From 0eec1dc63688e231bc0130c91b02b12c8996bd88 Mon Sep 17 00:00:00 2001
From: rstoyanchev <rossen.stoyanchev@broadcom.com>
Date: Thu, 19 Jun 2025 17:37:27 +0100
Subject: [PATCH] Consistently validate API version

Closes gh-35082
---
 .../condition/VersionRequestCondition.java      |  6 +-----
 .../condition/VersionRequestConditionTests.java | 17 +++++++++++++++++
 .../mvc/condition/VersionRequestCondition.java  |  7 ++-----
 .../condition/VersionRequestConditionTests.java | 17 +++++++++++++++++
 4 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/spring-webflux/src/main/java/org/springframework/web/reactive/result/condition/VersionRequestCondition.java b/spring-webflux/src/main/java/org/springframework/web/reactive/result/condition/VersionRequestCondition.java
index ceb1d51f255..8bc7734921d 100644
--- a/spring-webflux/src/main/java/org/springframework/web/reactive/result/condition/VersionRequestCondition.java
+++ b/spring-webflux/src/main/java/org/springframework/web/reactive/result/condition/VersionRequestCondition.java
@@ -105,10 +105,6 @@ public final class VersionRequestCondition extends AbstractRequestCondition<Vers
 
 	@Override
 	public @Nullable VersionRequestCondition getMatchingCondition(ServerWebExchange exchange) {
-		if (this.version == null) {
-			return this;
-		}
-
 		Comparable<?> requestVersion = exchange.getAttribute(VERSION_ATTRIBUTE_NAME);
 		if (requestVersion == null) {
 			String value = this.versionStrategy.resolveVersion(exchange);
@@ -118,7 +114,7 @@ public final class VersionRequestCondition extends AbstractRequestCondition<Vers
 			exchange.getAttributes().put(VERSION_ATTRIBUTE_NAME, (requestVersion));
 		}
 
-		if (requestVersion == NO_VERSION_ATTRIBUTE) {
+		if (this.version == null || requestVersion == NO_VERSION_ATTRIBUTE) {
 			return this;
 		}
 
diff --git a/spring-webflux/src/test/java/org/springframework/web/reactive/result/condition/VersionRequestConditionTests.java b/spring-webflux/src/test/java/org/springframework/web/reactive/result/condition/VersionRequestConditionTests.java
index e97f6cb4883..2a0b6d3348a 100644
--- a/spring-webflux/src/test/java/org/springframework/web/reactive/result/condition/VersionRequestConditionTests.java
+++ b/spring-webflux/src/test/java/org/springframework/web/reactive/result/condition/VersionRequestConditionTests.java
@@ -23,6 +23,8 @@ import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.web.accept.InvalidApiVersionException;
+import org.springframework.web.accept.MissingApiVersionException;
 import org.springframework.web.accept.NotAcceptableApiVersionException;
 import org.springframework.web.accept.SemanticApiVersionParser;
 import org.springframework.web.reactive.accept.DefaultApiVersionStrategy;
@@ -90,6 +92,21 @@ public class VersionRequestConditionTests {
 		testMatch("v1.3", condition, true, false);
 	}
 
+	@Test
+	void notVersionedMatch() {
+		VersionRequestCondition condition = new VersionRequestCondition(null, this.strategy);
+		this.strategy.addSupportedVersion("1.1", "1.3");
+
+		testMatch("v1.1", condition, true, false);
+		testMatch("v1.3", condition, true, false);
+
+		assertThatThrownBy(() -> condition.getMatchingCondition(exchangeWithVersion("1.2")))
+				.isInstanceOf(InvalidApiVersionException.class);
+
+		assertThatThrownBy(() -> condition.getMatchingCondition(MockServerWebExchange.from(MockServerHttpRequest.get("/"))))
+				.isInstanceOf(MissingApiVersionException.class);
+	}
+
 	private void testMatch(
 			String requestVersion, VersionRequestCondition condition, boolean matches, boolean notAcceptable) {
 
diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/condition/VersionRequestCondition.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/condition/VersionRequestCondition.java
index 401c257229b..2df3288d475 100644
--- a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/condition/VersionRequestCondition.java
+++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/condition/VersionRequestCondition.java
@@ -27,6 +27,7 @@ import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 import org.springframework.web.accept.ApiVersionStrategy;
 import org.springframework.web.accept.InvalidApiVersionException;
+import org.springframework.web.accept.MissingApiVersionException;
 import org.springframework.web.accept.NotAcceptableApiVersionException;
 import org.springframework.web.bind.annotation.RequestMapping;
 
@@ -104,10 +105,6 @@ public final class VersionRequestCondition extends AbstractRequestCondition<Vers
 
 	@Override
 	public @Nullable VersionRequestCondition getMatchingCondition(HttpServletRequest request) {
-		if (this.version == null) {
-			return this;
-		}
-
 		Comparable<?> requestVersion = (Comparable<?>) request.getAttribute(VERSION_ATTRIBUTE_NAME);
 		if (requestVersion == null) {
 			String value = this.versionStrategy.resolveVersion(request);
@@ -117,7 +114,7 @@ public final class VersionRequestCondition extends AbstractRequestCondition<Vers
 			request.setAttribute(VERSION_ATTRIBUTE_NAME, (requestVersion));
 		}
 
-		if (requestVersion == NO_VERSION_ATTRIBUTE) {
+		if (this.version == null || requestVersion == NO_VERSION_ATTRIBUTE) {
 			return this;
 		}
 
diff --git a/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/condition/VersionRequestConditionTests.java b/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/condition/VersionRequestConditionTests.java
index 9d90263c808..a0642ae81b4 100644
--- a/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/condition/VersionRequestConditionTests.java
+++ b/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/condition/VersionRequestConditionTests.java
@@ -24,6 +24,8 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.web.accept.DefaultApiVersionStrategy;
+import org.springframework.web.accept.InvalidApiVersionException;
+import org.springframework.web.accept.MissingApiVersionException;
 import org.springframework.web.accept.NotAcceptableApiVersionException;
 import org.springframework.web.accept.SemanticApiVersionParser;
 import org.springframework.web.testfixture.servlet.MockHttpServletRequest;
@@ -88,6 +90,21 @@ public class VersionRequestConditionTests {
 		testMatch("v1.3", condition, true, false);
 	}
 
+	@Test
+	void notVersionedMatch() {
+		VersionRequestCondition condition = new VersionRequestCondition(null, this.strategy);
+		this.strategy.addSupportedVersion("1.1", "1.3");
+
+		testMatch("v1.1", condition, true, false);
+		testMatch("v1.3", condition, true, false);
+
+		assertThatThrownBy(() -> condition.getMatchingCondition(requestWithVersion("1.2")))
+				.isInstanceOf(InvalidApiVersionException.class);
+
+		assertThatThrownBy(() -> condition.getMatchingCondition(new MockHttpServletRequest("GET", "/path")))
+				.isInstanceOf(MissingApiVersionException.class);
+	}
+
 	private void testMatch(
 			String requestVersion, VersionRequestCondition condition, boolean matches, boolean notAcceptable) {