Merge branch '5.6.x' into 5.7.x

web/src/main/java/org/springframework/security/web/access/intercept/AuthorizationFilter.java

@@ -19,8 +19,11 @@ package org.springframework.security.web.access.intercept;
 import java.io.IOException;
 import java.util.function.Supplier;
 
+import javax.servlet.DispatcherType;
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -35,7 +38,7 @@ import org.springframework.security.authorization.event.AuthorizationGrantedEven
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.util.Assert;
-import org.springframework.web.filter.OncePerRequestFilter;
+import org.springframework.web.filter.GenericFilterBean;
 
 /**
  * An authorization filter that restricts access to the URL using
@@ -44,13 +47,17 @@ import org.springframework.web.filter.OncePerRequestFilter;
  * @author Evgeniy Cheban
  * @since 5.5
  */
-public class AuthorizationFilter extends OncePerRequestFilter {
+public class AuthorizationFilter extends GenericFilterBean {
 
 	private final AuthorizationManager<HttpServletRequest> authorizationManager;
 
 	private AuthorizationEventPublisher eventPublisher = AuthorizationFilter::noPublish;
 
-	private boolean shouldFilterAllDispatcherTypes = false;
+	private boolean observeOncePerRequest = true;
+
+	private boolean filterErrorDispatch = false;
+
+	private boolean filterAsyncDispatch = false;
 
 	/**
 	 * Creates an instance.
@@ -62,15 +69,57 @@ public class AuthorizationFilter extends OncePerRequestFilter {
 	}
 
 	@Override
-	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+	public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain)
 			throws ServletException, IOException {
 
-		AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, request);
-		this.eventPublisher.publishAuthorizationEvent(this::getAuthentication, request, decision);
-		if (decision != null && !decision.isGranted()) {
-			throw new AccessDeniedException("Access Denied");
+		HttpServletRequest request = (HttpServletRequest) servletRequest;
+		HttpServletResponse response = (HttpServletResponse) servletResponse;
+
+		if (this.observeOncePerRequest && isApplied(request)) {
+			chain.doFilter(request, response);
+			return;
 		}
-		filterChain.doFilter(request, response);
+
+		if (skipDispatch(request)) {
+			chain.doFilter(request, response);
+			return;
+		}
+
+		String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();
+		request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
+		try {
+			AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, request);
+			this.eventPublisher.publishAuthorizationEvent(this::getAuthentication, request, decision);
+			if (decision != null && !decision.isGranted()) {
+				throw new AccessDeniedException("Access Denied");
+			}
+			chain.doFilter(request, response);
+		}
+		finally {
+			request.removeAttribute(alreadyFilteredAttributeName);
+		}
+	}
+
+	private boolean skipDispatch(HttpServletRequest request) {
+		if (DispatcherType.ERROR.equals(request.getDispatcherType()) && !this.filterErrorDispatch) {
+			return true;
+		}
+		if (DispatcherType.ASYNC.equals(request.getDispatcherType()) && !this.filterAsyncDispatch) {
+			return true;
+		}
+		return false;
+	}
+
+	private boolean isApplied(HttpServletRequest request) {
+		return request.getAttribute(getAlreadyFilteredAttributeName()) != null;
+	}
+
+	private String getAlreadyFilteredAttributeName() {
+		String name = getFilterName();
+		if (name == null) {
+			name = getClass().getName();
+		}
+		return name + ".APPLIED";
 	}
 
 	private Authentication getAuthentication() {
@@ -82,22 +131,6 @@ public class AuthorizationFilter extends OncePerRequestFilter {
 		return authentication;
 	}
 
-	@Override
-	protected void doFilterNestedErrorDispatch(HttpServletRequest request, HttpServletResponse response,
-			FilterChain filterChain) throws ServletException, IOException {
-		doFilterInternal(request, response, filterChain);
-	}
-
-	@Override
-	protected boolean shouldNotFilterAsyncDispatch() {
-		return !this.shouldFilterAllDispatcherTypes;
-	}
-
-	@Override
-	protected boolean shouldNotFilterErrorDispatch() {
-		return !this.shouldFilterAllDispatcherTypes;
-	}
-
 	/**
 	 * Use this {@link AuthorizationEventPublisher} to publish
 	 * {@link AuthorizationDeniedEvent}s and {@link AuthorizationGrantedEvent}s.
@@ -124,7 +157,9 @@ public class AuthorizationFilter extends OncePerRequestFilter {
 	 * @since 5.7
 	 */
 	public void setShouldFilterAllDispatcherTypes(boolean shouldFilterAllDispatcherTypes) {
-		this.shouldFilterAllDispatcherTypes = shouldFilterAllDispatcherTypes;
+		this.observeOncePerRequest = !shouldFilterAllDispatcherTypes;
+		this.filterErrorDispatch = shouldFilterAllDispatcherTypes;
+		this.filterAsyncDispatch = shouldFilterAllDispatcherTypes;
 	}
 
 	private static <T> void noPublish(Supplier<Authentication> authentication, T object,
@@ -132,4 +167,38 @@ public class AuthorizationFilter extends OncePerRequestFilter {
 
 	}
 
+	public boolean isObserveOncePerRequest() {
+		return this.observeOncePerRequest;
+	}
+
+	/**
+	 * Sets whether this filter apply only once per request. By default, this is
+	 * <code>true</code>, meaning the filter will only execute once per request. Sometimes
+	 * users may wish it to execute more than once per request, such as when JSP forwards
+	 * are being used and filter security is desired on each included fragment of the HTTP
+	 * request.
+	 * @param observeOncePerRequest whether the filter should only be applied once per
+	 * request
+	 */
+	public void setObserveOncePerRequest(boolean observeOncePerRequest) {
+		this.observeOncePerRequest = observeOncePerRequest;
+	}
+
+	/**
+	 * If set to true, the filter will be applied to error dispatcher. Defaults to false.
+	 * @param filterErrorDispatch whether the filter should be applied to error dispatcher
+	 */
+	public void setFilterErrorDispatch(boolean filterErrorDispatch) {
+		this.filterErrorDispatch = filterErrorDispatch;
+	}
+
+	/**
+	 * If set to true, the filter will be applied to the async dispatcher. Defaults to
+	 * false.
+	 * @param filterAsyncDispatch whether the filter should be applied to async dispatch
+	 */
+	public void setFilterAsyncDispatch(boolean filterAsyncDispatch) {
+		this.filterAsyncDispatch = filterAsyncDispatch;
+	}
+
 }