diff --git a/spring-core/src/main/java/org/springframework/util/AntPathMatcher.java b/spring-core/src/main/java/org/springframework/util/AntPathMatcher.java index d7067d8a6a..f1ae2a43fe 100644 --- a/spring-core/src/main/java/org/springframework/util/AntPathMatcher.java +++ b/spring-core/src/main/java/org/springframework/util/AntPathMatcher.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2021 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -705,8 +705,8 @@ public class AntPathMatcher implements PathMatcher { else { this.exactMatch = false; patternBuilder.append(quote(pattern, end, pattern.length())); - this.pattern = (this.caseSensitive ? Pattern.compile(patternBuilder.toString()) : - Pattern.compile(patternBuilder.toString(), Pattern.CASE_INSENSITIVE)); + this.pattern = Pattern.compile(patternBuilder.toString(), + Pattern.DOTALL | (this.caseSensitive ? 0 : Pattern.CASE_INSENSITIVE)); } } diff --git a/spring-core/src/test/java/org/springframework/util/AntPathMatcherTests.java b/spring-core/src/test/java/org/springframework/util/AntPathMatcherTests.java index b018e99caf..71eb80a23f 100644 --- a/spring-core/src/test/java/org/springframework/util/AntPathMatcherTests.java +++ b/spring-core/src/test/java/org/springframework/util/AntPathMatcherTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2020 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -131,6 +131,7 @@ class AntPathMatcherTests { assertThat(pathMatcher.match("/{bla}.*", "/testing.html")).isTrue(); assertThat(pathMatcher.match("/{bla}", "//x\ny")).isTrue(); + assertThat(pathMatcher.match("/{var:.*}", "/x\ny")).isTrue(); } @Test diff --git a/spring-web/src/main/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilder.java b/spring-web/src/main/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilder.java index 4581158f85..d854c40e92 100644 --- a/spring-web/src/main/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilder.java +++ b/spring-web/src/main/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilder.java @@ -520,7 +520,7 @@ public class Jackson2ObjectMapperBuilder { } /** - * Specify one or more modules to be registered with the {@link ObjectMapper}. + * Specify the modules to be registered with the {@link ObjectMapper}. *

Multiple invocations are not additive, the last one defines the modules to * register. *

Note: If this is set, no finding of modules is going to happen - not by @@ -537,15 +537,9 @@ public class Jackson2ObjectMapperBuilder { } /** - * Set a complete list of modules to be registered with the {@link ObjectMapper}. - *

Multiple invocations are not additive, the last one defines the modules to - * register. - *

Note: If this is set, no finding of modules is going to happen - not by - * Jackson, and not by Spring either (see {@link #findModulesViaServiceLoader}). - * As a consequence, specifying an empty list here will suppress any kind of - * module detection. - *

Specify either this or {@link #modulesToInstall}, not both. + * Variant of {@link #modules(Module...)} with a {@link List}. * @see #modules(Module...) + * @see #modules(Consumer) * @see com.fasterxml.jackson.databind.Module */ public Jackson2ObjectMapperBuilder modules(List modules) { @@ -555,6 +549,22 @@ public class Jackson2ObjectMapperBuilder { return this; } + /** + * Variant of {@link #modules(Module...)} with a {@link Consumer} for full + * control over the underlying list of modules. + * @since 6.0 + * @see #modules(Module...) + * @see #modules(List) + * @see com.fasterxml.jackson.databind.Module + */ + public Jackson2ObjectMapperBuilder modules(Consumer> consumer) { + this.modules = (this.modules != null ? this.modules : new ArrayList<>()); + this.findModulesViaServiceLoader = false; + this.findWellKnownModules = false; + consumer.accept(this.modules); + return this; + } + /** * Specify one or more modules to be registered with the {@link ObjectMapper}. *

Multiple invocations are not additive, the last one defines the modules @@ -565,6 +575,7 @@ public class Jackson2ObjectMapperBuilder { * allowing to eventually override their configuration. *

