EndpointRequest should match @ServletEndpoint

This commit also changes the request matcher for MVC
endpoints to use an AntPathRequestMatcher instead of an
MvcRequestMatcher. The endpoint is always available
under the mapped endpoint path and this way the same matcher
can be used for both MVC and Jersey.

Fixes gh-17912

Co-authored-by: Phillip Webb <pwebb@pivotal.io>

spring-boot-samples/spring-boot-sample-secure-jersey/src/test/java/sample/secure/jersey/AbstractJerseySecureTests.java

@@ -0,0 +1,161 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.jersey;
+
+import org.junit.Test;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Abstract base class for actuator tests with custom security.
+ *
+ * @author Madhura Bhave
+ */
+public abstract class AbstractJerseySecureTests {
+
+	abstract String getPath();
+
+	abstract String getManagementPath();
+
+	@Autowired
+	private TestRestTemplate testRestTemplate;
+
+	@Test
+	public void helloEndpointIsSecure() {
+		ResponseEntity<String> entity = restTemplate().getForEntity(getPath() + "/hello", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Test
+	public void actuatorInsecureEndpoint() {
+		ResponseEntity<String> entity = restTemplate().getForEntity(getManagementPath() + "/actuator/health",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		assertThat(entity.getBody()).contains("\"status\":\"UP\"");
+		entity = restTemplate().getForEntity(getManagementPath() + "/actuator/health/diskSpace", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		assertThat(entity.getBody()).contains("\"status\":\"UP\"");
+	}
+
+	@Test
+	public void actuatorLinksWithAnonymous() {
+		ResponseEntity<String> entity = restTemplate().getForEntity(getManagementPath() + "/actuator", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+		entity = restTemplate().getForEntity(getManagementPath() + "/actuator/", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Test
+	public void actuatorLinksWithUnauthorizedUser() {
+		ResponseEntity<String> entity = userRestTemplate().getForEntity(getManagementPath() + "/actuator",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+		entity = userRestTemplate().getForEntity(getManagementPath() + "/actuator/", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+	}
+
+	@Test
+	public void actuatorLinksWithAuthorizedUser() {
+		ResponseEntity<String> entity = adminRestTemplate().getForEntity(getManagementPath() + "/actuator",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		adminRestTemplate().getForEntity(getManagementPath() + "/actuator/", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+	}
+
+	@Test
+	public void actuatorSecureEndpointWithAnonymous() {
+		ResponseEntity<String> entity = restTemplate().getForEntity(getManagementPath() + "/actuator/env",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+		entity = restTemplate().getForEntity(
+				getManagementPath() + "/actuator/env/management.endpoints.web.exposure.include", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Test
+	public void actuatorSecureEndpointWithUnauthorizedUser() {
+		ResponseEntity<String> entity = userRestTemplate().getForEntity(getManagementPath() + "/actuator/env",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+		entity = userRestTemplate().getForEntity(
+				getManagementPath() + "/actuator/env/management.endpoints.web.exposure.include", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+	}
+
+	@Test
+	public void actuatorSecureEndpointWithAuthorizedUser() {
+		ResponseEntity<String> entity = adminRestTemplate().getForEntity(getManagementPath() + "/actuator/env",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		entity = adminRestTemplate().getForEntity(
+				getManagementPath() + "/actuator/env/management.endpoints.web.exposure.include", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+	}
+
+	@Test
+	public void secureServletEndpointWithAnonymous() {
+		ResponseEntity<String> entity = restTemplate().getForEntity(getManagementPath() + "/actuator/jolokia",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+		entity = restTemplate().getForEntity(getManagementPath() + "/actuator/jolokia/list", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Test
+	public void secureServletEndpointWithUnauthorizedUser() {
+		ResponseEntity<String> entity = userRestTemplate().getForEntity(getManagementPath() + "/actuator/jolokia",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+		entity = userRestTemplate().getForEntity(getManagementPath() + "/actuator/jolokia/list", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+	}
+
+	@Test
+	public void secureServletEndpointWithAuthorizedUser() {
+		ResponseEntity<String> entity = adminRestTemplate().getForEntity(getManagementPath() + "/actuator/jolokia",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+		entity = adminRestTemplate().getForEntity(getManagementPath() + "/actuator/jolokia/list", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+	}
+
+	@Test
+	public void actuatorExcludedFromEndpointRequestMatcher() {
