Examples with AntPathRequestMatcher org.springframework.security.web.util.matcher.AntPathRequestMatcher used on opensource projects

Example 1 with AntPathRequestMatcher

use of org.springframework.security.web.util.matcher.AntPathRequestMatcher in project spring-security by spring-projects.

the class RequestCacheConfigurer method createDefaultSavedRequestMatcher.

@SuppressWarnings("unchecked")
private RequestMatcher createDefaultSavedRequestMatcher(H http) {
    ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
    if (contentNegotiationStrategy == null) {
        contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
    }
    RequestMatcher notFavIcon = new NegatedRequestMatcher(new AntPathRequestMatcher("/**/favicon.ico"));
    MediaTypeRequestMatcher jsonRequest = new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.APPLICATION_JSON);
    jsonRequest.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
    RequestMatcher notJson = new NegatedRequestMatcher(jsonRequest);
    RequestMatcher notXRequestedWith = new NegatedRequestMatcher(new RequestHeaderRequestMatcher("X-Requested-With", "XMLHttpRequest"));
    boolean isCsrfEnabled = http.getConfigurer(CsrfConfigurer.class) != null;
    List<RequestMatcher> matchers = new ArrayList<RequestMatcher>();
    if (isCsrfEnabled) {
        RequestMatcher getRequests = new AntPathRequestMatcher("/**", "GET");
        matchers.add(0, getRequests);
    }
    matchers.add(notFavIcon);
    matchers.add(notJson);
    matchers.add(notXRequestedWith);
    return new AndRequestMatcher(matchers);
}

Example 2 with AntPathRequestMatcher

use of org.springframework.security.web.util.matcher.AntPathRequestMatcher in project spring-security by spring-projects.

the class DefaultFilterInvocationSecurityMetadataSourceTests method mixingPatternsWithAndWithoutHttpMethodsIsSupported.

// SEC-1236
@Test
public void mixingPatternsWithAndWithoutHttpMethodsIsSupported() throws Exception {
    LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>>();
    Collection<ConfigAttribute> userAttrs = SecurityConfig.createList("A");
    requestMap.put(new AntPathRequestMatcher("/user/**", null), userAttrs);
    requestMap.put(new AntPathRequestMatcher("/teller/**", "GET"), SecurityConfig.createList("B"));
    this.fids = new DefaultFilterInvocationSecurityMetadataSource(requestMap);
    FilterInvocation fi = createFilterInvocation("/user", null, null, "GET");
    Collection<ConfigAttribute> attrs = this.fids.getAttributes(fi);
    assertThat(attrs).isEqualTo(userAttrs);
}

Example 3 with AntPathRequestMatcher

use of org.springframework.security.web.util.matcher.AntPathRequestMatcher in project spring-security by spring-projects.

the class DefaultFilterInvocationSecurityMetadataSourceTests method createFids.

// ~ Methods
// ========================================================================================================
private void createFids(String pattern, String method) {
    LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>>();
    requestMap.put(new AntPathRequestMatcher(pattern, method), this.def);
    this.fids = new DefaultFilterInvocationSecurityMetadataSource(requestMap);
}

Example 4 with AntPathRequestMatcher

use of org.springframework.security.web.util.matcher.AntPathRequestMatcher in project midpoint by Evolveum.

the class MidPointGuiAuthorizationEvaluator method addSecurityConfig.

private void addSecurityConfig(FilterInvocation filterInvocation, Collection<ConfigAttribute> guiConfigAttr, String url, DisplayableValue<String>[] actions) {
    AntPathRequestMatcher matcher = new AntPathRequestMatcher(url);
    if (!matcher.matches(filterInvocation.getRequest()) || actions == null) {
        return;
    }
    for (DisplayableValue<String> action : actions) {
        String actionUri = action.getValue();
        if (StringUtils.isBlank(actionUri)) {
            continue;
        }
        //all users has permission to access these resources
        if (action.equals(AuthorizationConstants.AUTZ_UI_PERMIT_ALL_URL)) {
            return;
        }
        SecurityConfig config = new SecurityConfig(actionUri);
        if (!guiConfigAttr.contains(config)) {
            guiConfigAttr.add(config);
        }
    }
}