Commit 72d7c286 authored by Dave Syer's avatar Dave Syer

Add Spring MVC-generated path suffixes to endpoint paths

Spring Security doesn't know that Spring MVC maps /foo, /foo.json
and /foo/ all to the same handler. This change explicitly adds
suffixes to the actuator endpoint matchers so they are properly
protected.
parent 97adb5c1
...@@ -221,7 +221,13 @@ public class ManagementSecurityAutoConfiguration { ...@@ -221,7 +221,13 @@ public class ManagementSecurityAutoConfiguration {
List<String> paths = new ArrayList<String>(endpoints.size()); List<String> paths = new ArrayList<String>(endpoints.size());
for (MvcEndpoint endpoint : endpoints) { for (MvcEndpoint endpoint : endpoints) {
if (endpoint.isSensitive() == secure) { if (endpoint.isSensitive() == secure) {
paths.add(endpointHandlerMapping.getPrefix() + endpoint.getPath()); String path = endpointHandlerMapping.getPrefix() + endpoint.getPath();
paths.add(path);
if (secure) {
// Add Spring MVC-generated additional paths
paths.add(path + "/");
paths.add(path + ".*");
}
} }
} }
return paths.toArray(new String[paths.size()]); return paths.toArray(new String[paths.size()]);
......
...@@ -70,6 +70,23 @@ public class SampleActuatorApplicationTests { ...@@ -70,6 +70,23 @@ public class SampleActuatorApplicationTests {
.containsKey("Set-Cookie")); .containsKey("Set-Cookie"));
} }
@Test
public void testMetricsIsSecure() throws Exception {
@SuppressWarnings("rawtypes")
ResponseEntity<Map> entity = new TestRestTemplate().getForEntity(
"http://localhost:8080/metrics", Map.class);
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
entity = new TestRestTemplate().getForEntity(
"http://localhost:8080/metrics/", Map.class);
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
entity = new TestRestTemplate().getForEntity(
"http://localhost:8080/metrics/foo", Map.class);
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
entity = new TestRestTemplate().getForEntity(
"http://localhost:8080/metrics.json", Map.class);
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
}
@Test @Test
public void testHome() throws Exception { public void testHome() throws Exception {
@SuppressWarnings("rawtypes") @SuppressWarnings("rawtypes")
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment