Rework security request matchers
Update the security request matchers so that a bean is no longer needed
when the matcher is used. Matchers can now be build by starting from
the `EndpointRequest` or `StaticResourceRequest` classes. For example:
http.authorizeRequests()
.requestMatchers(EndpointRequest.to("status", "info")).permitAll()
.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
.requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()
Closes gh-7958
This commit is contained in:
Phillip Webb
@@ -0,0 +1,189 @@
|
||||
/*
|
||||
* Copyright 2012-2017 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.boot.autoconfigure.security;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.EnumSet;
|
||||
import java.util.LinkedHashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
import java.util.stream.Collectors;
|
||||
import java.util.stream.Stream;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
|
||||
import org.springframework.boot.autoconfigure.web.ServerProperties;
|
||||
import org.springframework.boot.security.ApplicationContextRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.util.Assert;
|
||||
|
||||
/**
|
||||
* Factory that can be used to create a {@link RequestMatcher} for static resources in
|
||||
* commonly used locations.
|
||||
*
|
||||
* @author Madhura Bhave
|
||||
* @author Phillip Webb
|
||||
* @since 2.0.0
|
||||
*/
|
||||
public final class StaticResourceRequest {
|
||||
|
||||
private StaticResourceRequest() {
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a matcher that includes all commonly used {@link Location Locations}. The
|
||||
* {@link StaticResourceRequestMatcher#excluding(Location, Location...) excluding} method
|
||||
* can be used to remove specific locations if required. For example:
|
||||
* <pre class="code">
|
||||
* StaticResourceRequest.toCommonLocations().excluding(Location.CSS)
|
||||
* </pre>
|
||||
* @return the configured {@link RequestMatcher}
|
||||
*/
|
||||
public static StaticResourceRequestMatcher toCommonLocations() {
|
||||
return to(EnumSet.allOf(Location.class));
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a matcher that includes the specified {@link Location Locations}. For
|
||||
* example: <pre class="code">
|
||||
* StaticResourceRequest.to(Location.CSS, Location.JAVA_SCRIPT)
|
||||
* </pre>
|
||||
* @param first the first location to include
|
||||
* @param rest additional locations to include
|
||||
* @return the configured {@link RequestMatcher}
|
||||
*/
|
||||
public static StaticResourceRequestMatcher to(Location first, Location... rest) {
|
||||
return to(EnumSet.of(first, rest));
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a matcher that includes the specified {@link Location Locations}. For
|
||||
* example: <pre class="code">
|
||||
* StaticResourceRequest.to(locations)
|
||||
* </pre>
|
||||
* @param locations the locations to include
|
||||
* @return the configured {@link RequestMatcher}
|
||||
*/
|
||||
public static StaticResourceRequestMatcher to(Set<Location> locations) {
|
||||
Assert.notNull(locations, "Locations must not be null");
|
||||
return new StaticResourceRequestMatcher(new LinkedHashSet<>(locations));
|
||||
}
|
||||
|
||||
public enum Location {
|
||||
|
||||
/**
|
||||
* Resources under {@code "/css"}.
|
||||
*/
|
||||
CSS("/css/**"),
|
||||
|
||||
/**
|
||||
* Resources under {@code "/js"}.
|
||||
*/
|
||||
JAVA_SCRIPT("/js/**"),
|
||||
|
||||
/**
|
||||
* Resources under {@code "/images"}.
|
||||
*/
|
||||
IMAGES("/images/**"),
|
||||
|
||||
/**
|
||||
* Resources under {@code "/webjars"}.
|
||||
*/
|
||||
WEB_JARS("/webjars/**"),
|
||||
|
||||
/**
|
||||
* The {@code "favicon.ico"} resource.
|
||||
*/
|
||||
FAVICON("/**/favicon.ico");
|
||||
|
||||
private String[] patterns;
|
||||
|
||||
Location(String... patterns) {
|
||||
this.patterns = patterns;
|
||||
}
|
||||
|
||||
Stream<String> getPatterns() {
|
||||
return Arrays.stream(this.patterns);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* The request matcher used to match against resource {@link Location Locations}.
|
||||
*/
|
||||
public final static class StaticResourceRequestMatcher
|
||||
extends ApplicationContextRequestMatcher<ServerProperties> {
|
||||
|
||||
private final Set<Location> locations;
|
||||
|
||||
private RequestMatcher delegate;
|
||||
|
||||
private StaticResourceRequestMatcher(Set<Location> locations) {
|
||||
super(ServerProperties.class);
|
||||
this.locations = locations;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a new {@link StaticResourceRequestMatcher} based on this one but excluding the
|
||||
* specified locations.
