SEC-2827: Clean up MessageMatcher Ambiguities

2026-08-04 17:27:13 +00:00 · 2015-01-23 17:23:29 -06:00
parent b97a5d3b53
commit 414f98bee0
4 changed files with 262 additions and 60 deletions
@@ -57,13 +57,23 @@ public class MessageSecurityMetadataSourceRegistry {
        return matchers(MessageMatcher.ANY_MESSAGE);
    }

+    /**
+     * Maps any {@link Message} that has a null SimpMessageHeaderAccessor destination header (i.e. CONNECT,
+     * CONNECT_ACK, HEARTBEAT, UNSUBSCRIBE, DISCONNECT, DISCONNECT_ACK, OTHER)
+     *
+     * @return the Expression to associate
+     */
+    public Constraint nullDestMatcher() {
+        return matchers(SimpDestinationMessageMatcher.NULL_DESTINATION_MATCHER);
+    }
+
    /**
     * Maps a {@link List} of {@link SimpDestinationMessageMatcher} instances.
     *
     * @param typesToMatch the {@link SimpMessageType} instance to match on
     * @return the {@link Constraint} associated to the matchers.
     */
-    public Constraint typeMatchers(SimpMessageType... typesToMatch) {
+    public Constraint simpTypeMatchers(SimpMessageType... typesToMatch) {
        MessageMatcher<?>[] typeMatchers = new MessageMatcher<?>[typesToMatch.length];
        for (int i = 0; i < typesToMatch.length; i++) {
            SimpMessageType typeToMatch = typesToMatch[i];
@@ -81,15 +91,45 @@ public class MessageSecurityMetadataSourceRegistry {
     *            the patterns to create
     *            {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher}
     *            from. Uses
-     *            {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}
+     *            {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}
     *            .
     *
     * @return the {@link Constraint} that is associated to the
     *         {@link MessageMatcher}
-     * @see {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}
+     * @see {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}
     */
-    public Constraint antMatchers(String... patterns) {
-        return antMatchers(null, patterns);
+    public Constraint simpDestMatchers(String... patterns) {
+        return simpDestMatchers(null, patterns);
+    }
+
+    /**
+     * Maps a {@link List} of {@link SimpDestinationMessageMatcher} instances that match on {@code SimpMessageType.MESSAGE}.
+     * If no destination is found on the Message, then the Matcher returns
+     * false.
+     *
+     * @param patterns the patterns to create {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher}
+     *                    from. Uses {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}.
+     *
+     * @return the {@link Constraint}  that is associated to the {@link MessageMatcher}
+     * @see {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}
+     */
+    public Constraint simpDestMessageMatchers(String... patterns) {
+        return simpDestMatchers(SimpMessageType.MESSAGE, patterns);
+    }
+
+    /**
+     * Maps a {@link List} of {@link SimpDestinationMessageMatcher} instances that match on {@code SimpMessageType.SUBSCRIBE}.
+     * If no destination is found on the Message, then the Matcher returns
+     * false.
+     *
+     * @param patterns the patterns to create {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher}
+     *                    from. Uses {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}.
+     *
+     * @return the {@link Constraint}  that is associated to the {@link MessageMatcher}
+     * @see {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}
+     */
+    public Constraint simpDestSubscribeMatchers(String... patterns) {
+        return simpDestMatchers(SimpMessageType.SUBSCRIBE, patterns);
    }

    /**
@@ -99,12 +139,12 @@ public class MessageSecurityMetadataSourceRegistry {
     *
     * @param type the {@link SimpMessageType} to match on. If null, the {@link SimpMessageType} is not considered for matching.
     * @param patterns the patterns to create {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher}
-     *                    from. Uses {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}.
+     *                    from. Uses {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}.
     *
     * @return the {@link Constraint}  that is associated to the {@link MessageMatcher}
-     * @see {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}
+     * @see {@link MessageSecurityMetadataSourceRegistry#simpDestPathMatcher(PathMatcher)}
     */
-    public Constraint antMatchers(SimpMessageType type, String... patterns) {
+    private Constraint simpDestMatchers(SimpMessageType type, String... patterns) {
        List<MatcherBuilder> matchers = new ArrayList<MatcherBuilder>(patterns.length);
        for(String pattern : patterns) {
            matchers.add(new PathMatcherMessageMatcherBuilder(pattern, type));
@@ -113,13 +153,13 @@ public class MessageSecurityMetadataSourceRegistry {
    }