+		ResponseEntity<String> entity = userRestTemplate().getForEntity(getManagementPath() + "/actuator/mappings",
+				String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
+	}
+
+	TestRestTemplate restTemplate() {
+		return this.testRestTemplate;
+	}
+
+	TestRestTemplate adminRestTemplate() {
+		return this.testRestTemplate.withBasicAuth("admin", "admin");
+	}
+
+	TestRestTemplate userRestTemplate() {
+		return this.testRestTemplate.withBasicAuth("user", "password");
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-jersey/src/test/java/sample/secure/jersey/CustomApplicationPathActuatorTests.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.jersey;
+
+import org.junit.runner.RunWith;
+
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.web.server.LocalServerPort;
+import org.springframework.test.context.junit4.SpringRunner;
+
+/**
+ * Integration tests for actuator endpoints with custom application path.
+ *
+ * @author Madhura Bhave
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+		properties = "spring.jersey.application-path=/example")
+
+public class CustomApplicationPathActuatorTests extends AbstractJerseySecureTests {
+
+	@LocalServerPort
+	private int port;
+
+	@Override
+	String getPath() {
+		return "http://localhost:" + this.port + "/example";
+	}
+
+	@Override
+	String getManagementPath() {
+		return "http://localhost:" + this.port + "/example";
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-jersey/src/test/java/sample/secure/jersey/JerseySecureApplicationTests.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.jersey;
+
+import org.junit.runner.RunWith;
+
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.web.server.LocalServerPort;
+import org.springframework.test.context.junit4.SpringRunner;
+
+/**
+ * Integration tests for actuator endpoints with custom security configuration.
+ *
+ * @author Madhura Bhave
+ * @author Stephane Nicoll
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+public class JerseySecureApplicationTests extends AbstractJerseySecureTests {
+
+	@LocalServerPort
+	private int port;
+
+	@Override
+	String getPath() {
+		return "http://localhost:" + this.port;
+	}
+
+	@Override
+	String getManagementPath() {
+		return "http://localhost:" + this.port;
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-jersey/src/test/java/sample/secure/jersey/ManagementPortAndPathJerseyApplicationTests.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.jersey;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.boot.actuate.autoconfigure.web.server.LocalManagementPort;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.boot.web.server.LocalServerPort;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Integration tests for separate management and main service ports with custom management
+ * context path.
+ *
+ * @author Dave Syer
+ * @author Madhura Bhave
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT,
+		properties = { "management.server.port=0", "management.server.servlet.context-path=/management" })
+public class ManagementPortAndPathJerseyApplicationTests extends AbstractJerseySecureTests {
+
+	@LocalServerPort
+	private int port;
+
+	@LocalManagementPort
+	private int managementPort;
+
+	@Test
+	public void testMissing() {
+		ResponseEntity<String> entity = new TestRestTemplate("admin", "admin")
+				.getForEntity("http://localhost:" + this.managementPort + "/management/actuator/missing", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
+	}
+
+	@Override
+	String getPath() {
+		return "http://localhost:" + this.port;
+	}
+
+	@Override
+	String getManagementPath() {
+		return "http://localhost:" + this.managementPort + "/management";
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-jersey/src/test/java/sample/secure/jersey/ManagementPortCustomApplicationPathJerseyTests.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.secure.jersey;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.boot.actuate.autoconfigure.web.server.LocalManagementPort;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.boot.web.server.LocalServerPort;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Integration tests for separate management and main service ports with custom
+ * application path.
+ *
+ * @author Madhura Bhave
+ */
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+		properties = { "management.server.port=0", "spring.jersey.application-path=/example" })
+public class ManagementPortCustomApplicationPathJerseyTests extends AbstractJerseySecureTests {
+
+	@LocalServerPort
+	private int port;
+
+	@LocalManagementPort
+	private int managementPort;
+
+	@Test
+	public void actuatorPathOnMainPortShouldNotMatch() {
+		ResponseEntity<String> entity = new TestRestTemplate()
+				.getForEntity("http://localhost:" + this.port + "/example/actuator/health", String.class);
+		assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+	}
+
+	@Override
+	String getPath() {
+		return "http://localhost:" + this.port + "/example";
+	}
+
+	@Override
+	String getManagementPath() {
+		return "http://localhost:" + this.managementPort;
+	}
+
+}