|
||||
* @param first the first location to exclude
|
||||
* @param rest additional locations to exclude
|
||||
* @return a new {@link StaticResourceRequestMatcher}
|
||||
*/
|
||||
public StaticResourceRequestMatcher excluding(Location first, Location... rest) {
|
||||
return excluding(EnumSet.of(first, rest));
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a new {@link StaticResourceRequestMatcher} based on this one but excluding the
|
||||
* specified locations.
|
||||
* @param locations the locations to exclude
|
||||
* @return a new {@link StaticResourceRequestMatcher}
|
||||
*/
|
||||
public StaticResourceRequestMatcher excluding(Set<Location> locations) {
|
||||
Assert.notNull(locations, "Locations must not be null");
|
||||
Set<Location> subset = new LinkedHashSet<>(this.locations);
|
||||
subset.removeAll(locations);
|
||||
return new StaticResourceRequestMatcher(subset);
|
||||
}
|
||||
|
||||
@Override
|
||||
protected void initialized(ServerProperties serverProperties) {
|
||||
this.delegate = new OrRequestMatcher(getDelegateMatchers(serverProperties));
|
||||
}
|
||||
|
||||
private List<RequestMatcher> getDelegateMatchers(
|
||||
ServerProperties serverProperties) {
|
||||
return getPatterns(serverProperties).map(AntPathRequestMatcher::new)
|
||||
.collect(Collectors.toList());
|
||||
}
|
||||
|
||||
private Stream<String> getPatterns(ServerProperties serverProperties) {
|
||||
return this.locations.stream().flatMap(Location::getPatterns)
|
||||
.map(serverProperties.getServlet()::getPath);
|
||||
}
|
||||
|
||||
@Override
|
||||
protected boolean matches(HttpServletRequest request, ServerProperties context) {
|
||||
return this.delegate.matches(request);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,175 @@
|
||||
/*
|
||||
* Copyright 2012-2017 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.boot.autoconfigure.security;
|
||||
|
||||
import java.util.Set;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
|
||||
import org.assertj.core.api.AssertDelegateTarget;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.rules.ExpectedException;
|
||||
|
||||
import org.springframework.boot.autoconfigure.security.StaticResourceRequest.Location;
|
||||
import org.springframework.boot.autoconfigure.web.ServerProperties;
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockServletContext;
|
||||
import org.springframework.security.web.util.matcher.RequestMatcher;
|
||||
import org.springframework.web.context.WebApplicationContext;
|
||||
import org.springframework.web.context.support.StaticWebApplicationContext;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
|
||||
/**
|
||||
* Tests for {@link StaticResourceRequest}.
|
||||
*
|
||||
* @author Madhura Bhave
|
||||
* @author Phillip Webb
|
||||
*/
|
||||
public class StaticResourceRequestTests {
|
||||
|
||||
@Rule
|
||||
public ExpectedException thrown = ExpectedException.none();
|
||||
|
||||
@Test
|
||||
public void toCommonLocationsShouldMatchCommonLocations() throws Exception {
|
||||
RequestMatcher matcher = StaticResourceRequest.toCommonLocations();
|
||||
assertMatcher(matcher).matches("/css/file.css");
|
||||
assertMatcher(matcher).matches("/js/file.js");
|
||||
assertMatcher(matcher).matches("/images/file.css");
|
||||
assertMatcher(matcher).matches("/webjars/file.css");
|
||||
assertMatcher(matcher).matches("/foo/favicon.ico");
|
||||
assertMatcher(matcher).doesNotMatch("/bar");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void toCommonLocationsWithExcludeShouldNotMatchExcluded() throws Exception {
|
||||
RequestMatcher matcher = StaticResourceRequest.toCommonLocations()
|
||||
.excluding(Location.CSS);
|
||||
assertMatcher(matcher).doesNotMatch("/css/file.css");
|
||||
assertMatcher(matcher).matches("/js/file.js");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void toLocationShouldMatchLocation() throws Exception {
|
||||
RequestMatcher matcher = StaticResourceRequest.to(Location.CSS);
|
||||
assertMatcher(matcher).matches("/css/file.css");
