Skip to content

Commit b9979c7

Browse files
GrmpfNarfGrmpfNarf
authored
Merge branch 'spring-projects:main' into feature/gh-16394 
2 parents 768602b + 88a3801 commit b9979c7

File tree

420 files changed

+13517
-1954
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

420 files changed

+13517
-1954
lines changed

‎.github/workflows/continuous-integration-workflow.yml

+3-19
Original file line numberDiff line numberDiff line change
@@ -64,39 +64,23 @@ jobs:
6464
./gradlew publishMavenJavaPublicationToLocalRepository
6565
./gradlew cloneRepository -PrepositoryName="spring-projects/spring-security-samples" -Pref="$samples_branch" -PcloneOutputDirectory="$SAMPLES_DIR"
6666
./gradlew --refresh-dependencies --project-dir "$SAMPLES_DIR" --init-script spring-security-ci.gradle -PlocalRepositoryPath="$LOCAL_REPOSITORY_PATH" -PspringSecurityVersion="$version" test integrationTest
67-
check-tangles:
68-
name: Check for Package Tangles
69-
runs-on: ubuntu-latest
70-
if: ${{ github.repository_owner == 'spring-projects' }}
71-
steps:
72-
- uses: actions/checkout@v4
73-
- name: Set up gradle
74-
uses: spring-io/spring-gradle-build-action@v2
75-
with:
76-
java-version: 17
77-
distribution: temurin
78-
- name: Check for package tangles
79-
env:
80-
STRUCTURE101_LICENSEID: ${{ secrets.STRUCTURE101_LICENSEID }}
81-
run: |
82-
./gradlew assemble && ./gradlew s101 -Ps101.licenseId="$STRUCTURE101_LICENSEID" --stacktrace
8367
deploy-artifacts:
8468
name: Deploy Artifacts
85-
needs: [ build, test, check-samples, check-tangles ]
69+
needs: [ build, test, check-samples ]
8670
uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@v1
8771
with:
8872
should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
8973
secrets: inherit
9074
deploy-docs:
9175
name: Deploy Docs
92-
needs: [ build, test, check-samples, check-tangles ]
76+
needs: [ build, test, check-samples ]
9377
uses: spring-io/spring-security-release-tools/.github/workflows/deploy-docs.yml@v1
9478
with:
9579
should-deploy-docs: ${{ needs.build.outputs.should-deploy-artifacts }}
9680
secrets: inherit
9781
deploy-schema:
9882
name: Deploy Schema
99-
needs: [ build, test, check-samples, check-tangles ]
83+
needs: [ build, test, check-samples ]
10084
uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@v1
10185
with:
10286
should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}

‎.github/workflows/update-antora-ui-spring.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
matrix:
1919
branch: [ '5.8.x', '6.2.x', '6.3.x', 'main' ]
2020
steps:
21-
- uses: spring-io/spring-doc-actions/update-antora-spring-ui@852920ba3fb1f28b35a2f13201133bc00ef33677
21+
- uses: spring-io/spring-doc-actions/update-antora-spring-ui@c2038265125ec6f305a4a041d892ee44c156a754
2222
name: Update
2323
with:
2424
docs-branch: ${{ matrix.branch }}
@@ -28,7 +28,7 @@ jobs:
2828
runs-on: ubuntu-latest
2929
name: Update on docs-build
3030
steps:
31-
- uses: spring-io/spring-doc-actions/update-antora-spring-ui@852920ba3fb1f28b35a2f13201133bc00ef33677
31+
- uses: spring-io/spring-doc-actions/update-antora-spring-ui@c2038265125ec6f305a4a041d892ee44c156a754
3232
name: Update
3333
with:
3434
docs-branch: 'docs-build'

‎acl/spring-security-acl.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,5 @@ dependencies {
2020
testImplementation "org.springframework:spring-test"
2121

2222
testRuntimeOnly 'org.hsqldb:hsqldb'
23+
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
2324
}

‎acl/src/main/java/org/springframework/security/acls/AclEntryVoter.java

+4
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,11 @@
9696
* All comparisons and prefixes are case sensitive.
9797
*
9898
* @author Ben Alex
99+
* @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
100+
* annotations may also prove useful, for example
101+
* {@code @PreAuthorize("hasPermission(#id, ObjectsReturnType.class, read)")}
99102
*/
103+
@Deprecated
100104
public class AclEntryVoter extends AbstractAclVoter {
101105

