GitHub-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2026-05-04 05:06:36 +01:00
Code Issues Projects Releases Wiki Activity

Merge Improve error message for missing access attribute in intercept-url

Browse Source 
Improve error message for missing access attribute in intercept-url
This commit is contained in:
Rob Winch
2026-02-23 15:31:34 -06:00
committed by GitHub
parent 4d0627e6c0 53300be8d7
commit 1ab17d941a
8 changed files with 150 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java
+4
View File
@@ -124,6 +124,10 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
List<Element> interceptMessages = DomUtils.getChildElementsByTagName(element, Elements.INTERCEPT_URL);
for (Element interceptMessage : interceptMessages) {
String accessExpression = interceptMessage.getAttribute(ATT_ACCESS);
if (!StringUtils.hasText(accessExpression)) {
parserContext.getReaderContext().error("access attribute cannot be empty or null", interceptMessage);
continue;
}
BeanDefinitionBuilder authorizationManager = BeanDefinitionBuilder
.rootBeanDefinition(WebExpressionAuthorizationManager.class);
authorizationManager.addPropertyReference("expressionHandler", expressionHandlerRef);
config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java
+2 -1
View File
@@ -142,10 +142,11 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
ManagedMap<BeanMetadataElement, BeanDefinition> filterInvocationDefinitionMap = new ManagedMap<>();
for (Element urlElt : urlElts) {
String access = urlElt.getAttribute(ATT_ACCESS);
String path = urlElt.getAttribute(ATT_PATTERN);
if (!StringUtils.hasText(access)) {
parserContext.getReaderContext().error("access attribute cannot be empty or null", urlElt);
continue;
}
String path = urlElt.getAttribute(ATT_PATTERN);
String matcherRef = urlElt.getAttribute(HttpSecurityBeanDefinitionParser.ATT_REQUEST_MATCHER_REF);
boolean hasMatcherRef = StringUtils.hasText(matcherRef);
if (!hasMatcherRef && !StringUtils.hasText(path)) {
config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java
+48
View File
@@ -337,6 +337,54 @@ public class InterceptUrlConfigTests {
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
}
/**
* gh-18503
*/
@Test
public void configWhenInterceptUrlMissingAccessThenException() {
assertThatExceptionOfType(BeanDefinitionParsingException.class)
.isThrownBy(() -> this.spring.configLocations(this.xml("MissingAccess")).autowire())
.withMessageContaining("access attribute cannot be empty or null");
}
/**
* gh-18503
*/
@Test
public void configWhenInterceptUrlEmptyAccessThenException() {
assertThatExceptionOfType(BeanDefinitionParsingException.class)
.isThrownBy(() -> this.spring.configLocations(this.xml("EmptyAccess")).autowire())
.withMessageContaining("access attribute cannot be empty or null");
}
/**
* gh-18503
*/
@Test
public void configWhenInterceptUrlValidAccessThenLoads() {
assertThatNoException().isThrownBy(() -> this.spring.configLocations(this.xml("ValidAccess")).autowire());
}
/**
* gh-18503
*/
@Test
public void configWhenUseAuthorizationManagerFalseAndMissingAccessThenException() {
assertThatExceptionOfType(BeanDefinitionParsingException.class)
.isThrownBy(() -> this.spring.configLocations(this.xml("MissingAccessLegacy")).autowire())
.withMessageContaining("access attribute cannot be empty or null");
}
/**
* gh-18503
*/
@Test
public void configWhenUseAuthorizationManagerFalseAndEmptyAccessThenException() {
assertThatExceptionOfType(BeanDefinitionParsingException.class)
.isThrownBy(() -> this.spring.configLocations(this.xml("EmptyAccessLegacy")).autowire())
.withMessageContaining("access attribute cannot be empty or null");
}
private static RequestPostProcessor adminCredentials() {
return httpBasic("admin", "password");
}
config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-EmptyAccess.xml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xsi:schemaLocation="
http://www.springframework.org/schema/security
https://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
<http>
<intercept-url pattern="/admin/**" access="" />
</http>
<user-service>
<user name="user" password="{noop}password" authorities="ROLE_USER"/>
</user-service>
</b:beans>
config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-EmptyAccessLegacy.xml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xsi:schemaLocation="
http://www.springframework.org/schema/security
https://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
<http use-authorization-manager="false">
<intercept-url pattern="/admin/**" access=""/>
</http>
<user-service>
<user name="user" password="{noop}password" authorities="ROLE_USER"/>
</user-service>
</b:beans>
config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-MissingAccess.xml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xsi:schemaLocation="
http://www.springframework.org/schema/security
https://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
<http>
<intercept-url pattern="/admin/**"/>
</http>
<user-service>
<user name="user" password="{noop}password" authorities="ROLE_USER"/>
</user-service>
</b:beans>
config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-MissingAccessLegacy.xml
+19
View File
@@ -0,0 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xsi:schemaLocation="
http://www.springframework.org/schema/security
https://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
<http use-authorization-manager="false">
<intercept-url pattern="/admin/**"/>
</http>
<user-service>
<user name="user" password="{noop}password" authorities="ROLE_USER"/>
</user-service>
</b:beans>
config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-ValidAccess.xml
+20
View File
@@ -0,0 +1,20 @@
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xsi:schemaLocation="
http://www.springframework.org/schema/security
https://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
<http>
<intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
<http-basic />
</http>
<user-service>
<user name="user" password="{noop}password" authorities="ROLE_USER"/>
</user-service>
</b:beans>