    /**
-     * The {@link PathMatcher} to be used with the {@link MessageSecurityMetadataSourceRegistry#antMatchers(String...)}.
+     * The {@link PathMatcher} to be used with the {@link MessageSecurityMetadataSourceRegistry#simpDestMatchers(String...)}.
     * The default is to use the default constructor of {@link AntPathMatcher}.
     *
     * @param pathMatcher the {@link PathMatcher} to use. Cannot be null.
     * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization.
     */
-    public MessageSecurityMetadataSourceRegistry pathMatcher(PathMatcher pathMatcher) {
+    public MessageSecurityMetadataSourceRegistry simpDestPathMatcher(PathMatcher pathMatcher) {
        Assert.notNull(pathMatcher, "pathMatcher cannot be null");
        this.pathMatcher = pathMatcher;
        return this;
@@ -344,7 +384,14 @@ public class MessageSecurityMetadataSourceRegistry {
        }

        public MessageMatcher<?> build() {
-            return new SimpDestinationMessageMatcher(pattern, type, pathMatcher);
+            if(type == null) {
+                return new SimpDestinationMessageMatcher(pattern, pathMatcher);
+            } else if(SimpMessageType.MESSAGE == type) {
+                return SimpDestinationMessageMatcher.createMessageMatcher(pattern, pathMatcher);
+            } else if(SimpMessageType.SUBSCRIBE == type) {
+                return SimpDestinationMessageMatcher.createSubscribeMatcher(pattern, pathMatcher);
+            }
+            throw new IllegalStateException(type + " is not supported since it does not have a destination");
        }
    }

@@ -22,6 +22,7 @@ import org.mockito.Mock;
 import org.mockito.runners.MockitoJUnitRunner;
 import org.springframework.messaging.Message;
 import org.springframework.messaging.simp.SimpMessageHeaderAccessor;
+import org.springframework.messaging.simp.SimpMessageType;
 import org.springframework.messaging.support.MessageBuilder;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.messaging.access.intercept.MessageSecurityMetadataSource;
@@ -48,20 +49,21 @@ public class MessageSecurityMetadataSourceRegistryTests {
        message = MessageBuilder
                .withPayload("Hi")
                .setHeader(SimpMessageHeaderAccessor.DESTINATION_HEADER, "location")
-                   .build();
+                .setHeader(SimpMessageHeaderAccessor.MESSAGE_TYPE_HEADER, SimpMessageType.MESSAGE)
+                .build();
    }

    // See https://github.com/spring-projects/spring-security/commit/3f30529039c76facf335d6ca69d18d8ae287f3f9#commitcomment-7412712
    // https://jira.spring.io/browse/SPR-11660
    @Test
-    public void destinationMatcherCustom() {
+    public void simpDestMatchersCustom() {
        message = MessageBuilder
                .withPayload("Hi")
                .setHeader(SimpMessageHeaderAccessor.DESTINATION_HEADER, "price.stock.1.2")
                .build();
        messages
-                .pathMatcher(new AntPathMatcher("."))
-                .antMatchers("price.stock.*").permitAll();
+                .simpDestPathMatcher(new AntPathMatcher("."))
+                .simpDestMatchers("price.stock.*").permitAll();

        assertThat(getAttribute()).isNull();

@@ -70,21 +72,21 @@ public class MessageSecurityMetadataSourceRegistryTests {
                .setHeader(SimpMessageHeaderAccessor.DESTINATION_HEADER, "price.stock.1.2")
                .build();
        messages
-                .pathMatcher(new AntPathMatcher("."))
-                .antMatchers("price.stock.**").permitAll();
+                .simpDestPathMatcher(new AntPathMatcher("."))
+                .simpDestMatchers("price.stock.**").permitAll();

        assertThat(getAttribute()).isEqualTo("permitAll");
    }

    @Test
-    public void destinationMatcherCustomSetAfterMatchersDoesNotMatter() {
+    public void simpDestMatchersCustomSetAfterMatchersDoesNotMatter() {
        message = MessageBuilder
                .withPayload("Hi")
                .setHeader(SimpMessageHeaderAccessor.DESTINATION_HEADER, "price.stock.1.2")
                .build();
        messages
-                .antMatchers("price.stock.*").permitAll()
-                .pathMatcher(new AntPathMatcher("."));
+                .simpDestMatchers("price.stock.*").permitAll()
+                .simpDestPathMatcher(new AntPathMatcher("."));

        assertThat(getAttribute()).isNull();

