Skip to content

Commit 146d326

Browse files
marcusdacoregiomarcusdacoregio
committed
Merge branch '5.8.x'
Closes gh-11971
2 parents 06c879b + f3321c2 commit 146d326

File tree

8 files changed

+124
-1
lines changed

8 files changed

+124
-1
lines changed

Diff for: ‎config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java

+7-1
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
5959

6060
private static final String ATT_SERVLET_PATH = "servlet-path";
6161

62+
private static final String ATT_FILTER_ALL_DISPATCHER_TYPES = "filter-all-dispatcher-types";
63+
6264
private String authorizationManagerRef;
6365

6466
private final BeanMetadataElement securityContextHolderStrategy;
@@ -82,7 +84,11 @@ public BeanDefinition parse(Element element, ParserContext parserContext) {
8284
this.authorizationManagerRef = createAuthorizationManager(element, parserContext);
8385
BeanDefinitionBuilder filterBuilder = BeanDefinitionBuilder.rootBeanDefinition(AuthorizationFilter.class);
8486
filterBuilder.getRawBeanDefinition().setSource(parserContext.extractSource(element));
85-
BeanDefinition filter = filterBuilder.addConstructorArgReference(this.authorizationManagerRef)
87+
filterBuilder.addConstructorArgReference(this.authorizationManagerRef);
88+
if ("true".equals(element.getAttribute(ATT_FILTER_ALL_DISPATCHER_TYPES))) {
89+
filterBuilder.addPropertyValue("shouldFilterAllDispatcherTypes", Boolean.TRUE);
90+
}
91+
BeanDefinition filter = filterBuilder
8692
.addPropertyValue("securityContextHolderStrategy", this.securityContextHolderStrategy)
8793
.getBeanDefinition();
8894
String id = element.getAttribute(AbstractBeanDefinitionParser.ID_ATTRIBUTE);

Diff for: ‎config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc

+3
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,9 @@ http.attlist &=
385385
http.attlist &=
386386
## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "true"
387387
attribute once-per-request {xsd:boolean}?
388+
http.attlist &=
389+
## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Only works when use-authorization-manager=true. Defauls to "false".
390+
attribute filter-all-dispatcher-types {xsd:boolean}?
388391
http.attlist &=
389392
## Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true" (rewriting is disabled).
390393
attribute disable-url-rewriting {xsd:boolean}?

Diff for: ‎config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd

+7
Original file line numberDiff line numberDiff line change
@@ -1385,6 +1385,13 @@
13851385
</xs:documentation>
13861386
</xs:annotation>
13871387
</xs:attribute>
1388+
<xs:attribute name="filter-all-dispatcher-types" type="xs:boolean">
1389+
<xs:annotation>
1390+
<xs:documentation>Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Only
1391+
works when use-authorization-manager=true. Defauls to "false".
1392+
</xs:documentation>
1393+
</xs:annotation>
1394+
</xs:attribute>
13881395
<xs:attribute name="disable-url-rewriting" type="xs:boolean">
13891396
<xs:annotation>
13901397
<xs:documentation>Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true"

Diff for: ‎config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc

+3
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,9 @@ http.attlist &=
385385
http.attlist &=
386386
## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "false"
387387
attribute once-per-request {xsd:boolean}?
388+
http.attlist &=
389+
## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not work when use-authorization-manager=false. Defaults to "false".
390+
attribute filter-all-dispatcher-types {xsd:boolean}?
388391
http.attlist &=
389392
## Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true" (rewriting is disabled).
390393
attribute disable-url-rewriting {xsd:boolean}?

Diff for: ‎config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd

+7
Original file line numberDiff line numberDiff line change
@@ -1363,6 +1363,13 @@
13631363
</xs:documentation>
13641364
</xs:annotation>
13651365
</xs:attribute>
1366+
<xs:attribute name="filter-all-dispatcher-types" type="xs:boolean">
1367+
<xs:annotation>
1368+
<xs:documentation>Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not
1369+
work when use-authorization-manager=false. Defaults to "false".
1370+
</xs:documentation>
1371+
</xs:annotation>
1372+
</xs:attribute>
13661373
<xs:attribute name="disable-url-rewriting" type="xs:boolean">
13671374
<xs:annotation>
13681375
<xs:documentation>Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true"

Diff for: ‎config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java

+36
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.util.Collections;
2020
import java.util.Map;
2121

