Skip to content

Commit 92d3c9d

Browse files
jzheauxjzheaux
committed
Add PathPatternRequestMatcher
Closes gh-16429
1 parent 174f17e commit 92d3c9d

File tree

2 files changed

+237
-0
lines changed

2 files changed

+237
-0
lines changed

‎web/src/main/java/org/springframework/security/web/servlet/util/matcher/PathPatternRequestMatcher.java

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
/*
2+
* Copyright 2002-2025 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.web.servlet.util.matcher;
18+
19+
import java.util.Objects;
20+
21+
import jakarta.servlet.http.HttpServletRequest;
22+
23+
import org.springframework.http.server.PathContainer;
24+
import org.springframework.http.server.RequestPath;
25+
import org.springframework.security.web.util.matcher.RequestMatcher;
26+
import org.springframework.security.web.util.matcher.RequestMatchers;
27+
import org.springframework.web.util.ServletRequestPathUtils;
28+
import org.springframework.web.util.pattern.PathPattern;
29+
import org.springframework.web.util.pattern.PathPatternParser;
30+
31+
/**
32+
* A {@link RequestMatcher} that uses {@link PathPattern}s to match against each
33+
* {@link HttpServletRequest}. The provided path should be relative to the servlet (that
34+
* is, it should exclude any context or servlet path).
35+
*
36+
* <p>
37+
* To also match the servlet, please see {@link RequestMatchers#servlet}
38+
*
39+
* <p>
40+
* For example, if I want to match the path {@code /servlet/application}, then I would do:
41+
* <pre>
42+
* RequestMatchers.servlet("/servlet").uris("/application/**").matcher();
43+
* </pre>
44+
*
45+
* <p>
46+
* Or, if my path is part of the default servlet, and thus not a specific part of the
47+
* path, then I would do:
48+
*
49+
* <pre>
50+
* PathPatternRequestMatcher.pathPattern("/application/**");
51+
* </pre>
52+
*
53+
* <p>
54+
* Note that the {@link org.springframework.web.servlet.HandlerMapping} that contains the
55+
* related URI patterns must be using the same
56+
* {@link org.springframework.web.util.pattern.PathPatternParser} configured in this
57+
* class.
58+
* </p>
59+
*
60+
* @author Josh Cummings
61+
* @since 6.5
62+
*/
63+
public final class PathPatternRequestMatcher implements RequestMatcher {
64+
65+
private final PathPattern pattern;
66+
67+
/**
68+
* Creates a {@link PathPatternRequestMatcher} that uses the provided {@code pattern}.
69+
* <p>
70+
* The {@code pattern} should be relative to the servlet path
71+
* </p>
72+
* @param pattern the pattern used to match
73+
*/
74+
public PathPatternRequestMatcher(PathPattern pattern) {
75+
this.pattern = pattern;
76+
}
77+
78+
/**
79+
* Creates a {@link PathPatternRequestMatcher} that uses the provided {@code pattern},
80+
* parsing it with {@link PathPatternParser#defaultInstance}.
81+
* <p>
82+
* The {@code pattern} should be relative to the servlet path
83+
* </p>
84+
* @param pattern the pattern used to match
85+
*/
86+
public static PathPatternRequestMatcher pathPattern(String pattern) {
87+
PathPatternParser parser = PathPatternParser.defaultInstance;
88+
PathPattern pathPattern = parser.parse(pattern);
89+
return new PathPatternRequestMatcher(pathPattern);
90+
}
91+
92+
/**
93+
* {@inheritDoc}
94+
*/
95+
@Override
96+
public boolean matches(HttpServletRequest request) {
97+
return matcher(request).isMatch();
98+
}
99+
100+
/**
101+
* {@inheritDoc}
102+
*/
103+
@Override
104+
public MatchResult matcher(HttpServletRequest request) {
105+
PathContainer path = getRequestPath(request).pathWithinApplication();
106+
PathPattern.PathMatchInfo info = this.pattern.matchAndExtract(path);
107+
return (info != null) ? MatchResult.match(info.getUriVariables()) : MatchResult.notMatch();
108+
}
109+
110+
private RequestPath getRequestPath(HttpServletRequest request) {
111+
return ServletRequestPathUtils.parseAndCache(request);
112+
}
113+
114+
/**
115+
* {@inheritDoc}
116+
*/
117+
@Override
118+
public boolean equals(Object o) {
119+
if (!(o instanceof PathPatternRequestMatcher that)) {
120+
return false;
121+
}
122+
return Objects.equals(this.pattern, that.pattern);
123+
}
124+
125+
/**
126+
* {@inheritDoc}
127+
*/
128+
@Override
129+
public int hashCode() {
130+
return Objects.hash(this.pattern);
131+
}
132+
133+
/**
134+
* {@inheritDoc}
135+
*/
136+
@Override
137+
public String toString() {
138+
return "PathPatternRequestMatcher [pattern=" + this.pattern + "]";
139+
}
140+
141+
}

