Skip to content

Commit 106e9f5

Browse files
ngocnhan-tran1996philwebb
ngocnhan-tran1996
authored and
philwebb
committed
Migrate from AntPathRequestMatcher to PathPatternRequestMatcher
See gh-45163 Signed-off-by: Tran Ngoc Nhan <[email protected]>
1 parent bc9b331 commit 106e9f5

File tree

13 files changed

+48
-46
lines changed

13 files changed

+48
-46
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryActuatorAutoConfiguration.java

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262
import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
6363
import org.springframework.security.config.annotation.web.builders.WebSecurity;
6464
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
65+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
6566
import org.springframework.security.web.util.matcher.OrRequestMatcher;
6667
import org.springframework.security.web.util.matcher.RequestMatcher;
6768
import org.springframework.web.cors.CorsConfiguration;
@@ -183,15 +184,12 @@ static class IgnoredCloudFoundryPathsWebSecurityCustomizer implements WebSecurit
183184
}
184185

185186
@Override
186-
@SuppressWarnings("removal")
187187
public void customize(WebSecurity web) {
188188
List<RequestMatcher> requestMatchers = new ArrayList<>();
189189
this.pathMappedEndpoints.getAllPaths()
190-
.forEach((path) -> requestMatchers
191-
.add(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(path + "/**")));
192-
requestMatchers.add(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(BASE_PATH));
193-
requestMatchers
194-
.add(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(BASE_PATH + "/"));
190+
.forEach((path) -> requestMatchers.add(PathPatternRequestMatcher.withDefaults().matcher(path + "/**")));
191+
requestMatchers.add(PathPatternRequestMatcher.withDefaults().matcher(BASE_PATH));
192+
requestMatchers.add(PathPatternRequestMatcher.withDefaults().matcher(BASE_PATH + "/"));
195193
web.ignoring().requestMatchers(new OrRequestMatcher(requestMatchers));
196194
}
197195

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/AntPathRequestMatcherProvider.java

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@
1919
import java.util.function.Function;
2020

2121
import org.springframework.http.HttpMethod;
22-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
22+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
2323
import org.springframework.security.web.util.matcher.RequestMatcher;
2424

2525
/**
26-
* {@link RequestMatcherProvider} that provides an {@link AntPathRequestMatcher}.
26+
* {@link RequestMatcherProvider} that provides an {@link PathPatternRequestMatcher}.
2727
*
2828
* @author Madhura Bhave
2929
* @author Chris Bono
@@ -37,11 +37,9 @@ class AntPathRequestMatcherProvider implements RequestMatcherProvider {
3737
}
3838

3939
@Override
40-
@SuppressWarnings("removal")
4140
public RequestMatcher getRequestMatcher(String pattern, HttpMethod httpMethod) {
4241
String path = this.pathFactory.apply(pattern);
43-
return new org.springframework.security.web.util.matcher.AntPathRequestMatcher(path,
44-
(httpMethod != null) ? httpMethod.name() : null);
42+
return PathPatternRequestMatcher.withDefaults().matcher(httpMethod, path);
4543
}
4644

4745
}

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import org.springframework.core.annotation.MergedAnnotation;
4343
import org.springframework.core.annotation.MergedAnnotations;
4444
import org.springframework.http.HttpMethod;
45+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
4546
import org.springframework.security.web.util.matcher.OrRequestMatcher;
4647
import org.springframework.security.web.util.matcher.RequestMatcher;
4748
import org.springframework.util.Assert;
@@ -231,14 +232,12 @@ protected List<RequestMatcher> getLinksMatchers(RequestMatcherFactory requestMat
231232
return linksMatchers;
232233
}
233234

234-
@SuppressWarnings("removal")
235235
protected RequestMatcherProvider getRequestMatcherProvider(WebApplicationContext context) {
236236
try {
237237
return getRequestMatcherProviderBean(context);
238238
}
239239
catch (NoSuchBeanDefinitionException ex) {
240-
return (pattern, method) -> new org.springframework.security.web.util.matcher.AntPathRequestMatcher(
241-
pattern, (method != null) ? method.name() : null);
240+
return (pattern, method) -> PathPatternRequestMatcher.withDefaults().matcher(method, pattern);
242241
}
243242
}
244243

