@@ -22,8 +22,7 @@ class TypeAuthorizedUrl extends Class {
22
22
}
23
23
24
24
/**
25
- * The class
26
- * `org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry`.
25
+ * The class `org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry`.
27
26
*/
28
27
class TypeAbstractRequestMatcherRegistry extends Class {
29
28
TypeAbstractRequestMatcherRegistry ( ) {
@@ -34,38 +33,44 @@ class TypeAbstractRequestMatcherRegistry extends Class {
34
33
}
35
34
36
35
/**
37
- * The class
38
- * `org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest.EndpointRequestMatcher`.
36
+ * The class `org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest`.
39
37
*/
40
- class TypeEndpointRequestMatcher extends Class {
41
- TypeEndpointRequestMatcher ( ) {
38
+ class TypeEndpointRequest extends Class {
39
+ TypeEndpointRequest ( ) {
42
40
this
43
41
.hasQualifiedName ( "org.springframework.boot.actuate.autoconfigure.security.servlet" ,
44
- "EndpointRequest$EndpointRequestMatcher" )
42
+ "EndpointRequest" )
43
+ }
44
+ }
45
+
46
+ /** A call to `EndpointRequest.toAnyEndpoint` method. */
47
+ class ToAnyEndpointCall extends MethodAccess {
48
+ ToAnyEndpointCall ( ) {
49
+ getMethod ( ) .hasName ( "toAnyEndpoint" ) and
50
+ getMethod ( ) .getDeclaringType ( ) instanceof TypeEndpointRequest
45
51
}
46
52
}
47
53
48
54
/**
49
- * A call to `HttpSecurity.requestMatcher` method with argument of type
50
- * `EndpointRequestMatcher`.
55
+ * A call to `HttpSecurity.requestMatcher` method with argument `RequestMatcher.toAnyEndpoint()`.
51
56
*/
52
57
class RequestMatcherCall extends MethodAccess {
53
58
RequestMatcherCall ( ) {
54
59
getMethod ( ) .hasName ( "requestMatcher" ) and
55
60
getMethod ( ) .getDeclaringType ( ) instanceof TypeHttpSecurity and
56
- getArgument ( 0 ) . getType ( ) instanceof TypeEndpointRequestMatcher
61
+ getArgument ( 0 ) instanceof ToAnyEndpointCall
57
62
}
58
63
}
59
64
60
65
/**
61
- * A call to `HttpSecurity.requestMatchers` method with lambda argument resolving to
62
- * `EndpointRequestMatcher` type .
66
+ * A call to `HttpSecurity.requestMatchers` method with lambda argument
67
+ * `RequestMatcher.toAnyEndpoint()` .
63
68
*/
64
69
class RequestMatchersCall extends MethodAccess {
65
70
RequestMatchersCall ( ) {
66
71
getMethod ( ) .hasName ( "requestMatchers" ) and
67
72
getMethod ( ) .getDeclaringType ( ) instanceof TypeHttpSecurity and
68
- getArgument ( 0 ) .( LambdaExpr ) .getExprBody ( ) . getType ( ) instanceof TypeEndpointRequestMatcher
73
+ getArgument ( 0 ) .( LambdaExpr ) .getExprBody ( ) instanceof ToAnyEndpointCall
69
74
}
70
75
}
71
76
@@ -92,9 +97,6 @@ class PermitAllCall extends MethodAccess {
92
97
or
93
98
// .requestMatchers(matcher -> EndpointRequest).authorizeRequests([...]).[...]
94
99
authorizeRequestsCall .getQualifier ( ) instanceof RequestMatchersCall
95
- or
96
- // http.authorizeRequests([...]).[...]
97
- authorizeRequestsCall .getQualifier ( ) instanceof VarAccess
98
100
|
99
101
// [...].authorizeRequests(r -> r.anyRequest().permitAll()) or
100
102
// [...].authorizeRequests(r -> r.requestMatchers(EndpointRequest).permitAll())
@@ -117,6 +119,22 @@ class PermitAllCall extends MethodAccess {
117
119
this .getQualifier ( ) = anyRequestCall
118
120
)
119
121
)
122
+ or
123
+ exists ( AuthorizeRequestsCall authorizeRequestsCall |
124
+ // http.authorizeRequests([...]).[...]
125
+ authorizeRequestsCall .getQualifier ( ) instanceof VarAccess
126
+ |
127
+ // [...].authorizeRequests(r -> r.requestMatchers(EndpointRequest).permitAll())
128
+ authorizeRequestsCall .getArgument ( 0 ) .( LambdaExpr ) .getExprBody ( ) = this and
129
+ this .getQualifier ( ) instanceof RegistryRequestMatchersCall
130
+ or
131
+ // [...].authorizeRequests().requestMatchers(EndpointRequest).permitAll() or
132
+ authorizeRequestsCall .getNumArgument ( ) = 0 and
133
+ exists ( RegistryRequestMatchersCall registryRequestMatchersCall |
134
+ registryRequestMatchersCall .getQualifier ( ) = authorizeRequestsCall and
135
+ this .getQualifier ( ) = registryRequestMatchersCall
136
+ )
137
+ )
120
138
}
121
139
}
122
140
@@ -129,13 +147,13 @@ class AnyRequestCall extends MethodAccess {
129
147
}
130
148
131
149
/**
132
- * A call to `AbstractRequestMatcherRegistry.requestMatchers` method with an argument of type
133
- * `EndpointRequestMatcher `.
150
+ * A call to `AbstractRequestMatcherRegistry.requestMatchers` method with an argument
151
+ * `RequestMatcher.toAnyEndpoint() `.
134
152
*/
135
153
class RegistryRequestMatchersCall extends MethodAccess {
136
154
RegistryRequestMatchersCall ( ) {
137
155
getMethod ( ) .hasName ( "requestMatchers" ) and
138
156
getMethod ( ) .getDeclaringType ( ) instanceof TypeAbstractRequestMatcherRegistry and
139
- getAnArgument ( ) . getType ( ) instanceof TypeEndpointRequestMatcher
157
+ getAnArgument ( ) instanceof ToAnyEndpointCall
140
158
}
141
159
}
0 commit comments