Skip to content

Commit 753e113

Browse files
jgrandjajgrandja
committed
RequestMatcherDelegatingAuthorizationManager defaults to deny
Closes gh-11958
1 parent d0653af commit 753e113

File tree

51 files changed

+126
-67
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+126
-67
lines changed

Diff for: ‎config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java

+1-4
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@
3434
import org.springframework.beans.factory.xml.BeanDefinitionParser;
3535
import org.springframework.beans.factory.xml.ParserContext;
3636
import org.springframework.beans.factory.xml.XmlReaderContext;
37-
import org.springframework.security.authorization.AuthenticatedAuthorizationManager;
3837
import org.springframework.security.authorization.AuthorizationManager;
3938
import org.springframework.security.authorization.ObservationAuthorizationManager;
4039
import org.springframework.security.config.Elements;
@@ -43,7 +42,6 @@
4342
import org.springframework.security.web.access.intercept.AuthorizationFilter;
4443
import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
4544
import org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager;
46-
import org.springframework.security.web.util.matcher.AnyRequestMatcher;
4745
import org.springframework.security.web.util.matcher.RequestMatcher;
4846
import org.springframework.util.StringUtils;
4947
import org.springframework.util.xml.DomUtils;
@@ -197,8 +195,7 @@ public AuthorizationManager<HttpServletRequest> getObject() throws Exception {
197195
.entrySet()) {
198196
builder.add(entry.getKey(), entry.getValue());
199197
}
200-
AuthorizationManager<HttpServletRequest> manager = builder
201-
.add(AnyRequestMatcher.INSTANCE, AuthenticatedAuthorizationManager.authenticated()).build();
198+
AuthorizationManager<HttpServletRequest> manager = builder.build();
202199
if (!this.observationRegistry.isNoop()) {
203200
return new ObservationAuthorizationManager<>(this.observationRegistry, manager);
204201
}

Diff for: ‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurerTests.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -358,15 +358,15 @@ public void getWhenServletPathRoleAdminConfiguredAndRoleIsUserThenRespondsWithFo
358358
}
359359

360360
@Test
361-
public void getWhenServletPathRoleAdminConfiguredAndRoleIsUserAndWithoutServletPathThenRespondsWithOk()
361+
public void getWhenServletPathRoleAdminConfiguredAndRoleIsUserAndWithoutServletPathThenRespondsWithForbidden()
362362
throws Exception {
363363
this.spring.register(ServletPathConfig.class, BasicController.class).autowire();
364364
// @formatter:off
365365
MockHttpServletRequestBuilder requestWithUser = get("/")
366366
.with(user("user")
367367
.roles("USER"));
368368
// @formatter:on
369-
this.mvc.perform(requestWithUser).andExpect(status().isOk());
369+
this.mvc.perform(requestWithUser).andExpect(status().isForbidden());
370370
}
371371

372372
@Test

Diff for: ‎config/src/test/java/org/springframework/security/config/authentication/AuthenticationManagerBeanDefinitionParserTests.java

+4-1
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,10 @@ public void passwordEncoderBeanUsed() throws Exception {
139139
+ "<user-service>"
140140
+ " <user name='user' password='password' authorities='ROLE_A,ROLE_B' />"
141141
+ "</user-service>"
142-
+ "<http/>")
142+
+ "<http>"
143+
+ " <intercept-url pattern=\"/**\" access=\"authenticated\"/>"
144+
+ " <http-basic />"
145+
+ "</http>")
143146
.mockMvcAfterSpringSecurityOk()
144147
.autowire();
145148
this.mockMvc.perform(get("/").with(httpBasic("user", "password")))

Diff for: ‎config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ public void requestWhenUsingPatchAndAuthorizationManagerThenAuthorizesRequestsAc
120120
this.spring.configLocations(this.xml("PatchMethodAuthorizationManager")).autowire();
121121
// @formatter:off
122122
this.mvc.perform(get("/path").with(userCredentials()))
123-
.andExpect(status().isOk());
123+
.andExpect(status().isForbidden());
124124
this.mvc.perform(patch("/path").with(userCredentials()))
125125
.andExpect(status().isForbidden());
126126
this.mvc.perform(patch("/path").with(adminCredentials()))

Diff for: ‎config/src/test/java/org/springframework/security/config/http/SessionManagementConfigServlet31Tests.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2013 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -85,6 +85,7 @@ public void changeSessionIdThenPreserveParameters() throws Exception {
8585
String id = request.getSession().getId();
8686
// @formatter:off
8787
loadContext("<http>\n"
88+
+ " <intercept-url pattern=\"/**\" access=\"authenticated\"/>\n"
8889
+ " <form-login/>\n"
8990
+ " <session-management/>\n"
9091
+ " <csrf disabled='true'/>\n"
@@ -107,6 +108,7 @@ public void changeSessionId() throws Exception {
107108
String id = request.getSession().getId();
108109
// @formatter:off
109110
loadContext("<http>\n"
111+
+ " <intercept-url pattern=\"/**\" access=\"authenticated\"/>\n"
110112
+ " <form-login/>\n"
111113
+ " <session-management session-fixation-protection='changeSessionId'/>\n"
112114
+ " <csrf disabled='true'/>\n"

Diff for: ‎config/src/test/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDslTests.kt

+2-2
Original file line numberDiff line numberDiff line change
@@ -512,7 +512,7 @@ class AuthorizeHttpRequestsDslTests {
512512
request.servletPath = "/other"
513513
request
514514
})
515-
.andExpect(status().isOk)
515+
.andExpect(status().isForbidden)
516516
}
517517

