From 0d2a0d7b9e2da7fff7373a7fe1b79e8f750b9073 Mon Sep 17 00:00:00 2001
From: Brian Clozel <brian.clozel@broadcom.com>
Date: Mon, 18 Aug 2025 10:44:15 +0200
Subject: [PATCH] Fix '**' parsing within a PathPattern segment

Prior to this commit, a regexp path segment ending with a double wilcard
(like "/path**") would be incorrectly parsed as a double wildcard
segment ("/**").

This commit fixes the incorrect parsing.

Fixes gh-35339
---
 .../web/util/pattern/InternalPathPatternParser.java  | 12 ++++++++++--
 .../web/util/pattern/PathPatternParserTests.java     |  7 ++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/spring-web/src/main/java/org/springframework/web/util/pattern/InternalPathPatternParser.java b/spring-web/src/main/java/org/springframework/web/util/pattern/InternalPathPatternParser.java
index 7011545ed3f..3906e72bd59 100644
--- a/spring-web/src/main/java/org/springframework/web/util/pattern/InternalPathPatternParser.java
+++ b/spring-web/src/main/java/org/springframework/web/util/pattern/InternalPathPatternParser.java
@@ -234,14 +234,22 @@ class InternalPathPatternParser {
 	}
 
 	private boolean isDoubleWildcard(char separator) {
+		// next char is present
 		if ((this.pos + 1) >= this.pathPatternLength) {
 			return false;
 		}
+		// current char and next char are '*'
 		if (this.pathPatternData[this.pos] != '*' || this.pathPatternData[this.pos + 1] != '*') {
 			return false;
 		}
-		if ((this.pos + 2) < this.pathPatternLength) {
-			return this.pathPatternData[this.pos + 2] == separator;
+		// previous char is a separator, if any
+		if ((this.pos - 1 >= 0) && (this.pathPatternData[this.pos - 1] != separator)) {
+			return false;
+		}
+		// next char is a separator, if any
+		if (((this.pos + 2) < this.pathPatternLength) &&
+				this.pathPatternData[this.pos + 2] != separator) {
+			return false;
 		}
 		return true;
 	}
diff --git a/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternParserTests.java b/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternParserTests.java
index 99c3db01549..e70fe5e8328 100644
--- a/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternParserTests.java
+++ b/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternParserTests.java
@@ -85,9 +85,14 @@ class PathPatternParserTests {
 
 		@Test
 		void regexpSegmentIsNotWildcardSegment() {
-			// this is not double wildcard, it's / then **acb (an odd, unnecessary use of double *)
 			pathPattern = checkStructure("/**acb");
 			assertPathElements(pathPattern, SeparatorPathElement.class, RegexPathElement.class);
+
+			pathPattern = checkStructure("/a**bc");
+			assertPathElements(pathPattern, SeparatorPathElement.class, RegexPathElement.class);
+
+			pathPattern = checkStructure("/abc**");
+			assertPathElements(pathPattern, SeparatorPathElement.class, RegexPathElement.class);
 		}
 
 		@Test