Skip to content

Commit 1150f46

Browse files
wilkinsonawilkinsona
committed
Merge branch 'gh-14503' into 2.0.x
2 parents 85f2db3 + d4cad5e commit 1150f46

File tree

5 files changed

+464
-82
lines changed

5 files changed

+464
-82
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java

+2-19
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535
import org.springframework.boot.actuate.endpoint.annotation.Endpoint;
3636
import org.springframework.boot.actuate.endpoint.web.PathMappedEndpoints;
3737
import org.springframework.boot.autoconfigure.security.servlet.RequestMatcherProvider;
38-
import org.springframework.boot.autoconfigure.web.servlet.DispatcherServletPath;
3938
import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher;
4039
import org.springframework.core.annotation.AnnotatedElementUtils;
4140
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@@ -139,23 +138,13 @@ protected final boolean matches(HttpServletRequest request,
139138

140139
private RequestMatcher createDelegate(WebApplicationContext context) {
141140
try {
142-
String pathPrefix = getPathPrefix(context);
143-
return createDelegate(context, new RequestMatcherFactory(pathPrefix));
141+
return createDelegate(context, new RequestMatcherFactory());
144142
}
145143
catch (NoSuchBeanDefinitionException ex) {
146144
return EMPTY_MATCHER;
147145
}
148146
}
149147

150-
private String getPathPrefix(WebApplicationContext context) {
151-
try {
152-
return context.getBean(DispatcherServletPath.class).getPrefix();
153-
}
154-
catch (NoSuchBeanDefinitionException ex) {
155-
return "";
156-
}
157-
}
158-
159148
protected abstract RequestMatcher createDelegate(WebApplicationContext context,
160149
RequestMatcherFactory requestMatcherFactory);
161150

@@ -313,15 +302,9 @@ protected RequestMatcher createDelegate(WebApplicationContext context,
313302
*/
314303
private static class RequestMatcherFactory {
315304

316-
private final String prefix;
317-
318-
RequestMatcherFactory(String prefix) {
319-
this.prefix = prefix;
320-
}
321-
322305
public RequestMatcher antPath(RequestMatcherProvider matcherProvider,
323306
String... parts) {
324-
StringBuilder pattern = new StringBuilder(this.prefix);
307+
StringBuilder pattern = new StringBuilder();
325308
for (String part : parts) {
326309
pattern.append(part);
327310
}

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/AbstractEndpointRequestIntegrationTests.java