102106
private static final Log logger = LogFactory.getLog(AclEntryVoter.class);

‎acl/src/main/java/org/springframework/security/acls/afterinvocation/AbstractAclProvider.java

+5
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020

2121
import org.springframework.security.access.AfterInvocationProvider;
2222
import org.springframework.security.access.ConfigAttribute;
23+
import org.springframework.security.acls.AclPermissionEvaluator;
2324
import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
2425
import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
2526
import org.springframework.security.acls.model.Acl;
@@ -39,7 +40,11 @@
3940
* services.
4041
*
4142
* @author Ben Alex
43+
* @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
44+
* annotations may also prove useful, for example
45+
* {@code @PostAuthorize("hasPermission(filterObject, read)")}
4246
*/
47+
@Deprecated
4348
public abstract class AbstractAclProvider implements AfterInvocationProvider {
4449

4550
protected final AclService aclService;

‎acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProvider.java

+5
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import org.springframework.security.access.AccessDeniedException;
2727
import org.springframework.security.access.AuthorizationServiceException;
2828
import org.springframework.security.access.ConfigAttribute;
29+
import org.springframework.security.acls.AclPermissionEvaluator;
2930
import org.springframework.security.acls.model.AclService;
3031
import org.springframework.security.acls.model.Permission;
3132
import org.springframework.security.core.Authentication;
@@ -62,7 +63,11 @@
6263
*
6364
* @author Ben Alex
6465
* @author Paulo Neves
66+
* @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
67+
* annotations may also prove useful, for example
68+
* {@code @PostFilter("hasPermission(filterObject, read)")}
6569
*/
70+
@Deprecated
6671
public class AclEntryAfterInvocationCollectionFilteringProvider extends AbstractAclProvider {
6772

6873
protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationCollectionFilteringProvider.class);

‎acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java

+6
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.springframework.context.support.MessageSourceAccessor;
2828
import org.springframework.security.access.AccessDeniedException;
2929
import org.springframework.security.access.ConfigAttribute;
30+
import org.springframework.security.acls.AclPermissionEvaluator;
3031
import org.springframework.security.acls.model.AclService;
3132
import org.springframework.security.acls.model.Permission;
3233
import org.springframework.security.core.Authentication;
@@ -59,7 +60,12 @@
5960
* granted and <code>null</code> will be returned.
6061
* <p>
6162
* All comparisons and prefixes are case sensitive.
63+
*
64+
* @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
65+
* annotations may also prove useful, for example
66+
* {@code @PostAuthorize("hasPermission(filterObject, read)")}
6267
*/
68+
@Deprecated
6369
public class AclEntryAfterInvocationProvider extends AbstractAclProvider implements MessageSourceAware {
6470

6571
protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationProvider.class);

‎acl/src/main/java/org/springframework/security/acls/afterinvocation/ArrayFilterer.java

+2
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@
3232
*
3333
* @author Ben Alex
3434
* @author Paulo Neves
35+
* @deprecated please see {@code PostFilter}
3536
*/
37+
@Deprecated
3638
class ArrayFilterer<T> implements Filterer<T> {
3739

3840
protected static final Log logger = LogFactory.getLog(ArrayFilterer.class);

‎acl/src/main/java/org/springframework/security/acls/afterinvocation/CollectionFilterer.java

+2
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,9 @@
3131
*
3232
* @author Ben Alex
3333
* @author Paulo Neves
34+
* @deprecated please see {@code PostFilter}
3435
*/
36+
@Deprecated
3537
class CollectionFilterer<T> implements Filterer<T> {
3638

3739
protected static final Log logger = LogFactory.getLog(CollectionFilterer.class);

‎acl/src/main/java/org/springframework/security/acls/afterinvocation/Filterer.java

+2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@
2323
*
2424
* @author Ben Alex
2525
* @author Paulo Neves
26+
* @deprecated please use {@code PreFilter} and {@code @PostFilter} instead
2627
*/
28+
@Deprecated
2729
interface Filterer<T> extends Iterable<T> {
2830

2931
/**

‎aspects/spring-security-aspects.gradle

+2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ dependencies {
2727
testImplementation "org.mockito:mockito-junit-jupiter"
2828
testImplementation "org.springframework:spring-test"
2929
testAspect sourceSets.main.output
30+
31+
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
3032
}
3133

3234
compileAspectj.ajcOptions.outxmlfile = "META-INF/aop.xml"

