Skip to content

Commit ef50ff2

Browse files
jzheauxjzheaux
committed
Prgress
1 parent 75f30d1 commit ef50ff2

File tree

174 files changed

+713
-2967
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

174 files changed

+713
-2967
lines changed

‎cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@
5252
import org.springframework.security.web.savedrequest.RequestCache;
5353
import org.springframework.security.web.savedrequest.SavedRequest;
5454
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
55-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
5655
import org.springframework.security.web.util.matcher.RequestMatcher;
5756
import org.springframework.util.Assert;
5857
import org.springframework.util.StringUtils;
@@ -335,7 +334,7 @@ public final void setProxyReceptorMatcher(RequestMatcher proxyReceptorMatcher) {
335334
}
336335

337336
public final void setProxyReceptorUrl(final String proxyReceptorUrl) {
338-
this.proxyReceptorMatcher = new AntPathRequestMatcher("/**" + proxyReceptorUrl);
337+
this.proxyReceptorMatcher = PathPatternRequestMatcher.withDefaults().matcher(proxyReceptorUrl);
339338
}
340339

341340
public final void setProxyGrantingTicketStorage(final ProxyGrantingTicketStorage proxyGrantingTicketStorage) {

‎config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java

Lines changed: 14 additions & 329 deletions
Large diffs are not rendered by default.

‎config/src/main/java/org/springframework/security/config/annotation/web/RequestMatcherFactory.java

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
import org.springframework.context.ApplicationContext;
2020
import org.springframework.http.HttpMethod;
2121
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
22-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
2322
import org.springframework.security.web.util.matcher.RequestMatcher;
2423

2524
/**
@@ -34,22 +33,16 @@ public final class RequestMatcherFactory {
3433
private static PathPatternRequestMatcher.Builder builder;
3534

3635
public static void setApplicationContext(ApplicationContext context) {
37-
builder = context.getBeanProvider(PathPatternRequestMatcher.Builder.class).getIfUnique();
38-
}
39-
40-
public static boolean usesPathPatterns() {
41-
return builder != null;
36+
builder = context.getBeanProvider(PathPatternRequestMatcher.Builder.class)
37+
.getIfUnique(PathPatternRequestMatcher::withDefaults);
4238
}
4339

4440
public static RequestMatcher matcher(String path) {
4541
return matcher(null, path);
4642
}
4743

4844
public static RequestMatcher matcher(HttpMethod method, String path) {
49-
if (builder != null) {
50-
return builder.matcher(method, path);
51-
}
52-
return new AntPathRequestMatcher(path, (method != null) ? method.name() : null);
45+
return builder.matcher(method, path);
5346
}
5447

5548
private RequestMatcherFactory() {

‎config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

Lines changed: 10 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
import jakarta.servlet.ServletResponse;
2929
import jakarta.servlet.http.HttpServletRequest;
3030

31-
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
3231
import org.springframework.beans.factory.ObjectProvider;
3332
import org.springframework.context.ApplicationContext;
3433
import org.springframework.core.OrderComparator;
@@ -45,7 +44,6 @@
4544
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
4645
import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry;
4746
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
48-
import org.springframework.security.config.annotation.web.RequestMatcherFactory;
4947
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
5048
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
5149
import org.springframework.security.config.annotation.web.configurers.AnonymousConfigurer;
@@ -91,17 +89,14 @@
9189
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
9290
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
9391
import org.springframework.security.web.context.SecurityContextRepository;
94-
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
92+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
9593
import org.springframework.security.web.session.HttpSessionEventPublisher;
96-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
9794
import org.springframework.security.web.util.matcher.AnyRequestMatcher;
9895
import org.springframework.security.web.util.matcher.OrRequestMatcher;
9996
import org.springframework.security.web.util.matcher.RequestMatcher;
10097
import org.springframework.util.Assert;
101-
import org.springframework.util.ClassUtils;
10298
import org.springframework.web.cors.CorsConfiguration;
10399
import org.springframework.web.filter.CorsFilter;
104-
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
105100

106101
/**
107102
* A {@link HttpSecurity} is similar to Spring Security's XML <http> element in the
@@ -153,12 +148,6 @@
153148
public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain, HttpSecurity>
154149
implements SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity> {
155150

156-
private static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector";
157-
158-
private static final String HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector";
159-
160-
private static final boolean mvcPresent;
161-
162151
private final RequestMatcherConfigurer requestMatcherConfigurer;
163152

