matcher.RequestMatcher;
3939
import org.springframework.util.Assert;
@@ -54,8 +54,8 @@ final class BaseOpenSamlLogoutRequestValidatorParametersResolver
5454
private final RelyingPartyRegistrationRepository registrations;
5555

5656
private RequestMatcher requestMatcher = new OrRequestMatcher(
57-
new AntPathRequestMatcher("/logout/saml2/slo/{registrationId}"),
58-
new AntPathRequestMatcher("/logout/saml2/slo"));
57+
PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo/{registrationId}"),
58+
PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo"));
5959

6060
/**
6161
* Constructs a {@link BaseOpenSamlLogoutRequestValidatorParametersResolver}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilter.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -49,7 +49,7 @@
4949
import org.springframework.security.web.RedirectStrategy;
5050
import org.springframework.security.web.authentication.logout.CompositeLogoutHandler;
5151
import org.springframework.security.web.authentication.logout.LogoutHandler;
52-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
52+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
5353
import org.springframework.security.web.util.matcher.RequestMatcher;
5454
import org.springframework.util.Assert;
5555
import org.springframework.util.StringUtils;
@@ -245,7 +245,8 @@ private static class Saml2AssertingPartyLogoutRequestResolver
245245

246246
private final RelyingPartyRegistrationResolver relyingPartyRegistrationResolver;
247247

248-
private RequestMatcher logoutRequestMatcher = new AntPathRequestMatcher("/logout/saml2/slo");
248+
private RequestMatcher logoutRequestMatcher = PathPatternRequestMatcher.withDefaults()
249+
.matcher("/logout/saml2/slo");
249250

250251
Saml2AssertingPartyLogoutRequestResolver(RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
251252
this.relyingPartyRegistrationResolver = relyingPartyRegistrationResolver;

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutResponseFilter.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -41,7 +41,7 @@
4141
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
4242
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
4343
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
44-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
44+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
4545
import org.springframework.security.web.util.matcher.RequestMatcher;
4646
import org.springframework.util.Assert;
4747
import org.springframework.web.filter.OncePerRequestFilter;
@@ -72,7 +72,7 @@ public final class Saml2LogoutResponseFilter extends OncePerRequestFilter {
7272

7373
private Saml2LogoutRequestRepository logoutRequestRepository = new HttpSessionLogoutRequestRepository();
7474

75-
private RequestMatcher logoutRequestMatcher = new AntPathRequestMatcher("/logout/saml2/slo");
75+
private RequestMatcher logoutRequestMatcher = PathPatternRequestMatcher.withDefaults().matcher("/logout/saml2/slo");
7676

7777
public Saml2LogoutResponseFilter(RelyingPartyRegistrationRepository registrations,
7878
Saml2LogoutResponseValidator logoutResponseValidator, LogoutSuccessHandler logoutSuccessHandler) {

0 commit comments

Comments
 (0)