‎build.gradle

+1-7
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ plugins {
2020

2121
apply plugin: 'io.spring.nohttp'
2222
apply plugin: 'locks'
23-
apply plugin: 's101'
2423
apply plugin: 'io.spring.convention.root'
2524
apply plugin: 'org.jetbrains.kotlin.jvm'
2625
apply plugin: 'org.springframework.security.versions.verify-dependencies-versions'
@@ -121,16 +120,11 @@ tasks.register('cloneRepository', IncludeRepoTask) {
121120
outputDirectory = project.hasProperty("cloneOutputDirectory") ? project.file("$cloneOutputDirectory") : defaultDirectory
122121
}
123122

124-
s101 {
125-
repository = 'https://structure101.com/binaries/latest'
126-
configurationDirectory = project.file("etc/s101")
127-
}
128-
129123
wrapperUpgrade {
130124
gradle {
131125
'spring-security' {
132126
repo = 'spring-projects/spring-security'
133-
baseBranch = '6.2.x' // runs only on 6.2.x and the update is merged forward to main
127+
baseBranch = '6.3.x' // runs only on 6.3.x and the update is merged forward to main
134128
}
135129
}
136130
}

‎buildSrc/build.gradle

+2
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@ dependencies {
9595
testImplementation 'org.mockito:mockito-core'
9696
testImplementation 'org.mockito:mockito-junit-jupiter'
9797
testImplementation libs.com.squareup.okhttp3.mockwebserver
98+
99+
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
98100
}
99101

100102

‎buildSrc/src/test/resources/samples/showcase/sgbcs-api/sgbcs-api.gradle

+2
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,7 @@ dependencies {
66
implementation 'org.springframework:spring-core'
77
testImplementation "org.junit.jupiter:junit-jupiter-api"
88
testImplementation "org.junit.jupiter:junit-jupiter-engine"
9+
10+
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
911
}
1012

‎buildSrc/src/test/resources/samples/showcase/sgbcs-core/sgbcs-core.gradle

+2
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,6 @@ dependencies {
55
optional 'ch.qos.logback:logback-classic'
66
testImplementation "org.junit.jupiter:junit-jupiter-api"
77
testImplementation "org.junit.jupiter:junit-jupiter-engine"
8+
9+
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
810
}

‎cas/spring-security-cas.gradle

+2
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,6 @@ dependencies {
2222
testImplementation "org.mockito:mockito-junit-jupiter"
2323
testImplementation "org.springframework:spring-test"
2424
testImplementation 'org.skyscreamer:jsonassert'
25+
26+
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
2527
}

‎cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java

+15
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
5252
import org.springframework.security.web.savedrequest.RequestCache;
5353
import org.springframework.security.web.savedrequest.SavedRequest;
54+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
5455
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
5556
import org.springframework.security.web.util.matcher.RequestMatcher;
5657
import org.springframework.util.Assert;
@@ -215,6 +216,8 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
215216

216217
public CasAuthenticationFilter() {
217218
super("/login/cas");
219+
RequestMatcher processUri = PathPatternRequestMatcher.withDefaults().matcher("/login/cas");
220+
setRequiresAuthenticationRequestMatcher(processUri);
218221
setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler());
219222
setSecurityContextRepository(this.securityContextRepository);
220223
}
@@ -319,6 +322,18 @@ public final void setAuthenticationFailureHandler(AuthenticationFailureHandler f
319322
super.setAuthenticationFailureHandler(new CasAuthenticationFailureHandler(failureHandler));
320323
}
321324

325+
/**
326+
* Use this {@code RequestMatcher} to match proxy receptor requests. Without setting
327+
* this matcher, {@link CasAuthenticationFilter} will not capture any proxy receptor
328+
* requets.
329+
* @param proxyReceptorMatcher the {@link RequestMatcher} to use
330+
* @since 6.5
331+
*/
332+
public final void setProxyReceptorMatcher(RequestMatcher proxyReceptorMatcher) {
333+
Assert.notNull(proxyReceptorMatcher, "proxyReceptorMatcher cannot be null");
334+
this.proxyReceptorMatcher = proxyReceptorMatcher;
335+
}
336+
322337
public final void setProxyReceptorUrl(final String proxyReceptorUrl) {
323338
this.proxyReceptorMatcher = new AntPathRequestMatcher("/**" + proxyReceptorUrl);
324339
}

‎cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java

+22-4
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
4444
import org.springframework.security.web.context.SecurityContextRepository;
4545
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
46+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
4647
import org.springframework.test.util.ReflectionTestUtils;
4748

