Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve regex "." matching for URL paths #28815

Closed
rstoyanchev opened this issue Jul 13, 2022 · 0 comments
Closed

Improve regex "." matching for URL paths #28815

rstoyanchev opened this issue Jul 13, 2022 · 0 comments
Assignees
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement
Milestone

Comments

@rstoyanchev
Copy link
Contributor

AntPathMatcher and PathPattern support regex expressions but do not use the DOTALL option to ignore newline characters in URL paths. We should enable use of that to make path matching more predictable.

Note that this could create a mismatch in path matching between a security layer and Spring MVC or WebFlux, but such a security layer needs to address issues even more broadly, along the lines of Spring Security's MvcRequestMatcher which guarantees alignment with Spring MVC path matching. In addition, Spring Security's firewall rejects newlines and other problematic characters in URL paths to begin with.

We should also update the documentation to provide guidance around this and for example discourage use of HandlerInterceptor for security, or even a Filter, in favor of Spring Security, or otherwise use a path matching approach similar to that of Spring Security.

This issue is based on a report by @4ra1n.

@rstoyanchev rstoyanchev added in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement labels Jul 13, 2022
@rstoyanchev rstoyanchev added this to the 5.3.22 milestone Jul 13, 2022
@rstoyanchev rstoyanchev self-assigned this Jul 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement
Projects
None yet
Development

No branches or pull requests

1 participant