Specify either this or {@link #modules(Module...)}, not both. * @since 4.1.5 + * @see #modulesToInstall(Consumer) * @see #modulesToInstall(Class...) * @see com.fasterxml.jackson.databind.Module */ @@ -574,6 +585,21 @@ public class Jackson2ObjectMapperBuilder { return this; } + /** + * Variant of {@link #modulesToInstall(Module...)} with a {@link Consumer} + * for full control over the underlying list of modules. + * @since 6.0 + * @see #modulesToInstall(Module...) + * @see #modulesToInstall(Class...) + * @see com.fasterxml.jackson.databind.Module + */ + public Jackson2ObjectMapperBuilder modulesToInstall(Consumer> consumer) { + this.modules = (this.modules != null ? this.modules : new ArrayList<>()); + this.findWellKnownModules = true; + consumer.accept(this.modules); + return this; + } + /** * Specify one or more modules by class to be registered with * the {@link ObjectMapper}. @@ -585,6 +611,7 @@ public class Jackson2ObjectMapperBuilder { * allowing to eventually override their configuration. *

Specify either this or {@link #modules(Module...)}, not both. * @see #modulesToInstall(Module...) + * @see #modulesToInstall(Consumer) * @see com.fasterxml.jackson.databind.Module */ @SafeVarargs diff --git a/spring-web/src/main/java/org/springframework/web/util/pattern/CaptureVariablePathElement.java b/spring-web/src/main/java/org/springframework/web/util/pattern/CaptureVariablePathElement.java index 856c35af98..b3002295a9 100644 --- a/spring-web/src/main/java/org/springframework/web/util/pattern/CaptureVariablePathElement.java +++ b/spring-web/src/main/java/org/springframework/web/util/pattern/CaptureVariablePathElement.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2021 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -59,15 +59,9 @@ class CaptureVariablePathElement extends PathElement { } else { this.variableName = new String(captureDescriptor, 1, colon - 1); - if (caseSensitive) { - this.constraintPattern = Pattern.compile( - new String(captureDescriptor, colon + 1, captureDescriptor.length - colon - 2)); - } - else { - this.constraintPattern = Pattern.compile( - new String(captureDescriptor, colon + 1, captureDescriptor.length - colon - 2), - Pattern.CASE_INSENSITIVE); - } + this.constraintPattern = Pattern.compile( + new String(captureDescriptor, colon + 1, captureDescriptor.length - colon - 2), + Pattern.DOTALL | (caseSensitive ? 0 : Pattern.CASE_INSENSITIVE)); } } diff --git a/spring-web/src/main/java/org/springframework/web/util/pattern/RegexPathElement.java b/spring-web/src/main/java/org/springframework/web/util/pattern/RegexPathElement.java index c5cd8f588f..d66e7a7ce2 100644 --- a/spring-web/src/main/java/org/springframework/web/util/pattern/RegexPathElement.java +++ b/spring-web/src/main/java/org/springframework/web/util/pattern/RegexPathElement.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2021 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -108,12 +108,8 @@ class RegexPathElement extends PathElement { } patternBuilder.append(quote(text, end, text.length())); - if (this.caseSensitive) { - return Pattern.compile(patternBuilder.toString()); - } - else { - return Pattern.compile(patternBuilder.toString(), Pattern.CASE_INSENSITIVE); - } + return Pattern.compile(patternBuilder.toString(), + Pattern.DOTALL | (this.caseSensitive ? 0 : Pattern.CASE_INSENSITIVE)); } public List getVariableNames() { diff --git a/spring-web/src/test/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilderTests.java b/spring-web/src/test/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilderTests.java index 24f00cb81b..1f489ab00d 100644 --- a/spring-web/src/test/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilderTests.java +++ b/spring-web/src/test/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilderTests.java @@ -240,6 +240,16 @@ class Jackson2ObjectMapperBuilderTests { assertThat(serializers.findSerializer(null, SimpleType.construct(Integer.class), null)).isSameAs(serializer1); } + @Test + void modulesWithConsumer() { + NumberSerializer serializer1 = new NumberSerializer(Integer.class); + SimpleModule module = new SimpleModule(); + module.addSerializer(Integer.class, serializer1); + ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json().modules(list -> list.add(module) ).build(); + Serializers serializers = getSerializerFactoryConfig(objectMapper).serializers().iterator().next(); + assertThat(serializers.findSerializer(null, SimpleType.construct(Integer.class), null)).isSameAs(serializer1); + } + @Test