PathPatternRequestMatcher caching leads to unexpected behavior when forwarding

Describe the bug

Spring Security version 6.5.0 release.

Since the AntPathMatcher is deprecated, I replaced it with PathPatternRequestMatcher expecting that it would behave the same. However I discovered that the PathPatternRequestMatcher caches the parsed RequestPath in a request attribute (see org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher#getPathContainer). This leads to unexpected behavior when forwarding.

For example if you make a request to /path-a then call request.getRequestDispatcher("/path-b").forward(request, response) then a PathPatternRequestMatcher will never match on /path-b (assuming that /path-a was cached in the request, in my case by a filter earlier in the chain which uses a PathPatternRequestMatcher).

To Reproduce

• Make request to /path-a
• Use any PathPatternRequestMatcher on the request e.g. PathPatternRequestMatcher.withDefaults().matcher("/path-a").matches(request)
• Forward the request request.getRequestDispatcher("/path-b").forward(request, response)
• After forwarding PathPatternRequestMatcher.withDefaults().matcher("/path-b").matches(request) will return false

Expected behavior

The PathPatternRequestMatcher should behave the same as the AntPathMatcher which it is replacing and always match on the jakarta.servlet.http.HttpServletRequest#getRequestURI.

Sample

Can supply if required.

Screenshot

Screenshot illustrating the issue

Start with org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher#getPathContainer and reproduce the issue by matching /path-a, forwarding to /path-b, and matching again. Trace how the cached RequestPath is used across the forward; done means the matcher evaluates the forwarded request correctly, with regression coverage for this sequence.