Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add Spring MVC-generated path suffixes to endpoint paths

Browse Source 
Spring Security doesn't know that Spring MVC maps /foo, /foo.json
and /foo/ all to the same handler. This change explicitly adds
suffixes to the actuator endpoint matchers so they are properly
protected.
This commit is contained in:
Dave Syer
2014-04-03 14:03:09 +01:00
parent 97adb5c1b3
commit 72d7c286c0
2 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/ManagementSecurityAutoConfiguration.java
View File

@@ -221,7 +221,13 @@ public class ManagementSecurityAutoConfiguration {
List<String> paths = new ArrayList<String>(endpoints.size());
for (MvcEndpoint endpoint : endpoints) {
if (endpoint.isSensitive() == secure) {
paths.add(endpointHandlerMapping.getPrefix() + endpoint.getPath());
String path = endpointHandlerMapping.getPrefix() + endpoint.getPath();
paths.add(path);
if (secure) {
// Add Spring MVC-generated additional paths
paths.add(path + "/");
paths.add(path + ".*");
}
}
}
return paths.toArray(new String[paths.size()]);