164153
private List<OrderedFilter> filters = new ArrayList<>();
@@ -169,10 +158,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
169158

170159
private AuthenticationManager authenticationManager;
171160

172-
static {
173-
mvcPresent = ClassUtils.isPresent(HANDLER_MAPPING_INTROSPECTOR, HttpSecurity.class.getClassLoader());
174-
}
175-
176161
/**
177162
* Creates a new instance
178163
* @param objectPostProcessor the {@link ObjectPostProcessor} that should be used
@@ -320,9 +305,7 @@ public HttpSecurity headers(Customizer<HeadersConfigurer<HttpSecurity>> headersC
320305
/**
321306
* Adds a {@link CorsFilter} to be used. If a bean by the name of corsFilter is
322307
* provided, that {@link CorsFilter} is used. Else if corsConfigurationSource is
323-
* defined, then that {@link CorsConfiguration} is used. Otherwise, if Spring MVC is
324-
* on the classpath a {@link HandlerMappingIntrospector} is used. You can enable CORS
325-
* using:
308+
* defined, then that {@link CorsConfiguration} is used. You can enable CORS using:
326309
*
327310
* <pre>
328311
* &#064;Configuration
@@ -2202,10 +2185,8 @@ public HttpSecurity securityMatcher(RequestMatcher requestMatcher) {
22022185

22032186
/**
22042187
* Allows configuring the {@link HttpSecurity} to only be invoked when matching the
2205-
* provided pattern. This method creates a {@link MvcRequestMatcher} if Spring MVC is
2206-
* in the classpath or creates an {@link AntPathRequestMatcher} if not. If more
2207-
* advanced configuration is necessary, consider using
2208-
* {@link #securityMatchers(Customizer)} or {@link #securityMatcher(RequestMatcher)}.
2188+
* provided set of {@code patterns}. See
2189+
* {@link org.springframework.web.util.pattern.PathPattern} for matching rules
22092190
*
22102191
* <p>
22112192
* Invoking {@link #securityMatcher(String...)} will override previous invocations of
@@ -2215,19 +2196,16 @@ public HttpSecurity securityMatcher(RequestMatcher requestMatcher) {
22152196
* </p>
22162197
* @param patterns the pattern to match on (i.e. "/admin/**")
22172198
* @return the {@link HttpSecurity} for further customizations
2218-
* @see AntPathRequestMatcher
2219-
* @see MvcRequestMatcher
2199+
* @see org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher
2200+
* @see org.springframework.web.util.pattern.PathPattern
22202201
*/
22212202
public HttpSecurity securityMatcher(String... patterns) {
22222203
List<RequestMatcher> matchers = new ArrayList<>();
2204+
PathPatternRequestMatcher.Builder builder = getContext()
2205+
.getBeanProvider(PathPatternRequestMatcher.Builder.class)
2206+
.getIfUnique(PathPatternRequestMatcher::withDefaults);
22232207
for (String pattern : patterns) {
2224-
if (RequestMatcherFactory.usesPathPatterns()) {
2225-
matchers.add(RequestMatcherFactory.matcher(pattern));
2226-
}
2227-
else {
2228-
RequestMatcher matcher = mvcPresent ? createMvcMatcher(pattern) : createAntMatcher(pattern);
2229-
matchers.add(matcher);
2230-
}
2208+
matchers.add(builder.matcher(pattern));
22312209
}
22322210
this.requestMatcher = new OrRequestMatcher(matchers);
22332211
return this;
@@ -2258,26 +2236,6 @@ public HttpSecurity webAuthn(Customizer<WebAuthnConfigurer<HttpSecurity>> webAut
22582236
return HttpSecurity.this;
22592237
}
22602238

2261-
private RequestMatcher createAntMatcher(String pattern) {
2262-
return new AntPathRequestMatcher(pattern);
2263-
}
2264-
2265-
private RequestMatcher createMvcMatcher(String mvcPattern) {
2266-
ResolvableType type = ResolvableType.forClassWithGenerics(ObjectPostProcessor.class, Object.class);
2267-
ObjectProvider<ObjectPostProcessor<Object>> postProcessors = getContext().getBeanProvider(type);
2268-
ObjectPostProcessor<Object> opp = postProcessors.getObject();
2269-
if (!getContext().containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {
2270-
throw new NoSuchBeanDefinitionException("A Bean named " + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME
2271-
+ " of type " + HandlerMappingIntrospector.class.getName()
2272-
+ " is required to use MvcRequestMatcher. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext.");
2273-
}
2274-
HandlerMappingIntrospector introspector = getContext().getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
2275-
HandlerMappingIntrospector.class);
2276-
MvcRequestMatcher matcher = new MvcRequestMatcher(introspector, mvcPattern);
2277-
opp.postProcess(matcher);
2278-
return matcher;
2279-
}
2280-
22812239
/**
22822240
* If the {@link SecurityConfigurer} has already been specified get the original,
22832241
* otherwise apply the new {@link SecurityConfigurerAdapter}.