4849
import static org.assertj.core.api.Assertions.assertThat;
@@ -78,7 +79,7 @@ public void testGettersSetters() {
7879

7980
@Test
8081
public void testNormalOperation() throws Exception {
81-
MockHttpServletRequest request = new MockHttpServletRequest();
82+
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login/cas");
8283
request.setServletPath("/login/cas");
8384
request.addParameter("ticket", "ST-0-ER94xMJmn6pha35CQRoZ");
8485
CasAuthenticationFilter filter = new CasAuthenticationFilter();
@@ -103,7 +104,7 @@ public void testRequiresAuthenticationFilterProcessUrl() {
103104
String url = "/login/cas";
104105
CasAuthenticationFilter filter = new CasAuthenticationFilter();
105106
filter.setFilterProcessesUrl(url);
106-
MockHttpServletRequest request = new MockHttpServletRequest();
107+
MockHttpServletRequest request = new MockHttpServletRequest("POST", url);
107108
MockHttpServletResponse response = new MockHttpServletResponse();
108109
request.setServletPath(url);
109110
assertThat(filter.requiresAuthentication(request, response)).isTrue();
@@ -132,10 +133,11 @@ public void testRequiresAuthenticationAuthAll() {
132133
CasAuthenticationFilter filter = new CasAuthenticationFilter();
133134
filter.setFilterProcessesUrl(url);
134135
filter.setServiceProperties(properties);
135-
MockHttpServletRequest request = new MockHttpServletRequest();
136+
MockHttpServletRequest request = new MockHttpServletRequest("POST", url);
136137
MockHttpServletResponse response = new MockHttpServletResponse();
137138
request.setServletPath(url);
138139
assertThat(filter.requiresAuthentication(request, response)).isTrue();
140+
request = new MockHttpServletRequest("POST", "/other");
139141
request.setServletPath("/other");
140142
assertThat(filter.requiresAuthentication(request, response)).isFalse();
141143
request.setParameter(properties.getArtifactParameter(), "value");
@@ -170,7 +172,7 @@ public void testDoFilterAuthenticateAll() throws Exception {
170172
given(manager.authenticate(any(Authentication.class))).willReturn(authentication);
171173
ServiceProperties serviceProperties = new ServiceProperties();
172174
serviceProperties.setAuthenticateAllArtifacts(true);
173-
MockHttpServletRequest request = new MockHttpServletRequest();
175+
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/authenticate");
174176
request.setParameter("ticket", "ST-1-123");
175177
request.setServletPath("/authenticate");
176178
MockHttpServletResponse response = new MockHttpServletResponse();
@@ -266,4 +268,20 @@ void successfulAuthenticationWhenSecurityContextHolderStrategySetThenUses() thro
266268
verify(securityContextRepository).setContext(any(SecurityContext.class));
267269
}
268270

271+
@Test
272+
public void requiresAuthenticationWhenProxyRequestMatcherThenMatches() {
273+
CasAuthenticationFilter filter = new CasAuthenticationFilter();
274+
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/pgtCallback");
275+
MockHttpServletResponse response = new MockHttpServletResponse();
276+
request.setServletPath("/pgtCallback");
277+
assertThat(filter.requiresAuthentication(request, response)).isFalse();
278+
filter.setProxyReceptorMatcher(PathPatternRequestMatcher.withDefaults().matcher(request.getServletPath()));
279+
assertThat(filter.requiresAuthentication(request, response)).isFalse();
280+
filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
281+
assertThat(filter.requiresAuthentication(request, response)).isTrue();
282+
request.setRequestURI("/other");
283+
request.setServletPath("/other");
284+
assertThat(filter.requiresAuthentication(request, response)).isFalse();
285+
}
286+
269287
}

‎config/spring-security-config.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ dependencies {
126126
testImplementation libs.org.eclipse.jetty.jetty.servlet
127127

128128
testRuntimeOnly 'org.hsqldb:hsqldb'
129+
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
129130
}
130131

131132
def rncToXsd = tasks.named('rncToXsd', RncToXsd)

‎config/src/integration-test/java/org/springframework/security/config/annotation/configurers/WebAuthnWebDriverTests.java

+1
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@
6767
*
6868
* @author Daniel Garnier-Moiroux
6969
*/
70+
@org.junit.jupiter.api.Disabled
7071
class WebAuthnWebDriverTests {
7172

7273
private String baseUrl;

0 commit comments

Comments
 (0)