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryActuatorAutoConfigurationTests.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2024 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -182,8 +182,10 @@ void cloudFoundryPathsIgnoredBySpringSecurity() {
182182
testCloudFoundrySecurity(request, BASE_PATH + "/test", chain);
183183
testCloudFoundrySecurity(request, BASE_PATH + "/test/a", chain);
184184
request.setServletPath(BASE_PATH + "/other-path");
185+
request.setRequestURI(BASE_PATH + "/other-path");
185186
assertThat(chain.matches(request)).isFalse();
186187
request.setServletPath("/some-other-path");
188+
request.setRequestURI("/some-other-path");
187189
assertThat(chain.matches(request)).isFalse();
188190
});
189191
}
@@ -211,7 +213,7 @@ private FilterChainProxy getFilterChainProxy(Filter filter) {
211213

212214
private static void testCloudFoundrySecurity(MockHttpServletRequest request, String servletPath,
213215
SecurityFilterChain chain) {
214-
request.setServletPath(servletPath);
216+
request.setRequestURI(servletPath);
215217
assertThat(chain.matches(request)).isTrue();
216218
}
217219

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequestTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ private MockHttpServletRequest mockRequest(HttpMethod httpMethod, String servlet
430430
servletContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, this.context);
431431
MockHttpServletRequest request = new MockHttpServletRequest(servletContext);
432432
if (servletPath != null) {
433-
request.setServletPath(servletPath);
433+
request.setRequestURI(servletPath);
434434
}
435435
if (httpMethod != null) {
436436
request.setMethod(httpMethod.name());

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
5353
import org.springframework.security.web.FilterChainProxy;
5454
import org.springframework.security.web.SecurityFilterChain;
55-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
55+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
5656
import org.springframework.web.context.ConfigurableWebApplicationContext;
5757
import org.springframework.web.context.WebApplicationContext;
5858

@@ -206,7 +206,7 @@ private HttpStatus getResponseStatus(AssertableWebApplicationContext context, St
206206
MockHttpServletResponse response = new MockHttpServletResponse();
207207
servletContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, context);
208208
MockHttpServletRequest request = new MockHttpServletRequest(servletContext);
209-
request.setServletPath(path);
209+
request.setRequestURI(path);
210210
request.setMethod("GET");
211211
filterChainProxy.doFilter(request, response, new MockFilterChain());
212212
return HttpStatus.valueOf(response.getStatus());
@@ -216,10 +216,9 @@ private HttpStatus getResponseStatus(AssertableWebApplicationContext context, St
216216
static class CustomSecurityConfiguration {
217217

218218
@Bean
219-
@SuppressWarnings("removal")
220219
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
221220
http.authorizeHttpRequests((requests) -> {
222-
requests.requestMatchers(new AntPathRequestMatcher("/foo")).permitAll();
221+
requests.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/foo")).permitAll();
223222
requests.anyRequest().authenticated();
224223
});
225224
http.formLogin(withDefaults());
@@ -246,9 +245,8 @@ static class TestRemoteDevToolsSecurityFilterChainConfig extends TestSecurityFil
246245

247246
@Bean
248247
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
249-
@SuppressWarnings("removal")
250248
SecurityFilterChain testRemoteDevToolsSecurityFilterChain(HttpSecurity http) throws Exception {
251-
http.securityMatcher(new AntPathRequestMatcher("/**"));
249+
http.securityMatcher(PathPatternRequestMatcher.withDefaults().matcher("/**"));
252250
http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous());
253251
http.csrf((csrf) -> csrf.disable());
254252
return http.build();

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/SecurityRequestMatchersManagementContextConfigurationTests.java