518518
@Configuration
@@ -602,7 +602,7 @@ class AuthorizeHttpRequestsDslTests {
602602
servletPath = "/other"
603603
}
604604
})
605-
.andExpect(status().isOk)
605+
.andExpect(status().isForbidden)
606606
}
607607

608608
@Configuration

Diff for: ‎config/src/test/resources/org/springframework/security/config/authentication/PasswordEncoderParserTests-bean.xml

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
~ Copyright 2002-2017 the original author or authors.
2+
~ Copyright 2002-2022 the original author or authors.
33
~
44
~ Licensed under the Apache License, Version 2.0 (the "License");
55
~ you may not use this file except in compliance with the License.
@@ -22,7 +22,10 @@
2222

2323
<b:bean id="passwordEncoder" class="org.springframework.security.crypto.password.NoOpPasswordEncoder" factory-method="getInstance"/>
2424

25-
<http />
25+
<http>
26+
<intercept-url pattern="/**" access="authenticated"/>
27+
<http-basic />
28+
</http>
2629

2730
<authentication-manager>
2831
<authentication-provider>

Diff for: ‎config/src/test/resources/org/springframework/security/config/authentication/PasswordEncoderParserTests-default.xml

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@
33
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
44
xsi:schemaLocation="http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd
55
http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd">
6-
<http />
6+
<http>
7+
<intercept-url pattern="/**" access="authenticated"/>
8+
<http-basic />
9+
</http>
710

811
<authentication-manager>
912
<authentication-provider>

Diff for: ‎config/src/test/resources/org/springframework/security/config/debug/SecurityDebugBeanFactoryPostProcessorTests-context.xml

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,7 +25,9 @@
2525

2626
<debug/>
2727

28-
<http/>
28+
<http auto-config="true">
29+
<intercept-url pattern="/**" access="authenticated"/>
30+
</http>
2931

3032
<authentication-manager>
3133
<authentication-provider ref="authProvider"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-WithAccessDeniedHandler.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
2424
<http auto-config="true">
2525
<access-denied-handler ref="accessDeniedHandler"/>
2626
<csrf/>
27+
<intercept-url pattern="/**" access="authenticated"/>
2728
</http>
2829

2930
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-WithRequestAttrName.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
2424

2525
<http auto-config="true">
2626
<csrf request-handler-ref="requestHandler"/>
27+
<intercept-url pattern="/**" access="authenticated"/>
2728
</http>
2829

2930
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler"

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests-AutoConfig.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http auto-config="true">
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
</http>
2930

3031
<b:import resource="userservice.xml"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests-Simple.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@
2626

2727
<http auto-config="true">
2828
<csrf disabled="true"/>
29+
<intercept-url pattern="/**" access="authenticated"/>
2930
</http>
3031

3132
<b:import resource="userservice.xml"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests-WithAuthenticationFailureForwardUrl.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@
2929
authentication-failure-forward-url="/failure_forward_url"/>
3030

3131
<csrf disabled="true"/>
32+
<intercept-url pattern="/**" access="authenticated"/>
3233
</http>
3334

3435
<b:import resource="userservice.xml"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests-WithAuthenticationSuccessForwardUrl.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@
2929
authentication-success-forward-url="/success_forward_url"/>
3030

3131
<csrf disabled="true"/>
32+
<intercept-url pattern="/**" access="authenticated"/>
3233
</http>
3334

3435
<b:import resource="userservice.xml"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests-WithCustomAttributes.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -31,6 +31,7 @@
3131
password-parameter="custom_pass"/>
3232

3333
<csrf disabled="true"/>
34+
<intercept-url pattern="/**" access="authenticated"/>
3435
</http>
3536

3637
<b:import resource="userservice.xml"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-AuthenticationManagerEraseCredentials.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http>
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
<http-basic/>
2930
</http>
3031

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-AuthenticationManagerRefKeepCredentials.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http authentication-manager-ref="authMgr">
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
<http-basic/>
2930
</http>
3031

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-AuthenticationManagerRefNotProviderManager.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http authentication-manager-ref="authMgr">
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
<http-basic/>
2930
</http>
3031

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-AutoConfig.xml

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -24,7 +24,9 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true"/>
27+
<http auto-config="true">
28+
<intercept-url pattern="/**" access="authenticated"/>
29+
</http>
2830

2931
<b:import resource="userservice.xml"/>
3032
</b:beans>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-CustomAuthenticationDetailsSourceRef.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http>
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
<http-basic authentication-details-source-ref="authenticationDetailsSource"/>
2930
<form-login authentication-details-source-ref="authenticationDetailsSource"/>
3031
<x509 subject-principal-regex="OU=(.*?)(?:,|$)" authentication-details-source-ref="authenticationDetailsSource"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-CustomFilters.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http auto-config="true">
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
<custom-filter ref="${customFilterRef}" position="FIRST"/>
2930
<custom-filter ref="userFilter" before="SECURITY_CONTEXT_FILTER"/>
3031
<custom-filter ref="userFilter" after="LOGOUT_FILTER"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-DeleteCookies.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http auto-config="true">
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
<logout delete-cookies="JSESSIONID, mycookie"/>
2930
</http>
3031

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-HttpBasic.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<!--
3-
~ Copyright 2002-2018 the original author or authors.
3+
~ Copyright 2002-2022 the original author or authors.
44
~
55
~ Licensed under the Apache License, Version 2.0 (the "License");
66
~ you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727
<http>
28+
<intercept-url pattern="/**" access="authenticated"/>
2829
<http-basic/>
2930
</http>
3031

0 commit comments

Comments
 (0)