lookupAttributes(String url) of PathBasedFilterInvocationDefinitionMap
Hi there,
It seems to me that the method lookupAttributes is logically flawed.
Given the following source code of lookUpAttributes() from PathBasedFilterInvocationDefinitionMap:
Code:
public ConfigAttributeDefinition lookupAttributes(String url) {
// Strip anything after a question mark symbol, as per SEC-161. See also SEC-321
int firstQuestionMarkIndex = url.indexOf("?");
if (firstQuestionMarkIndex != -1) {
url = url.substring(0, firstQuestionMarkIndex);
}
if (isConvertUrlToLowercaseBeforeComparison()) {
url = url.toLowerCase();
if (logger.isDebugEnabled()) {
logger.debug("Converted URL to lowercase, from: '" + url + "'; to: '" + url + "'");
}
}
Iterator iter = requestMap.iterator();
while (iter.hasNext()) {
EntryHolder entryHolder = (EntryHolder) iter.next();
boolean matched = pathMatcher.match(entryHolder.getAntPath(), url);
if (logger.isDebugEnabled()) {
logger.debug("Candidate is: '" + url + "'; pattern is " + entryHolder.getAntPath() + "; matched="
+ matched);
}
if (matched) {
return entryHolder.getConfigAttributeDefinition();
}
}
return null;
}
Assuming that the value of parameter url is "/index.jsp", and the iterator loops through each of the entry holder comparing the ant path from the entry holder against the url parameter.
What happens if a given entry holder ant path "/**" is evaluated after entry holder ant path "/index.jsp"? Assuming that authentication has taken place, [User: User1 Role: ROLE_TEST] and ROLE TEST is given rights to "/**" only.
This means that if the current entry holder ant path in the iterator loop evaluates "/index.jsp" first, the local variable matched will be true since there's a pattern matching. But I will be denied access from accessing "/index.jsp" because it has no authorities.
Therefore, RoleVoter will return ACCESS_DENIED after voting whereas it should return ACCESS_GRANTED. ACCESS_DENIED because "/index.jsp" is evaluated first before "/**".
In order to correct this, I had to extend from PathBasedFilterInvocationDefinitionMap, overload lookupAttributes() and loop through a list of sorted keys of requestMap where "/**" will be evaluated first.
Am I doing this right way? Should I even extend from PathBasedFilterInvocationDefinitionMap in the first place?
Regards
