spring-projects / spring-projects/spring-security

Allow `InetAddressMatchers.builder().include(...)` to be called in a fluent style

Open
#19,071 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

InetAddressMatchers.builder().includeAddresses(...) returns this for fluent style calls, however, calling includeAddresses again doesn't work in a useful way.

Current Behavior

InetAddressMatchers.builder().includeAddresses(...) accepts a list of include addresses and the javadoc states "Adds an include list matcher that permits only the specified addresses.". If you call InetAddressMatchers.builder().includeAddresses(List.of("192.168.1.1", "192.168.1.2")).build() you'll get a matcher that matcher "192.168.1.1" or 192.168.1.2".

If however, you call the method more than once, e.g. InetAddressMatchers.builder().includeAddresses(List.of("192.168.1.1")).includeAddresses(List.of("192.168.1.2")).build() you get a matcher that won't match anything. This is because internally there are two IncludeListInetAddressMatcher instances. One will only match 192.168.1.1 and the other will only match 192.168.1.2.

Context

This came up during the development of https://github.com/spring-projects/spring-boot/issues/49687. You could argue that the API is working as designed, so perhaps this issue can just be closed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the InetAddressMatchers.builder().includeAddresses(...) entry point and inspect how IncludeListInetAddressMatcher instances are collected. Add or update tests for repeated includeAddresses calls, then verify that a matcher built from multiple calls matches the included addresses as intended rather than matching nothing.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.