void modulesToInstallByClass() { ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json() @@ -258,6 +268,15 @@ class Jackson2ObjectMapperBuilderTests { assertThat(serializers.findSerializer(null, SimpleType.construct(Integer.class), null).getClass()).isSameAs(CustomIntegerSerializer.class); } + @Test + void modulesToInstallWithConsumer() { + ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json() + .modulesToInstall(list -> list.add(new CustomIntegerModule())) + .build(); + Serializers serializers = getSerializerFactoryConfig(objectMapper).serializers().iterator().next(); + assertThat(serializers.findSerializer(null, SimpleType.construct(Integer.class), null).getClass()).isSameAs(CustomIntegerSerializer.class); + } + @Test void wellKnownModules() throws JsonProcessingException, UnsupportedEncodingException { ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json().build(); diff --git a/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternTests.java b/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternTests.java index 7a8f6e2e9c..b55e21ff43 100644 --- a/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternTests.java +++ b/spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternTests.java @@ -301,6 +301,7 @@ public class PathPatternTests { checkCapture("{var:f o}","f%20o","var","f o"); // constraint is expressed in non encoded form checkCapture("{var:f.o}","f%20o","var","f o"); checkCapture("{var:f\\|o}","f%7co","var","f|o"); + checkCapture("{var:.*}","x\ny","var","x\ny"); } @Test @@ -320,6 +321,8 @@ public class PathPatternTests { checkCapture("/{var1}_ _{var2}","/f%20o_%20_f%7co","var1","f o","var2","f|o"); checkCapture("/{var1}_ _{var2:f\\|o}","/f%20o_%20_f%7co","var1","f o","var2","f|o"); checkCapture("/{var1:f o}_ _{var2:f\\|o}","/f%20o_%20_f%7co","var1","f o","var2","f|o"); + checkCapture("/{var1:f o}_ _{var2:f\\|o}","/f%20o_%20_f%7co","var1","f o","var2","f|o"); + checkCapture("/{var1}_{var2}","/f\noo_foo","var1","f\noo","var2","foo"); } @Test diff --git a/src/docs/asciidoc/web/webmvc.adoc b/src/docs/asciidoc/web/webmvc.adoc index a1414f2934..eaf999d539 100644 --- a/src/docs/asciidoc/web/webmvc.adoc +++ b/src/docs/asciidoc/web/webmvc.adoc @@ -650,7 +650,7 @@ See <> in the section on MVC configuration for examples configure interceptors. You can also register them directly by using setters on individual `HandlerMapping` implementations. -Note that `postHandle` is less useful with `@ResponseBody` and `ResponseEntity` methods for +`postHandle` method is less useful with `@ResponseBody` and `ResponseEntity` methods for which the response is written and committed within the `HandlerAdapter` and before `postHandle`. That means it is too late to make any changes to the response, such as adding an extra header. For such scenarios, you can implement `ResponseBodyAdvice` and either @@ -659,6 +659,7 @@ declare it as an <> bean or configure it directly on + [[mvc-exceptionhandlers]] === Exceptions [.small]#<># @@ -5397,7 +5398,6 @@ the following example shows: public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor(new LocaleChangeInterceptor()); registry.addInterceptor(new ThemeChangeInterceptor()).addPathPatterns("/**").excludePathPatterns("/admin/**"); - registry.addInterceptor(new SecurityInterceptor()).addPathPatterns("/secure/*"); } } ---- @@ -5411,7 +5411,6 @@ the following example shows: override fun addInterceptors(registry: InterceptorRegistry) { registry.addInterceptor(LocaleChangeInterceptor()) registry.addInterceptor(ThemeChangeInterceptor()).addPathPatterns("/**").excludePathPatterns("/admin/**") - registry.addInterceptor(SecurityInterceptor()).addPathPatterns("/secure/*") } } ---- @@ -5427,13 +5426,19 @@ The following example shows how to achieve the same configuration in XML: - - - - ---- +NOTE: Mapped interceptors are not ideally suited as a security layer due to the potential +for a mismatch with annotated controller path matching, which can also match trailing +slashes and path extensions transparently, along with other path matching options. Many +of these options have been deprecated but the potential for a mismatch remains. +Generally, we recommend using Spring Security which includes a dedicated +https://docs.spring.io/spring-security/reference/servlet/integrations/mvc.html#mvc-requestmatcher[MvcRequestMatcher] +to align with Spring MVC path matching and also has a security firewall that blocks many +unwanted characters in URL paths. + + [[mvc-config-content-negotiation]]