SEC-2059: Support Path Variables in Web Expressions

web/src/main/java/org/springframework/security/web/access/expression/ExpressionBasedFilterInvocationSecurityMetadataSource.java

@@ -13,6 +13,7 @@ import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.expression.SecurityExpressionHandler;
 import org.springframework.security.web.FilterInvocation;
 import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 
@@ -53,9 +54,14 @@ public final class ExpressionBasedFilterInvocationSecurityMetadataSource extends
 					.getAttribute();
 			logger.debug("Adding web access control expression '" + expression
 					+ "', for " + request);
+
+			String pattern = null;
+			if(request instanceof AntPathRequestMatcher) {
+				pattern = ((AntPathRequestMatcher)request).getPattern();
+			}
 			try {
 				attributes.add(new WebExpressionConfigAttribute(parser
-						.parseExpression(expression)));
+						.parseExpression(expression), new PathVariableSecurityEvaluationContextPostProcessor(pattern)));
 			}
 			catch (ParseException e) {
 				throw new IllegalArgumentException("Failed to parse expression '"

web/src/main/java/org/springframework/security/web/access/expression/PathVariableSecurityEvaluationContextPostProcessor.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.access.expression;
+
+import java.util.Map;
+
+import org.springframework.expression.EvaluationContext;
+import org.springframework.security.web.FilterInvocation;
+import org.springframework.util.AntPathMatcher;
+import org.springframework.util.PathMatcher;
+
+/**
+ * Exposes URI template variables as variables on the {@link EvaluationContext}.
+ * For example, the pattern "/user/{username}/**" would expose a variable named
+ * username based on the current URI.
+ *
+ * <p>
+ * NOTE: This API is intentionally kept package scope as it may change in the future. It may be nice to allow users to augment expressions and queries
+ * </p>
+ *
+ * @author Rob Winch
+ * @since 4.1
+ */
+class PathVariableSecurityEvaluationContextPostProcessor implements SecurityEvaluationContextPostProcessor<FilterInvocation> {
+	private final PathMatcher matcher = new AntPathMatcher();
+	private final String antPattern;
+
+	/**
+	 * Creates a new instance.
+	 *
+	 * @param antPattern the ant pattern that may have template variables (i.e. "/user/{username}/**)
+	 */
+	public PathVariableSecurityEvaluationContextPostProcessor(String antPattern) {
+		this.antPattern = antPattern;
+	}
+
+	public EvaluationContext postProcess(EvaluationContext context, FilterInvocation invocation) {
+		if(antPattern == null) {
+			return context;
+		}
+		Map<String, String> variables = matcher.extractUriTemplateVariables(antPattern, invocation.getRequestUrl());
+		for(Map.Entry<String, String> entry : variables.entrySet()) {
+			context.setVariable(entry.getKey(), entry.getValue());
+		}
+		return context;
+	}
+
+}

web/src/main/java/org/springframework/security/web/access/expression/SecurityEvaluationContextPostProcessor.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.access.expression;
+
+import org.springframework.expression.EvaluationContext;
+/**
+ *
+/**
+ * Allows post processing the {@link EvaluationContext}
+ *
+ * <p>
+ * This API is intentionally kept package scope as it may evolve over time.
+ * </p>
+ *
+ * @author Rob Winch
+ * @since 4.1
+ * @param <I> the invocation to use for post processing
+ */
+interface SecurityEvaluationContextPostProcessor<I> {
+
+	/**
+	 * Allows post processing of the {@link EvaluationContext}. Implementations
+	 * may return a new instance of {@link EvaluationContext} or modify the
+	 * {@link EvaluationContext} that was passed in.
+	 *
+	 * @param context
+	 *            the original {@link EvaluationContext}
+	 * @param invocation
+	 *            the security invocation object (i.e. FilterInvocation)
+	 * @return the upated context.
+	 */
+	EvaluationContext postProcess(EvaluationContext context, I invocation);
+}

web/src/main/java/org/springframework/security/web/access/expression/WebExpressionConfigAttribute.java

@@ -1,7 +1,9 @@
 package org.springframework.security.web.access.expression;
 
+import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.Expression;
 import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.web.FilterInvocation;
 