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.springframework.context.annotation.Bean;
2828
import org.springframework.context.annotation.Configuration;
2929
import org.springframework.security.web.util.matcher.RequestMatcher;
30+
import org.springframework.web.util.pattern.PathPatternParser;
3031

3132
import static org.assertj.core.api.Assertions.assertThat;
3233

@@ -60,7 +61,8 @@ void registersRequestMatcherProviderIfMvcPresent() {
6061
this.contextRunner.withUserConfiguration(TestMvcConfiguration.class).run((context) -> {
6162
AntPathRequestMatcherProvider matcherProvider = context.getBean(AntPathRequestMatcherProvider.class);
6263
RequestMatcher requestMatcher = matcherProvider.getRequestMatcher("/example", null);
63-
assertThat(requestMatcher).extracting("pattern").isEqualTo("/custom/example");
64+
assertThat(requestMatcher).extracting("pattern")
65+
.isEqualTo(PathPatternParser.defaultInstance.parse("/custom/example"));
6466
});
6567
}
6668

@@ -71,7 +73,8 @@ void registersRequestMatcherForJerseyProviderIfJerseyPresentAndMvcAbsent() {
7173
.run((context) -> {
7274
AntPathRequestMatcherProvider matcherProvider = context.getBean(AntPathRequestMatcherProvider.class);
7375
RequestMatcher requestMatcher = matcherProvider.getRequestMatcher("/example", null);
74-
assertThat(requestMatcher).extracting("pattern").isEqualTo("/admin/example");
76+
assertThat(requestMatcher).extracting("pattern")
77+
.isEqualTo(PathPatternParser.defaultInstance.parse("/admin/example"));
7578
});
7679
}
7780

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/PathRequest.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2022 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
2424
import org.springframework.boot.autoconfigure.security.StaticResourceLocation;
2525
import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher;
2626
import org.springframework.boot.web.context.WebServerApplicationContext;
27+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
2728
import org.springframework.security.web.util.matcher.RequestMatcher;
2829
import org.springframework.web.context.WebApplicationContext;
2930

@@ -76,10 +77,9 @@ protected boolean ignoreApplicationContext(WebApplicationContext applicationCont
7677
}
7778

7879
@Override
79-
@SuppressWarnings("removal")
8080
protected void initialized(Supplier<H2ConsoleProperties> h2ConsoleProperties) {
81-
this.delegate = new org.springframework.security.web.util.matcher.AntPathRequestMatcher(
82-
h2ConsoleProperties.get().getPath() + "/**");
81+
this.delegate = PathPatternRequestMatcher.withDefaults()
82+
.matcher(h2ConsoleProperties.get().getPath() + "/**");
8383
}
8484

8585
@Override

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequest.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.springframework.boot.autoconfigure.web.servlet.DispatcherServletPath;
2929
import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher;
3030
import org.springframework.boot.web.context.WebServerApplicationContext;
31+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3132
import org.springframework.security.web.util.matcher.OrRequestMatcher;
3233
import org.springframework.security.web.util.matcher.RequestMatcher;
3334
import org.springframework.util.Assert;
@@ -134,10 +135,8 @@ protected void initialized(Supplier<DispatcherServletPath> dispatcherServletPath
134135
this.delegate = new OrRequestMatcher(getDelegateMatchers(dispatcherServletPath.get()).toList());
135136
}
136137

137-
@SuppressWarnings("removal")
138138
private Stream<RequestMatcher> getDelegateMatchers(DispatcherServletPath dispatcherServletPath) {
139-
return getPatterns(dispatcherServletPath)
140-
.map(org.springframework.security.web.util.matcher.AntPathRequestMatcher::new);
139+
return getPatterns(dispatcherServletPath).map(PathPatternRequestMatcher.withDefaults()::matcher);
141140
}
142141

143142
private Stream<String> getPatterns(DispatcherServletPath dispatcherServletPath) {

‎spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/PathRequestTests.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2022 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
import org.springframework.mock.web.MockHttpServletRequest;
2626
import org.springframework.mock.web.MockServletContext;
2727
import org.springframework.security.web.util.matcher.RequestMatcher;
28+
import org.springframework.util.StringUtils;
2829
import org.springframework.web.context.WebApplicationContext;
2930