@@ -93,14 +95,15 @@ public class MessageSecurityMetadataSourceRegistryTests {
                .setHeader(SimpMessageHeaderAccessor.DESTINATION_HEADER, "price.stock.1.2")
                .build();
        messages
-                .antMatchers("price.stock.**").permitAll()
-                .pathMatcher(new AntPathMatcher("."));
+                .simpDestMatchers("price.stock.**").permitAll()
+                .simpDestPathMatcher(new AntPathMatcher("."));

        assertThat(getAttribute()).isEqualTo("permitAll");
    }
+
    @Test(expected = IllegalArgumentException.class)
    public void pathMatcherNull() {
-        messages.pathMatcher(null);
+        messages.simpDestPathMatcher(null);
    }

    @Test
@@ -121,104 +124,203 @@ public class MessageSecurityMetadataSourceRegistryTests {
    }

    @Test
-    public void destinationMatcherExact() {
+    public void simpDestMatchersExact() {
        messages
-                .antMatchers("location").permitAll();
+                .simpDestMatchers("location").permitAll();

        assertThat(getAttribute()).isEqualTo("permitAll");
    }

    @Test
-    public void destinationMatcherMulti() {
+    public void simpDestMatchersMulti() {
        messages
-                .antMatchers("admin/**","api/**").hasRole("ADMIN")
-                .antMatchers("location").permitAll();
+                .simpDestMatchers("admin/**","api/**").hasRole("ADMIN")
+                .simpDestMatchers("location").permitAll();

        assertThat(getAttribute()).isEqualTo("permitAll");
    }

    @Test
-    public void destinationMatcherRole() {
+    public void simpDestMatchersRole() {
        messages
-                .antMatchers("admin/**","location/**").hasRole("ADMIN")
+                .simpDestMatchers("admin/**","location/**").hasRole("ADMIN")
                .anyMessage().denyAll();

        assertThat(getAttribute()).isEqualTo("hasRole('ROLE_ADMIN')");
    }

    @Test
-    public void destinationMatcherAnyRole() {
+    public void simpDestMatchersAnyRole() {
        messages
-                .antMatchers("admin/**","location/**").hasAnyRole("ADMIN", "ROOT")
+                .simpDestMatchers("admin/**","location/**").hasAnyRole("ADMIN", "ROOT")
                .anyMessage().denyAll();

        assertThat(getAttribute()).isEqualTo("hasAnyRole('ROLE_ADMIN','ROLE_ROOT')");
    }

    @Test
-    public void destinationMatcherAuthority() {
+    public void simpDestMatchersAuthority() {
        messages
-                .antMatchers("admin/**","location/**").hasAuthority("ROLE_ADMIN")
+                .simpDestMatchers("admin/**","location/**").hasAuthority("ROLE_ADMIN")
                .anyMessage().fullyAuthenticated();

        assertThat(getAttribute()).isEqualTo("hasAuthority('ROLE_ADMIN')");
    }

    @Test
-    public void destinationMatcherAccess() {
+    public void simpDestMatchersAccess() {
        String expected = "hasRole('ROLE_ADMIN') and fullyAuthenticated";
        messages
-                .antMatchers("admin/**","location/**").access(expected)
+                .simpDestMatchers("admin/**","location/**").access(expected)
                .anyMessage().denyAll();

        assertThat(getAttribute()).isEqualTo(expected);
    }

    @Test
-    public void destinationMatcherAnyAuthority() {
+    public void simpDestMatchersAnyAuthority() {
        messages
-                .antMatchers("admin/**","location/**").hasAnyAuthority("ROLE_ADMIN", "ROLE_ROOT")
+                .simpDestMatchers("admin/**","location/**").hasAnyAuthority("ROLE_ADMIN", "ROLE_ROOT")
                .anyMessage().denyAll();

        assertThat(getAttribute()).isEqualTo("hasAnyAuthority('ROLE_ADMIN','ROLE_ROOT')");
    }

