Skip to content

Commit 396abbe

Browse files
ngocnhan-tran1996ngocnhan-tran1996
committed
Migrate from AntPathRequestMatcher to PathPatternRequestMatcher
Signed-off-by: Tran Ngoc Nhan <[email protected]>
1 parent 06cc550 commit 396abbe

File tree

8 files changed

+25
-33
lines changed

8 files changed

+25
-33
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryActuatorAutoConfiguration.java

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262
import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
6363
import org.springframework.security.config.annotation.web.builders.WebSecurity;
6464
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
65+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
6566
import org.springframework.security.web.util.matcher.OrRequestMatcher;
6667
import org.springframework.security.web.util.matcher.RequestMatcher;
6768
import org.springframework.web.cors.CorsConfiguration;
@@ -183,15 +184,12 @@ static class IgnoredCloudFoundryPathsWebSecurityCustomizer implements WebSecurit
183184
}
184185

185186
@Override
186-
@SuppressWarnings("removal")
187187
public void customize(WebSecurity web) {
188188
List<RequestMatcher> requestMatchers = new ArrayList<>();
189189
this.pathMappedEndpoints.getAllPaths()
190-
.forEach((path) -> requestMatchers
191-
.add(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(path + "/**")));
192-
requestMatchers.add(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(BASE_PATH));
193-
requestMatchers
194-
.add(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(BASE_PATH + "/"));
190+
.forEach((path) -> requestMatchers.add(PathPatternRequestMatcher.withDefaults().matcher(path + "/**")));
191+
requestMatchers.add(PathPatternRequestMatcher.withDefaults().matcher(BASE_PATH));
192+
requestMatchers.add(PathPatternRequestMatcher.withDefaults().matcher(BASE_PATH + "/"));
195193
web.ignoring().requestMatchers(new OrRequestMatcher(requestMatchers));
196194
}
197195

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/AntPathRequestMatcherProvider.java

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@
1919
import java.util.function.Function;
2020

2121
import org.springframework.http.HttpMethod;
22-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
22+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
2323
import org.springframework.security.web.util.matcher.RequestMatcher;
2424

2525
/**
26-
* {@link RequestMatcherProvider} that provides an {@link AntPathRequestMatcher}.
26+
* {@link RequestMatcherProvider} that provides an {@link PathPatternRequestMatcher}.
2727
*
2828
* @author Madhura Bhave
2929
* @author Chris Bono
@@ -37,11 +37,9 @@ class AntPathRequestMatcherProvider implements RequestMatcherProvider {
3737
}
3838

3939
@Override
40-
@SuppressWarnings("removal")
4140
public RequestMatcher getRequestMatcher(String pattern, HttpMethod httpMethod) {
4241
String path = this.pathFactory.apply(pattern);
43-
return new org.springframework.security.web.util.matcher.AntPathRequestMatcher(path,
44-
(httpMethod != null) ? httpMethod.name() : null);
42+
return PathPatternRequestMatcher.withDefaults().matcher(httpMethod, path);
4543
}
4644

4745
}

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import org.springframework.core.annotation.MergedAnnotation;
4343
import org.springframework.core.annotation.MergedAnnotations;
4444
import org.springframework.http.HttpMethod;
45+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
4546
import org.springframework.security.web.util.matcher.OrRequestMatcher;
4647
import org.springframework.security.web.util.matcher.RequestMatcher;
4748
import org.springframework.util.Assert;
@@ -231,14 +232,12 @@ protected List<RequestMatcher> getLinksMatchers(RequestMatcherFactory requestMat
231232
return linksMatchers;
232233
}
233234

234-
@SuppressWarnings("removal")
235235
protected RequestMatcherProvider getRequestMatcherProvider(WebApplicationContext context) {
236236
try {
237237
return getRequestMatcherProviderBean(context);
238238
}
239239
catch (NoSuchBeanDefinitionException ex) {
240-
return (pattern, method) -> new org.springframework.security.web.util.matcher.AntPathRequestMatcher(
241-
pattern, (method != null) ? method.name() : null);
240+
return (pattern, method) -> PathPatternRequestMatcher.withDefaults().matcher(method, pattern);
242241
}
243242
}
244243

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
5353
import org.springframework.security.web.FilterChainProxy;
5454
import org.springframework.security.web.SecurityFilterChain;
55-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
55+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
5656
import org.springframework.web.context.ConfigurableWebApplicationContext;
5757
import org.springframework.web.context.WebApplicationContext;
5858

@@ -216,10 +216,9 @@ private HttpStatus getResponseStatus(AssertableWebApplicationContext context, St
216216
static class CustomSecurityConfiguration {
217217

218218
@Bean
219-
@SuppressWarnings("removal")
220219
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
221220
http.authorizeHttpRequests((requests) -> {
222-
requests.requestMatchers(new AntPathRequestMatcher("/foo")).permitAll();
221+
requests.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/foo")).permitAll();
223222
requests.anyRequest().authenticated();
224223
});
225224
http.formLogin(withDefaults());
@@ -246,9 +245,8 @@ static class TestRemoteDevToolsSecurityFilterChainConfig extends TestSecurityFil
246245