 /**
  * Simple expression configuration attribute for use in web request authorizations.
@@ -9,17 +11,23 @@ import org.springframework.security.access.ConfigAttribute;
  * @author Luke Taylor
  * @since 3.0
  */
-class WebExpressionConfigAttribute implements ConfigAttribute {
+class WebExpressionConfigAttribute implements ConfigAttribute, SecurityEvaluationContextPostProcessor<FilterInvocation> {
 	private final Expression authorizeExpression;
+	private final SecurityEvaluationContextPostProcessor<FilterInvocation> postProcessor;
 
-	public WebExpressionConfigAttribute(Expression authorizeExpression) {
+	public WebExpressionConfigAttribute(Expression authorizeExpression, SecurityEvaluationContextPostProcessor<FilterInvocation> postProcessor) {
 		this.authorizeExpression = authorizeExpression;
+		this.postProcessor = postProcessor;
 	}
 
 	Expression getAuthorizeExpression() {
 		return authorizeExpression;
 	}
 
+	public EvaluationContext postProcess(EvaluationContext context, FilterInvocation fi) {
+		return postProcessor.postProcess(context, fi);
+	}
+
 	public String getAttribute() {
 		return null;
 	}

web/src/main/java/org/springframework/security/web/access/expression/WebExpressionVoter.java

@@ -1,6 +1,7 @@
 package org.springframework.security.web.access.expression;
 
 import java.util.Collection;
+import java.util.Map;
 
 import org.springframework.expression.EvaluationContext;
 import org.springframework.security.access.AccessDecisionVoter;
@@ -9,6 +10,7 @@ import org.springframework.security.access.expression.ExpressionUtils;
 import org.springframework.security.access.expression.SecurityExpressionHandler;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;
+import org.springframework.util.AntPathMatcher;
 
 /**
  * Voter which handles web authorisation decisions.
@@ -32,6 +34,7 @@ public class WebExpressionVoter implements AccessDecisionVoter<FilterInvocation>
 
 		EvaluationContext ctx = expressionHandler.createEvaluationContext(authentication,
 				fi);
+		ctx = weca.postProcess(ctx, fi);
 
 		return ExpressionUtils.evaluateAsBoolean(weca.getAuthorizeExpression(), ctx) ? ACCESS_GRANTED
 				: ACCESS_DENIED;

web/src/test/java/org/springframework/security/web/access/expression/WebExpressionVoterTests.java

@@ -4,11 +4,12 @@ import static org.fest.assertions.Assertions.*;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.*;
 
 import org.aopalliance.intercept.MethodInvocation;
 import org.junit.Test;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.stubbing.Answer;
 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.Expression;
 import org.springframework.security.access.AccessDecisionVoter;
@@ -35,7 +36,7 @@ public class WebExpressionVoterTests {
 	public void supportsWebConfigAttributeAndFilterInvocation() throws Exception {
 		WebExpressionVoter voter = new WebExpressionVoter();
 		assertTrue(voter
-				.supports(new WebExpressionConfigAttribute(mock(Expression.class))));
+				.supports(new WebExpressionConfigAttribute(mock(Expression.class), mock(SecurityEvaluationContextPostProcessor.class))));
 		assertTrue(voter.supports(FilterInvocation.class));
 		assertFalse(voter.supports(MethodInvocation.class));
 
@@ -54,7 +55,13 @@ public class WebExpressionVoterTests {
 	public void grantsAccessIfExpressionIsTrueDeniesIfFalse() {
 		WebExpressionVoter voter = new WebExpressionVoter();
 		Expression ex = mock(Expression.class);
-		WebExpressionConfigAttribute weca = new WebExpressionConfigAttribute(ex);
+		SecurityEvaluationContextPostProcessor postProcessor = mock(SecurityEvaluationContextPostProcessor.class);
+		when(postProcessor.postProcess(any(EvaluationContext.class), any(FilterInvocation.class))).thenAnswer(new Answer<EvaluationContext>() {
+			public EvaluationContext answer(InvocationOnMock invocation) throws Throwable {
+				return invocation.getArgumentAt(0, EvaluationContext.class);
+			}
+		});
+		WebExpressionConfigAttribute weca = new WebExpressionConfigAttribute(ex,postProcessor);
 		EvaluationContext ctx = mock(EvaluationContext.class);
 		SecurityExpressionHandler eh = mock(SecurityExpressionHandler.class);
 		FilterInvocation fi = new FilterInvocation("/path", "GET");