+184
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
/*
2+
* Copyright 2012-2018 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.boot.actuate.autoconfigure.security.servlet;
17+
18+
import java.util.ArrayList;
19+
import java.util.Base64;
20+
import java.util.List;
21+
22+
import org.junit.Test;
23+
24+
import org.springframework.boot.actuate.endpoint.EndpointId;
25+
import org.springframework.boot.actuate.endpoint.ExposableEndpoint;
26+
import org.springframework.boot.actuate.endpoint.Operation;
27+
import org.springframework.boot.actuate.endpoint.annotation.Endpoint;
28+
import org.springframework.boot.actuate.endpoint.annotation.ReadOperation;
29+
import org.springframework.boot.actuate.endpoint.web.PathMappedEndpoint;
30+
import org.springframework.boot.actuate.endpoint.web.PathMappedEndpoints;
31+
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
32+
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
33+
import org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext;
34+
import org.springframework.context.annotation.Bean;
35+
import org.springframework.context.annotation.Configuration;
36+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
37+
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
38+
import org.springframework.test.web.reactive.server.WebTestClient;
39+
40+
import static org.mockito.BDDMockito.given;
41+
import static org.mockito.Mockito.mock;
42+
43+
/**
44+
* Abstract base class for {@link EndpointRequest} tests.
45+
*
46+
* @author Madhura Bhave
47+
*/
48+
public abstract class AbstractEndpointRequestIntegrationTests {
49+
50+
protected abstract WebApplicationContextRunner getContextRunner();
51+
52+
@Test
53+
public void toEndpointShouldMatch() {
54+
getContextRunner().run((context) -> {
55+
WebTestClient webTestClient = getWebTestClient(context);
56+
webTestClient.get().uri("/actuator/e1").exchange().expectStatus().isOk();
57+
});
58+
}
59+
60+
@Test
61+
public void toAllEndpointsShouldMatch() {
62+
getContextRunner().withPropertyValues("spring.security.user.password=password")
63+
.run((context) -> {
64+
WebTestClient webTestClient = getWebTestClient(context);
65+
webTestClient.get().uri("/actuator/e2").exchange().expectStatus()
66+
.isUnauthorized();
67+
webTestClient.get().uri("/actuator/e2")
68+
.header("Authorization", getBasicAuth()).exchange()
69+
.expectStatus().isOk();
70+
});
71+
}
72+
73+
@Test
74+
public void toLinksShouldMatch() {
75+
getContextRunner().run((context) -> {
76+
WebTestClient webTestClient = getWebTestClient(context);
77+
webTestClient.get().uri("/actuator").exchange().expectStatus().isOk();
78+
webTestClient.get().uri("/actuator/").exchange().expectStatus().isOk();
79+
});
80+
}
81+
82+
protected WebTestClient getWebTestClient(AssertableWebApplicationContext context) {
83+
int port = context
84+
.getSourceApplicationContext(
85+
AnnotationConfigServletWebServerApplicationContext.class)
86+
.getWebServer().getPort();
87+
return WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
88+
}
89+
90+
String getBasicAuth() {
91+
return "Basic " + Base64.getEncoder().encodeToString("user:password".getBytes());
92+
}
93+
94+
static class BaseConfiguration {
95+
96+
@Bean
97+
public TestEndpoint1 endpoint1() {
98+
return new TestEndpoint1();
99+
}
100+
101+
@Bean
102+
public TestEndpoint2 endpoint2() {
103+
return new TestEndpoint2();
104+
}
105+
106+
@Bean
107+
public TestEndpoint3 endpoint3() {
108+
return new TestEndpoint3();
109+
}
110+
111+
@Bean
112+
public PathMappedEndpoints pathMappedEndpoints() {
113+
List<ExposableEndpoint<?>> endpoints = new ArrayList<>();
114+
endpoints.add(mockEndpoint("e1"));
115+
endpoints.add(mockEndpoint("e2"));
116+
endpoints.add(mockEndpoint("e3"));
117+
return new PathMappedEndpoints("/actuator", () -> endpoints);
118+
}
119+
120+
private TestPathMappedEndpoint mockEndpoint(String id) {
121+
TestPathMappedEndpoint endpoint = mock(TestPathMappedEndpoint.class);
122+
given(endpoint.getEndpointId()).willReturn(EndpointId.of(id));
123+
given(endpoint.getRootPath()).willReturn(id);
124+
return endpoint;
125+
}
126+
127+
}
128+
129+
@Endpoint(id = "e1")
130+
static class TestEndpoint1 {
131+
132+
@ReadOperation
133+
public Object getAll() {
134+
return "endpoint 1";
135+
}
136+
137+
}
138+
139+
@Endpoint(id = "e2")
140+
static class TestEndpoint2 {
141+
142+
@ReadOperation
143+
public Object getAll() {
144+
return "endpoint 2";
145+
}
146+
147+
}
148+
149+
@Endpoint(id = "e3")
150+
static class TestEndpoint3 {
151+
152+
@ReadOperation
153+
public Object getAll() {
154+
return null;
155+
}
156+
157+
}
158+
159+
interface TestPathMappedEndpoint
160+
extends ExposableEndpoint<Operation>, PathMappedEndpoint {
161+
162+
}
163+
164+
@Configuration
165+
static class SecurityConfiguration {
166+
167+
@Bean
168+
public WebSecurityConfigurerAdapter webSecurityConfigurerAdapter() {
169+
return new WebSecurityConfigurerAdapter() {
170+
@Override
171+
protected void configure(HttpSecurity http) throws Exception {
172+
http.authorizeRequests().requestMatchers(EndpointRequest.toLinks())
173+
.permitAll()
174+
.requestMatchers(EndpointRequest.to(TestEndpoint1.class))
175+
.permitAll().requestMatchers(EndpointRequest.toAnyEndpoint())
176+
.authenticated().anyRequest().hasRole("ADMIN").and()
177+
.httpBasic();
178+
}
179+
};
180+
}
181+
182+
}
183+
184+
}

0 commit comments

Comments
 (0)