‎config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@
5555
import org.springframework.security.web.access.AuthorizationManagerWebInvocationPrivilegeEvaluator;
5656
import org.springframework.security.web.access.AuthorizationManagerWebInvocationPrivilegeEvaluator.HttpServletRequestTransformer;
5757
import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator;
58+
import org.springframework.security.web.access.PathPatternRequestTransformer;
5859
import org.springframework.security.web.access.RequestMatcherDelegatingWebInvocationPrivilegeEvaluator;
5960
import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
6061
import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;
@@ -430,7 +431,7 @@ public void setApplicationContext(ApplicationContext applicationContext) throws
430431
this.filterChainDecoratorPostProcessor = postProcessor.getIfUnique(ObjectPostProcessor::identity);
431432
Class<HttpServletRequestTransformer> requestTransformerClass = HttpServletRequestTransformer.class;
432433
this.privilegeEvaluatorRequestTransformer = applicationContext.getBeanProvider(requestTransformerClass)
433-
.getIfUnique();
434+
.getIfUnique(PathPatternRequestTransformer::new);
434435
}
435436

436437
@Override

‎config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebMvcSecurityConfiguration.java

Lines changed: 0 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,7 @@
2626
import jakarta.servlet.ServletResponse;
2727
import jakarta.servlet.http.HttpServletRequest;
2828

29-
import org.springframework.beans.BeanMetadataElement;
3029
import org.springframework.beans.BeansException;
31-
import org.springframework.beans.factory.FactoryBean;
32-
import org.springframework.beans.factory.config.BeanDefinition;
33-
import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
34-
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
35-
import org.springframework.beans.factory.support.BeanDefinitionRegistry;
36-
import org.springframework.beans.factory.support.BeanDefinitionRegistryPostProcessor;
37-
import org.springframework.beans.factory.support.ManagedList;
3830
import org.springframework.context.ApplicationContext;
3931
import org.springframework.context.ApplicationContextAware;
4032
import org.springframework.context.annotation.Bean;
@@ -45,8 +37,6 @@
4537
import org.springframework.security.core.context.SecurityContextHolderStrategy;
4638
import org.springframework.security.web.FilterChainProxy;
4739
import org.springframework.security.web.SecurityFilterChain;
48-
import org.springframework.security.web.access.HandlerMappingIntrospectorRequestTransformer;
49-
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
5040
import org.springframework.security.web.debug.DebugFilter;
5141
import org.springframework.security.web.firewall.HttpFirewall;
5242
import org.springframework.security.web.firewall.RequestRejectedHandler;
@@ -58,7 +48,6 @@
5848
import org.springframework.web.method.support.HandlerMethodArgumentResolver;
5949
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
6050
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
61-
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
6251
import org.springframework.web.servlet.support.RequestDataValueProcessor;
6352

6453
/**
@@ -76,10 +65,6 @@
7665
*/
7766
class WebMvcSecurityConfiguration implements WebMvcConfigurer, ApplicationContextAware {
7867

79-
private static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector";
80-
81-
private static final String PATH_PATTERN_REQUEST_TRANSFORMER_BEAN_NAME = "pathPatternRequestTransformer";
82-
8368
private BeanResolver beanResolver;
8469

8570
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
@@ -121,86 +106,6 @@ public void setApplicationContext(ApplicationContext applicationContext) throws
121106
}
122107
}
123108

