Merge branch '3.5.x' into 4.0.x

bclozel · bclozel · commit a6d8c48e13cb · 2026-03-18T17:38:12.000+01:00
Closes gh-49649
diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java
@@ -449,12 +449,12 @@ protected boolean ignoreApplicationContext(@Nullable ApplicationContext applicat
 
 		@Override
 		protected ServerWebExchangeMatcher createDelegate(PathMappedEndpoints endpoints) {
-			Set<String> paths = this.endpoints.stream()
+			List<ServerWebExchangeMatcher> delegateMatchers = this.endpoints.stream()
 				.filter(Objects::nonNull)
 				.map(this::getEndpointId)
 				.flatMap((endpointId) -> streamAdditionalPaths(endpoints, endpointId))
-				.collect(Collectors.toCollection(LinkedHashSet::new));
-			List<ServerWebExchangeMatcher> delegateMatchers = getDelegateMatchers(paths, this.httpMethod);
+				.map(PathPatternParserServerWebExchangeMatcher::new)
+				.collect(Collectors.toCollection(ArrayList::new));
 			return (!CollectionUtils.isEmpty(delegateMatchers)) ? new OrServerWebExchangeMatcher(delegateMatchers)
 					: EMPTY_MATCHER;
 		}
diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java
@@ -456,13 +456,12 @@ protected RequestMatcher createDelegate(WebApplicationContext context,
 				RequestMatcherFactory requestMatcherFactory) {
 			PathMappedEndpoints endpoints = context.getBean(PathMappedEndpoints.class);
 			RequestMatcherProvider matcherProvider = getRequestMatcherProvider(context);
-			Set<String> paths = this.endpoints.stream()
+			List<RequestMatcher> delegateMatchers = this.endpoints.stream()
 				.filter(Objects::nonNull)
 				.map(this::getEndpointId)
 				.flatMap((endpointId) -> streamAdditionalPaths(endpoints, endpointId))
-				.collect(Collectors.toCollection(LinkedHashSet::new));
-			List<RequestMatcher> delegateMatchers = getDelegateMatchers(requestMatcherFactory, matcherProvider, paths,
-					this.httpMethod);
+				.map((path) -> requestMatcherFactory.antPath(matcherProvider, this.httpMethod, path))
+				.collect(Collectors.toCollection(ArrayList::new));
 			return (!CollectionUtils.isEmpty(delegateMatchers)) ? new OrRequestMatcher(delegateMatchers)
 					: EMPTY_MATCHER;
 		}
diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java
@@ -317,6 +317,7 @@ void toAdditionalPathsWithEndpointClassShouldNotMatchOtherPaths() {
 				FooEndpoint.class);
 		RequestMatcherAssert assertMatcher = assertMatcher(matcher, new PathMappedEndpoints("",
 				() -> List.of(mockEndpoint(EndpointId.of("foo"), "test", WebServerNamespace.SERVER, "/additional"))));
+		assertMatcher.doesNotMatch("/additional/foo");
 		assertMatcher.doesNotMatch("/foo");
 		assertMatcher.doesNotMatch("/bar");
 	}
diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequestTests.java
@@ -322,6 +322,7 @@ void toAdditionalPathsWithEndpointClassShouldNotMatchOtherPaths() {
 				FooEndpoint.class);
 		RequestMatcherAssert assertMatcher = assertMatcher(matcher, new PathMappedEndpoints("",
 				() -> List.of(mockEndpoint(EndpointId.of("foo"), "test", WebServerNamespace.SERVER, "/additional"))));
+		assertMatcher.doesNotMatch("/additional/foo");
 		assertMatcher.doesNotMatch("/foo");
 		assertMatcher.doesNotMatch("/bar");
 	}

Original file line number	Diff line number	Diff line change
`@@ -317,6 +317,7 @@ void toAdditionalPathsWithEndpointClassShouldNotMatchOtherPaths() {`
`317`	`317`	`FooEndpoint.class);`
`318`	`318`	`RequestMatcherAssert assertMatcher = assertMatcher(matcher, new PathMappedEndpoints("",`
`319`	`319`	`() -> List.of(mockEndpoint(EndpointId.of("foo"), "test", WebServerNamespace.SERVER, "/additional"))));`
	`320`	`+ assertMatcher.doesNotMatch("/additional/foo");`
`320`	`321`	`assertMatcher.doesNotMatch("/foo");`
`321`	`322`	`assertMatcher.doesNotMatch("/bar");`
`322`	`323`	`}`
Original file line number	Diff line number	Diff line change
`@@ -322,6 +322,7 @@ void toAdditionalPathsWithEndpointClassShouldNotMatchOtherPaths() {`
`322`	`322`	`FooEndpoint.class);`
`323`	`323`	`RequestMatcherAssert assertMatcher = assertMatcher(matcher, new PathMappedEndpoints("",`
`324`	`324`	`() -> List.of(mockEndpoint(EndpointId.of("foo"), "test", WebServerNamespace.SERVER, "/additional"))));`
	`325`	`+ assertMatcher.doesNotMatch("/additional/foo");`
`325`	`326`	`assertMatcher.doesNotMatch("/foo");`
`326`	`327`	`assertMatcher.doesNotMatch("/bar");`
`327`	`328`	`}`