spring-projects / spring-projects/spring-security
SEC-2776: Allow HTTPRequest header to be searched with regex
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
James McShane (Migrated from SEC-2776) said:
Currently, there are two request matchers that have individual functionality that I would like combined. The RegexRequestMatcher matches the request url against a pattern, whereas the HeaderRequestMatcher attempts to match a header exactly. I propose a class called RegexHeaderRequestMatcher.
Some use cases:
- Grab the XFF header matching some IP pattern
- Matching a set of content-types for specific request
- custom sites which integrate with Sharepoint search, which searches sites using a searcher that will match some pattern, but no specific name is known.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the existing RegexRequestMatcher and HeaderRequestMatcher implementations and their tests. The proposed RegexHeaderRequestMatcher should combine header matching with regular-expression support for cases such as XFF and content types. Confirm the expected behavior for matching header values before considering the work complete.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100