Validate server.servlet.path does not contain unusual patterns (eg /*)

[candrews]

In application.properties:

server.servlet.path=/*

EndpointRequest.to(HealthEndpoint.class).matches(request)

Make a request for /actuator/health

I'd expect for the matcher to match, but it doesn't. Looking inside EndpointRequest, the delegate field has a OrRequestMatcher instance composed of an AntPathRequestMatcher with pattern set to /*/actuator/health/** - the pattern should be /actuator/health/**

[candrews]

This issue is related to #12934

[candrews]

The RequestMatcherFactory created in org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest.AbstractRequestMatcher.createDelegate(WebApplicationContext) has servletPath=/* (as expected) but it isn't handled correctly in org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest.RequestMatcherFactory.antPath(String...)

looks like a bit more work like 469372c is necessary

[philwebb]

@candrews The server.servlet.path property is for the main path of the dispatcher servlet. Using /* doesn't seem valid to me. What path are you actually trying to map your dispatcher servlet to?

[candrews]

I'm not sure why my application has server.servlet.path=/* set - the history isn't telling me. However, google shows me a few pages instructing users to use this configuration for JBoss. https://victal.eti.br/deploying-springboot-applications-on-jboss-7.html is one such example. So I think I'm probably not the only person with this configuration.

Setting server.servlet.path=/ (which is the default) doesn't seem to break anything. So if you do nothing with this issue, it won't bother me.

If server.servlet.path=/* really is invalid, perhaps Spring Boot can have a validator on that field raising an error if this invalid value is provided?

[philwebb]

Good idea, I'll re-purpose this issue to add validation.

[mbhave]

We have some tests that rely on this behavior at the moment. I'm not quite sure what we want to allow for spring.mvc.servlet.path.

[mbhave]

* is a valid character in urls so maybe we should make this check less restrictive. Also, when determining url mappings, it seems like this should be getPath().endsWith("/*") so that a servlet path of /foo*bar will be mapped to foo*bar/*. Reopening the issue to see what the rest of the team thinks.

[philwebb]

We discussed this on the call and decided to keep it as strict as possible until someone complains that they really need *.