‎web/src/test/java/org/springframework/security/web/servlet/util/matcher/PathPatternRequestMatcherTests.java

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/*
2+
* Copyright 2002-2025 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.web.servlet.util.matcher;
18+
19+
import org.junit.jupiter.api.Test;
20+
21+
import org.springframework.http.HttpMethod;
22+
import org.springframework.mock.web.MockHttpServletRequest;
23+
import org.springframework.security.web.util.matcher.RequestMatcher;
24+
import org.springframework.security.web.util.matcher.RequestMatchers;
25+
import org.springframework.web.util.ServletRequestPathUtils;
26+
27+
import static org.assertj.core.api.Assertions.assertThat;
28+
29+
/**
30+
* Tests for {@link PathPatternRequestMatcher}
31+
*/
32+
public class PathPatternRequestMatcherTests {
33+
34+
@Test
35+
void matcherWhenPatternMatchesRequestThenMatchResult() {
36+
RequestMatcher matcher = PathPatternRequestMatcher.pathPattern("/uri");
37+
assertThat(matcher.matches(request("/uri"))).isTrue();
38+
}
39+
40+
@Test
41+
void matcherWhenPatternContainsPlaceholdersThenMatchResult() {
42+
RequestMatcher matcher = PathPatternRequestMatcher.pathPattern("/uri/{username}");
43+
assertThat(matcher.matcher(request("/uri/bob")).getVariables()).containsEntry("username", "bob");
44+
}
45+
46+
@Test
47+
void matcherWhenOnlyPathInfoMatchesThenMatches() {
48+
RequestMatcher matcher = PathPatternRequestMatcher.pathPattern("/uri");
49+
assertThat(matcher.matches(request("GET", "/mvc/uri", "/mvc"))).isTrue();
50+
}
51+
52+
@Test
53+
void matcherWhenUriContainsServletPathThenNoMatch() {
54+
RequestMatcher matcher = PathPatternRequestMatcher.pathPattern("/mvc/uri");
55+
assertThat(matcher.matches(request("GET", "/mvc/uri", "/mvc"))).isFalse();
56+
}
57+
58+
@Test
59+
void matcherWhenSameMethodThenMatchResult() {
60+
RequestMatcher matcher = RequestMatchers.request().methods(HttpMethod.GET).uris("/uri").matcher();
61+
assertThat(matcher.matches(request("/uri"))).isTrue();
62+
}
63+
64+
@Test
65+
void matcherWhenDifferentPathThenNoMatch() {
66+
RequestMatcher matcher = RequestMatchers.request().methods(HttpMethod.GET).uris("/uri").matcher();
67+
assertThat(matcher.matches(request("GET", "/urj", ""))).isFalse();
68+
}
69+
70+
@Test
71+
void matcherWhenDifferentMethodThenNoMatch() {
72+
RequestMatcher matcher = RequestMatchers.request().methods(HttpMethod.GET).uris("/uri").matcher();
73+
assertThat(matcher.matches(request("POST", "/mvc/uri", "/mvc"))).isFalse();
74+
}
75+
76+
@Test
77+
void matcherWhenNoMethodThenMatches() {
78+
RequestMatcher matcher = PathPatternRequestMatcher.pathPattern("/uri");
79+
assertThat(matcher.matches(request("POST", "/uri", ""))).isTrue();
80+
assertThat(matcher.matches(request("GET", "/uri", ""))).isTrue();
81+
}
82+
83+
MockHttpServletRequest request(String uri) {
84+
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
85+
ServletRequestPathUtils.parseAndCache(request);
86+
return request;
87+
}
88+
89+
MockHttpServletRequest request(String method, String uri, String servletPath) {
90+
MockHttpServletRequest request = new MockHttpServletRequest(method, uri);
91+
request.setServletPath(servletPath);
92+
ServletRequestPathUtils.parseAndCache(request);
93+
return request;
94+
}
95+
96+
}

0 commit comments

Comments
 (0)