247246
@Bean
248247
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
249-
@SuppressWarnings("removal")
250248
SecurityFilterChain testRemoteDevToolsSecurityFilterChain(HttpSecurity http) throws Exception {
251-
http.securityMatcher(new AntPathRequestMatcher("/**"));
249+
http.securityMatcher(PathPatternRequestMatcher.withDefaults().matcher("/**"));
252250
http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous());
253251
http.csrf((csrf) -> csrf.disable());
254252
return http.build();

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/PathRequest.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2022 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
2424
import org.springframework.boot.autoconfigure.security.StaticResourceLocation;
2525
import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher;
2626
import org.springframework.boot.web.context.WebServerApplicationContext;
27+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
2728
import org.springframework.security.web.util.matcher.RequestMatcher;
2829
import org.springframework.web.context.WebApplicationContext;
2930

@@ -76,10 +77,9 @@ protected boolean ignoreApplicationContext(WebApplicationContext applicationCont
7677
}
7778

7879
@Override
79-
@SuppressWarnings("removal")
8080
protected void initialized(Supplier<H2ConsoleProperties> h2ConsoleProperties) {
81-
this.delegate = new org.springframework.security.web.util.matcher.AntPathRequestMatcher(
82-
h2ConsoleProperties.get().getPath() + "/**");
81+
this.delegate = PathPatternRequestMatcher.withDefaults()
82+
.matcher(h2ConsoleProperties.get().getPath() + "/**");
8383
}
8484

8585
@Override

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequest.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.springframework.boot.autoconfigure.web.servlet.DispatcherServletPath;
2929
import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher;
3030
import org.springframework.boot.web.context.WebServerApplicationContext;
31+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3132
import org.springframework.security.web.util.matcher.OrRequestMatcher;
3233
import org.springframework.security.web.util.matcher.RequestMatcher;
3334
import org.springframework.util.Assert;
@@ -134,10 +135,8 @@ protected void initialized(Supplier<DispatcherServletPath> dispatcherServletPath
134135
this.delegate = new OrRequestMatcher(getDelegateMatchers(dispatcherServletPath.get()).toList());
135136
}
136137

137-
@SuppressWarnings("removal")
138138
private Stream<RequestMatcher> getDelegateMatchers(DispatcherServletPath dispatcherServletPath) {
139-
return getPatterns(dispatcherServletPath)
140-
.map(org.springframework.security.web.util.matcher.AntPathRequestMatcher::new);
139+
return getPatterns(dispatcherServletPath).map(PathPatternRequestMatcher.withDefaults()::matcher);
141140
}
142141

143142
private Stream<String> getPatterns(DispatcherServletPath dispatcherServletPath) {

‎spring-boot-project/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2024 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2626
import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
2727
import org.springframework.security.web.SecurityFilterChain;
28+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
2829

2930
/**
3031
* Spring Security configuration that allows anonymous access to the remote devtools
@@ -45,10 +46,9 @@ class RemoteDevtoolsSecurityConfiguration {
4546
}
4647

4748
@Bean
48-
@SuppressWarnings("removal")
4949
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
5050
SecurityFilterChain devtoolsSecurityFilterChain(HttpSecurity http) throws Exception {
51-
http.securityMatcher(new org.springframework.security.web.util.matcher.AntPathRequestMatcher(this.url));
51+
http.securityMatcher(PathPatternRequestMatcher.withDefaults().matcher(this.url));
5252
http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous());
5353
http.csrf(CsrfConfigurer::disable);
5454
return http.build();

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2023 the original author or authors.
2+
* Copyright 2012-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@
3131
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
3232
import org.springframework.security.web.SecurityFilterChain;
3333
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
34-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
34+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
3535
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
3636

3737
import static org.springframework.security.config.Customizer.withDefaults;
@@ -68,9 +68,9 @@ SecurityFilterChain configure(HttpSecurity http, HandlerMappingIntrospector hand
6868
requests.requestMatchers(EndpointRequest.toAnyEndpoint().excluding(MappingsEndpoint.class))
6969
.hasRole("ACTUATOR");
7070
requests.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll();
71-
requests.requestMatchers(new AntPathRequestMatcher("/foo")).permitAll();
71+
requests.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/foo")).permitAll();
7272
requests.requestMatchers(new MvcRequestMatcher(handlerMappingIntrospector, "/error")).permitAll();
73-
requests.requestMatchers(new AntPathRequestMatcher("/**")).hasRole("USER");
73+
requests.requestMatchers(PathPatternRequestMatcher.withDefaults().matcher("/**")).hasRole("USER");
7474
});
7575
http.cors(withDefaults());
7676
http.httpBasic(withDefaults());

0 commit comments

Comments
 (0)