UrlMapping with identical matcher applied in wrong order

Summary

The docs for authorizeRequests state:

There are multiple children to the http.authorizeRequests() method each matcher is considered in the order they were declared.

However, if two matchers are declared with the exact same pattern, the second one defined actually "wins" instead of the first one.

This appears to be caused by converting a List to a Map. In AbstractConfigAttributeRequestMatcherRegistry in the createRequestMap function:

for (UrlMapping mapping : getUrlMappings()) {
  RequestMatcher matcher = mapping.getRequestMatcher();
  Collection<ConfigAttribute> configAttrs = mapping.getConfigAttrs();
  requestMap.put(matcher, configAttrs);
}

Just changing put to putIfAbsent in the last line of the for loop should resolve this issue.

Actual Behavior

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
    .authorizeRequests()
    .antMatchers("A").denyAll()
    .antMatchers("A").permitAll();

The "denyAll" is ignored and any URL matching "A" will be permitted.

Expected Behavior

I would expect URLs matching "A" to be denied since that was defined first.

Version

4.2.3-RELEASE
but appears to be the same in the latest code