    @Test
-    public void destinationMatcherRememberMe() {
+    public void simpDestMatchersRememberMe() {
        messages
-                .antMatchers("admin/**","location/**").rememberMe()
+                .simpDestMatchers("admin/**","location/**").rememberMe()
                .anyMessage().denyAll();

        assertThat(getAttribute()).isEqualTo("rememberMe");
    }

    @Test
-    public void destinationMatcherAnonymous() {
+    public void simpDestMatchersAnonymous() {
        messages
-                .antMatchers("admin/**","location/**").anonymous()
+                .simpDestMatchers("admin/**","location/**").anonymous()
                .anyMessage().denyAll();

        assertThat(getAttribute()).isEqualTo("anonymous");
    }

    @Test
-    public void destinationMatcherFullyAuthenticated() {
+    public void simpDestMatchersFullyAuthenticated() {
        messages
-                .antMatchers("admin/**","location/**").fullyAuthenticated()
+                .simpDestMatchers("admin/**","location/**").fullyAuthenticated()
                .anyMessage().denyAll();

        assertThat(getAttribute()).isEqualTo("fullyAuthenticated");
    }

    @Test
-    public void destinationMatcherDenyAll() {
+    public void simpDestMatchersDenyAll() {
        messages
-                .antMatchers("admin/**","location/**").denyAll()
+                .simpDestMatchers("admin/**","location/**").denyAll()
                .anyMessage().permitAll();

        assertThat(getAttribute()).isEqualTo("denyAll");
    }

+    @Test
+    public void simpDestMessageMatchersNotMatch() {
+        messages
+                .simpDestMessageMatchers("admin/**").denyAll()
+                .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("permitAll");
+    }
+
+    @Test
+    public void simpDestMessageMatchersMatch() {
+        messages
+                .simpDestMessageMatchers("location/**").denyAll()
+                .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("denyAll");
+    }
+
+    @Test
+    public void simpDestSubscribeMatchersNotMatch() {
+        messages
+                .simpDestSubscribeMatchers("location/**").denyAll()
+                .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("permitAll");
+    }
+
+    @Test
+    public void simpDestSubscribeMatchersMatch() {
+        message = MessageBuilder.fromMessage(message)
+                    .setHeader(SimpMessageHeaderAccessor.MESSAGE_TYPE_HEADER, SimpMessageType.SUBSCRIBE)
+                    .build();
+
+        messages
+                .simpDestSubscribeMatchers("location/**").denyAll()
+                .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("denyAll");
+    }
+
+    @Test
+    public void nullDestMatcherNotMatches() {
+         messages
+             .nullDestMatcher().denyAll()
+             .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("permitAll");
+    }
+
+    @Test
+    public void nullDestMatcherMatch() {
+        message = MessageBuilder
+                .withPayload("Hi")
+                .setHeader(SimpMessageHeaderAccessor.MESSAGE_TYPE_HEADER, SimpMessageType.CONNECT)
+                .build();
+
+         messages
+             .nullDestMatcher().denyAll()
+             .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("denyAll");
+    }
+
+    @Test
+    public void simpTypeMatchersMatch() {
+         messages
+             .simpTypeMatchers(SimpMessageType.MESSAGE).denyAll()
+             .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("denyAll");
+    }
+
+    @Test
+    public void simpTypeMatchersMatchMulti() {
+         messages
+             .simpTypeMatchers(SimpMessageType.CONNECT, SimpMessageType.MESSAGE).denyAll()
+             .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("denyAll");
+    }
+
+    @Test
+    public void simpTypeMatchersNotMatch() {
+         messages
+             .simpTypeMatchers(SimpMessageType.CONNECT).denyAll()
+             .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("permitAll");
+    }
+
+    @Test
+    public void simpTypeMatchersNotMatchMulti() {
+         messages
+             .simpTypeMatchers(SimpMessageType.CONNECT, SimpMessageType.DISCONNECT).denyAll()
+             .anyMessage().permitAll();
+
+        assertThat(getAttribute()).isEqualTo("permitAll");
+    }
+
    private String getAttribute() {
        MessageSecurityMetadataSource source = messages.createMetadataSource();
        Collection<ConfigAttribute> attrs = source.getAttributes(message);