|
||||
assertMatcher(matcher).doesNotMatch("/js/file.js");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void toLocationWhenHasServletPathShouldMatchLocation() throws Exception {
|
||||
ServerProperties serverProperties = new ServerProperties();
|
||||
serverProperties.getServlet().setPath("/foo");
|
||||
RequestMatcher matcher = StaticResourceRequest.to(Location.CSS);
|
||||
assertMatcher(matcher, serverProperties).matches("/foo", "/css/file.css");
|
||||
assertMatcher(matcher, serverProperties).doesNotMatch("/foo", "/js/file.js");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void toLocationsFromSetWhenSetIsNullShouldThrowException() throws Exception {
|
||||
this.thrown.expect(IllegalArgumentException.class);
|
||||
this.thrown.expectMessage("Locations must not be null");
|
||||
StaticResourceRequest.to((Set<Location>) null);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void excludeFromSetWhenSetIsNullShouldThrowException() throws Exception {
|
||||
this.thrown.expect(IllegalArgumentException.class);
|
||||
this.thrown.expectMessage("Locations must not be null");
|
||||
StaticResourceRequest.toCommonLocations().excluding((Set<Location>) null);
|
||||
}
|
||||
|
||||
private RequestMatcherAssert assertMatcher(RequestMatcher matcher) {
|
||||
StaticWebApplicationContext context = new StaticWebApplicationContext();
|
||||
context.registerBean(ServerProperties.class);
|
||||
return assertThat(new RequestMatcherAssert(context, matcher));
|
||||
}
|
||||
|
||||
private RequestMatcherAssert assertMatcher(RequestMatcher matcher,
|
||||
ServerProperties serverProperties) {
|
||||
StaticWebApplicationContext context = new StaticWebApplicationContext();
|
||||
context.registerBean(ServerProperties.class, () -> serverProperties);
|
||||
return assertThat(new RequestMatcherAssert(context, matcher));
|
||||
}
|
||||
|
||||
private static class RequestMatcherAssert implements AssertDelegateTarget {
|
||||
|
||||
private final WebApplicationContext context;
|
||||
|
||||
private final RequestMatcher matcher;
|
||||
|
||||
RequestMatcherAssert(WebApplicationContext context, RequestMatcher matcher) {
|
||||
this.context = context;
|
||||
this.matcher = matcher;
|
||||
}
|
||||
|
||||
public void matches(String path) {
|
||||
matches(mockRequest(path));
|
||||
}
|
||||
|
||||
public void matches(String servletPath, String path) {
|
||||
matches(mockRequest(servletPath, path));
|
||||
}
|
||||
|
||||
private void matches(HttpServletRequest request) {
|
||||
assertThat(this.matcher.matches(request))
|
||||
.as("Matches " + getRequestPath(request)).isTrue();
|
||||
}
|
||||
|
||||
public void doesNotMatch(String path) {
|
||||
doesNotMatch(mockRequest(path));
|
||||
}
|
||||
|
||||
public void doesNotMatch(String servletPath, String path) {
|
||||
doesNotMatch(mockRequest(servletPath, path));
|
||||
}
|
||||
|
||||
private void doesNotMatch(HttpServletRequest request) {
|
||||
assertThat(this.matcher.matches(request))
|
||||
.as("Does not match " + getRequestPath(request)).isFalse();
|
||||
}
|
||||
|
||||
private MockHttpServletRequest mockRequest(String path) {
|
||||
return mockRequest(null, path);
|
||||
}
|
||||
|
||||
private MockHttpServletRequest mockRequest(String servletPath, String path) {
|
||||
MockServletContext servletContext = new MockServletContext();
|
||||
servletContext.setAttribute(
|
||||
WebApplicationContext.ROOT_WEB_APPLICATION_CONTEXT_ATTRIBUTE,
|
||||
this.context);
|
||||
MockHttpServletRequest request = new MockHttpServletRequest(servletContext);
|
||||
if (servletPath != null) {
|
||||
request.setServletPath(servletPath);
|
||||
}
|
||||
request.setPathInfo(path);
|
||||
return request;
|
||||
}
|
||||
|
||||
private String getRequestPath(HttpServletRequest request) {
|
||||
String url = request.getServletPath();
|
||||
if (request.getPathInfo() != null) {
|
||||
url += request.getPathInfo();
|
||||
}
|
||||
return url;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user