From e38d4657c6a973b30b9ece360f7ea2c97fb69555 Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukasz.lenart@gmail.com>
Date: Fri, 4 Sep 2015 09:04:37 +0200
Subject: [PATCH] Adds support to define allowed methods as regex

---
 .../xwork2/config/entities/ActionConfig.java  |  1 +
 .../config/entities/AllowedMethods.java       |  5 ++++-
 .../providers/XmlConfigurationProvider.java   | 22 ++++++++++++-------
 3 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/core/src/main/java/com/opensymphony/xwork2/config/entities/ActionConfig.java b/core/src/main/java/com/opensymphony/xwork2/config/entities/ActionConfig.java
index 5303e8395..7c10c9099 100644
--- a/core/src/main/java/com/opensymphony/xwork2/config/entities/ActionConfig.java
+++ b/core/src/main/java/com/opensymphony/xwork2/config/entities/ActionConfig.java
@@ -43,6 +43,7 @@ public class ActionConfig extends Located implements Serializable {
 
     public static final String DEFAULT_METHOD = "execute";
     public static final String WILDCARD = "*";
+    public static final String REGEX_WILDCARD = "regex:.*";
 
     protected List<InterceptorMapping> interceptors; // a list of interceptorMapping Objects eg. List<InterceptorMapping>
     protected Map<String,String> params;
diff --git a/core/src/main/java/com/opensymphony/xwork2/config/entities/AllowedMethods.java b/core/src/main/java/com/opensymphony/xwork2/config/entities/AllowedMethods.java
index 7a4fec1b8..f619d890e 100644
--- a/core/src/main/java/com/opensymphony/xwork2/config/entities/AllowedMethods.java
+++ b/core/src/main/java/com/opensymphony/xwork2/config/entities/AllowedMethods.java
@@ -32,8 +32,11 @@ public class AllowedMethods {
                 ret.append(c);
             }
         }
-        if (isPattern) {
+        if (isPattern && !method.startsWith("regex:")) {
             return new PatternAllowedMethod(ret.toString(), method);
+        } else if (method.startsWith("regex:")) {
+            String pattern = method.substring(method.indexOf(":") + 1);
+            return new PatternAllowedMethod(pattern, method);
         } else {
             return new LiteralAllowedMethod(ret.toString());
         }
diff --git a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java
index 3009dcbca..950d4a12b 100644
--- a/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java
+++ b/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java
@@ -845,17 +845,23 @@ public class XmlConfigurationProvider implements ConfigurationProvider {
     protected Set<String> buildAllowedMethods(Element element, PackageConfig.Builder packageContext) {
         NodeList allowedMethodsEls = element.getElementsByTagName("allowed-methods");
 
-        Set<String> allowedMethods = packageContext.getGlobalAllowedMethods();
+        Set<String> allowedMethods;
+        if (packageContext.isStrictMethodInvocation()) {
+            allowedMethods = packageContext.getGlobalAllowedMethods();
 
-        if (allowedMethodsEls.getLength() > 0) {
-            allowedMethods = new HashSet<>();
-            Node n = allowedMethodsEls.item(0).getFirstChild();
-            if (n != null) {
-                String s = n.getNodeValue().trim();
-                if (s.length() > 0) {
-                    allowedMethods = TextParseUtil.commaDelimitedStringToSet(s);
+            if (allowedMethodsEls.getLength() > 0) {
+                allowedMethods = new HashSet<>();
+                Node n = allowedMethodsEls.item(0).getFirstChild();
+                if (n != null) {
+                    String s = n.getNodeValue().trim();
+                    if (s.length() > 0) {
+                        allowedMethods = TextParseUtil.commaDelimitedStringToSet(s);
+                    }
                 }
             }
+        } else {
+            allowedMethods = new HashSet<>();
+            allowedMethods.add(ActionConfig.REGEX_WILDCARD);
         }
 
         return allowedMethods;