124-
@Bean
125-
static BeanDefinitionRegistryPostProcessor springSecurityHandlerMappingIntrospectorBeanDefinitionRegistryPostProcessor() {
126-
return new BeanDefinitionRegistryPostProcessor() {
127-
@Override
128-
public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {
129-
}
130-
131-
@Override
132-
public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {
133-
if (!registry.containsBeanDefinition(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {
134-
return;
135-
}
136-
137-
String hmiRequestTransformerBeanName = HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + "RequestTransformer";
138-
if (!registry.containsBeanDefinition(PATH_PATTERN_REQUEST_TRANSFORMER_BEAN_NAME)
139-
&& !registry.containsBeanDefinition(hmiRequestTransformerBeanName)) {
140-
if (!registry.containsBeanDefinition(hmiRequestTransformerBeanName)) {
141-
BeanDefinition hmiRequestTransformer = BeanDefinitionBuilder
142-
.rootBeanDefinition(HandlerMappingIntrospectorRequestTransformer.class)
143-
.addConstructorArgReference(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)
144-
.getBeanDefinition();
145-
registry.registerBeanDefinition(hmiRequestTransformerBeanName, hmiRequestTransformer);
146-
}
147-
}
148-
149-
BeanDefinition filterChainProxy = registry
150-
.getBeanDefinition(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME);
151-
152-
if (!filterChainProxy.getResolvableType().isInstance(CompositeFilterChainProxy.class)) {
153-
BeanDefinitionBuilder hmiCacheFilterBldr = BeanDefinitionBuilder
154-
.rootBeanDefinition(HandlerMappingIntrospectorCacheFilterFactoryBean.class)
155-
.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
156-
157-
ManagedList<BeanMetadataElement> filters = new ManagedList<>();
158-
filters.add(hmiCacheFilterBldr.getBeanDefinition());
159-
filters.add(filterChainProxy);
160-
BeanDefinitionBuilder compositeSpringSecurityFilterChainBldr = BeanDefinitionBuilder
161-
.rootBeanDefinition(CompositeFilterChainProxy.class)
162-
.addConstructorArgValue(filters);
163-
164-
registry.removeBeanDefinition(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME);
165-
registry.registerBeanDefinition(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME,
166-
compositeSpringSecurityFilterChainBldr.getBeanDefinition());
167-
}
168-
}
169-
};
170-
}
171-
172-
/**
173-
* {@link FactoryBean} to defer creation of
174-
* {@link HandlerMappingIntrospector#createCacheFilter()}
175-
*
176-
* @deprecated see {@link WebSecurityConfiguration} for
177-
* {@link org.springframework.web.util.pattern.PathPattern} replacement
178-
*/
179-
@Deprecated
180-
static class HandlerMappingIntrospectorCacheFilterFactoryBean
181-
implements ApplicationContextAware, FactoryBean<Filter> {
182-
183-
private ApplicationContext applicationContext;
184-
185-
@Override
186-
public void setApplicationContext(ApplicationContext applicationContext) {
187-
this.applicationContext = applicationContext;
188-
}
189-
190-
@Override
191-
public Filter getObject() throws Exception {
192-
HandlerMappingIntrospector handlerMappingIntrospector = this.applicationContext
193-
.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME, HandlerMappingIntrospector.class);
194-
return handlerMappingIntrospector.createCacheFilter();
195-
}
196-
197-
@Override
198-
public Class<?> getObjectType() {
199-
return Filter.class;
200-
}
201-
202-
}
203-
204109
/**
205110
* Extends {@link FilterChainProxy} to provide as much passivity as possible but
206111
* delegates to {@link CompositeFilter} for

‎config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@
6969
import org.springframework.security.web.firewall.RequestRejectedHandler;
7070
import org.springframework.web.filter.CompositeFilter;
7171
import org.springframework.web.filter.ServletRequestPathFilter;
72-
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
7372

7473
/**
7574
* Uses a {@link WebSecurity} to create the {@link FilterChainProxy} that performs the web
@@ -209,12 +208,11 @@ public void setImportMetadata(AnnotationMetadata importMetadata) {
209208
/**
210209
* Used to ensure Spring MVC request matching is cached.
211210
*
212-
* Creates a {@link BeanDefinitionRegistryPostProcessor} that detects if a bean named
213-
* HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME is defined. If so, it moves the
211+
* Creates a {@link BeanDefinitionRegistryPostProcessor} that moves the
214212
* AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME to another bean name
215213
* and then adds a {@link CompositeFilter} that contains
216-
* {@link HandlerMappingIntrospector#createCacheFilter()} and the original
217-
* FilterChainProxy under the original Bean name.
214+
* {@link ServletRequestPathFilter} and the original FilterChainProxy under the
215+
* original Bean name.
218216
* @return
219217
*/
220218
@Bean

0 commit comments

Comments
 (0)