22+
import jakarta.servlet.DispatcherType;
2223
import jakarta.servlet.ServletRegistration;
2324
import org.junit.jupiter.api.Test;
2425
import org.junit.jupiter.api.extension.ExtendWith;
@@ -33,10 +34,12 @@
3334
import org.springframework.security.config.test.SpringTestContextExtension;
3435
import org.springframework.test.web.servlet.MockMvc;
3536
import org.springframework.test.web.servlet.request.RequestPostProcessor;
37+
import org.springframework.web.bind.annotation.GetMapping;
3638
import org.springframework.web.bind.annotation.PathVariable;
3739
import org.springframework.web.bind.annotation.RequestMapping;
3840
import org.springframework.web.bind.annotation.RestController;
3941
import org.springframework.web.context.ConfigurableWebApplicationContext;
42+
import org.springframework.web.util.WebUtils;
4043

4144
import static org.assertj.core.api.Assertions.assertThat;
4245
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -380,6 +383,29 @@ public void configureWhenUsingDefaultMatcherAndServletPathAndAuthorizationManage
380383
.configLocations(this.xml("DefaultMatcherServletPathAuthorizationManager")).autowire());
381384
}
382385

386+
@Test
387+
public void requestWhenUsingFilterAllDispatcherTypesAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
388+
throws Exception {
389+
this.spring.configLocations(this.xml("AuthorizationManagerFilterAllDispatcherTypes")).autowire();
390+
// @formatter:off
391+
this.mvc.perform(get("/path").with(userCredentials()))
392+
.andExpect(status().isOk());
393+
this.mvc.perform(get("/path").with(adminCredentials()))
394+
.andExpect(status().isForbidden());
395+
this.mvc.perform(get("/error").with((request) -> {
396+
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error");
397+
request.setDispatcherType(DispatcherType.ERROR);
398+
return request;
399+
})).andExpect(status().isOk());
400+
this.mvc.perform(get("/path").with((request) -> {
401+
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/path");
402+
request.setDispatcherType(DispatcherType.ERROR);
403+
return request;
404+
})).andExpect(status().isUnauthorized());
405+
// @formatter:on
406+
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
407+
}
408+
383409
private static RequestPostProcessor adminCredentials() {
384410
return httpBasic("admin", "password");
385411
}
@@ -417,6 +443,16 @@ String path(@PathVariable("un") String name) {
417443

418444
}
419445

446+
@RestController
447+
static class ErrorController {
448+
449+
@GetMapping("/error")
450+
String error() {
451+
return "error";
452+
}
453+
454+
}
455+
420456
public static class Id {
421457

422458
public boolean isOne(int i) {

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2002-2022 the original author or authors.
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ https://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xmlns="http://www.springframework.org/schema/security"
21+
xsi:schemaLocation="
22+
http://www.springframework.org/schema/security
23+
https://www.springframework.org/schema/security/spring-security.xsd
24+
http://www.springframework.org/schema/beans
25+
https://www.springframework.org/schema/beans/spring-beans.xsd">
26+
27+
<http auto-config="true" use-authorization-manager="true" filter-all-dispatcher-types="true">
28+
<intercept-url request-matcher-ref="pathErrorRequestMatcher" access="permitAll()" />
29+
<intercept-url request-matcher-ref="errorRequestMatcher" access="authenticated" />
30+
<intercept-url pattern="/**" access="hasRole('USER')"/>
31+
<http-basic/>
32+
</http>
33+
34+
<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
35+
<b:bean name="error" class="org.springframework.security.config.http.InterceptUrlConfigTests.ErrorController"/>
36+
37+
<b:bean name="errorRequestMatcher" class="org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher">
38+
<b:constructor-arg value="ERROR"/>
39+
</b:bean>
40+
41+
<b:bean name="errorPathRequestMatcher" class="org.springframework.security.web.util.matcher.AntPathRequestMatcher">
42+
<b:constructor-arg value="/error"/>
43+
</b:bean>
44+
45+
<b:bean name="pathErrorRequestMatcher" class="org.springframework.security.web.util.matcher.AndRequestMatcher">
46+
<b:constructor-arg>
47+
<b:list>
48+
<b:ref bean="errorRequestMatcher"/>
49+
<b:ref bean="errorPathRequestMatcher"/>
50+
</b:list>
51+
</b:constructor-arg>
52+
</b:bean>
53+
54+
<b:import resource="userservice.xml"/>
55+
</b:beans>

Diff for: ‎docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc

+6
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,12 @@ Corresponds to the `observeOncePerRequest` property of `FilterSecurityIntercepto
9797
Defaults to `false`.
9898

9999

100+
[[nsa-http-filter-all-dispatcher-types]]
101+
* **filter-all-dispatcher-types**
102+
Corresponds to the `shouldFilterAllDispatcherTypes` property of the `AuthorizationFilter`. Only works when `use-authorization-manager=true`.
103+
Defaults to `false`.
104+
105+
100106
[[nsa-http-pattern]]
101107
* **pattern**
102108
Defining a pattern for the <<nsa-http,http>> element controls the requests which will be filtered through the list of filters which it defines.

0 commit comments

Comments
 (0)