3031
import static org.assertj.core.api.Assertions.assertThat;
@@ -99,14 +100,14 @@ private MockHttpServletRequest mockRequest(String path) {
99100
MockServletContext servletContext = new MockServletContext();
100101
servletContext.setAttribute(WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE, this.context);
101102
MockHttpServletRequest request = new MockHttpServletRequest(servletContext);
102-
request.setPathInfo(path);
103+
request.setRequestURI(path);
103104
return request;
104105
}
105106

106107
private String getRequestPath(HttpServletRequest request) {
107108
String url = request.getServletPath();
108-
if (request.getPathInfo() != null) {
109-
url += request.getPathInfo();
109+
if (StringUtils.hasText(request.getRequestURI())) {
110+
url += request.getRequestURI();
110111
}
111112
return url;
112113
}

‎spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequestTests.java

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import org.springframework.mock.web.MockHttpServletRequest;
2626
import org.springframework.mock.web.MockServletContext;
2727
import org.springframework.security.web.util.matcher.RequestMatcher;
28+
import org.springframework.util.StringUtils;
2829
import org.springframework.web.context.WebApplicationContext;
2930

3031
import static org.assertj.core.api.Assertions.assertThat;
@@ -156,15 +157,18 @@ private MockHttpServletRequest mockRequest(String servletPath, String path) {
156157
MockHttpServletRequest request = new MockHttpServletRequest(servletContext);
157158
if (servletPath != null) {
158159
request.setServletPath(servletPath);
160+
request.setRequestURI(servletPath + path);
161+
}
162+
else {
163+
request.setRequestURI(path);
159164
}
160-
request.setPathInfo(path);
161165
return request;
162166
}
163167

164168
private String getRequestPath(HttpServletRequest request) {
165169
String url = request.getServletPath();
166-
if (request.getPathInfo() != null) {
167-
url += request.getPathInfo();
170+
if (StringUtils.hasText(request.getRequestURI())) {
171+
url += request.getRequestURI();
168172
}
169173
return url;
170174
}

‎spring-boot-project/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2024 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2626
import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
2727
import org.springframework.security.web.SecurityFilterChain;
28+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
2829

2930
/**
3031
* Spring Security configuration that allows anonymous access to the remote devtools
@@ -45,10 +46,9 @@ class RemoteDevtoolsSecurityConfiguration {
4546
}
4647

4748
@Bean
48-
@SuppressWarnings("removal")
4949
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
5050
SecurityFilterChain devtoolsSecurityFilterChain(HttpSecurity http) throws Exception {
51-
http.securityMatcher(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(this.url));
51+
http.securityMatcher(PathPatternRequestMatcher.withDefaults().matcher(this.url));
5252
http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous());
5353
http.csrf(CsrfConfigurer::disable);
5454
return http.build();

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2023 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@
3131
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
3232
import org.springframework.security.web.SecurityFilterChain;
3333
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
34-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
34+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3535
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
3636

3737
import static org.springframework.security.config.Customizer.withDefaults;
@@ -68,9 +68,9 @@ SecurityFilterChain configure(HttpSecurity http, HandlerMappingIntrospector hand
6868
requests.requestMatchers(EndpointRequest.toAnyEndpoint().excluding(MappingsEndpoint.class))
6969
.hasRole("ACTUATOR");
7070
requests.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll();
71-
requests.requestMatchers(new AntPathRequestMatcher("/foo")).permitAll();
71+
requests.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/foo")).permitAll();
7272
requests.requestMatchers(new MvcRequestMatcher(handlerMappingIntrospector, "/error")).permitAll();
73-
requests.requestMatchers(new AntPathRequestMatcher("/**")).hasRole("USER");
73+
requests.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/**")).hasRole("USER");
7474
});
7575
http.cors(withDefaults());
7676
http.httpBasic(withDefaults());

0 commit comments

Comments
 (0)