class SpringAuthTagger
- SpringAuthTagger
- FrameworkTagger
- Tagger
- Reference
- Object
Defined in:
tagger/framework_taggers/java/spring_auth.crConstant Summary
-
ANNOTATION_PATTERNS =
[/\@PreAuthorize\s*\(/, /\@Secured\s*\(/, /\@RolesAllowed\s*\(/] -
ANY_REQUEST_AUTH =
/\.anyRequest\s*\(\)\s*\.\s*(authenticated|hasRole|hasAnyRole|hasAuthority|hasAnyAuthority|access)\s*(?:\(|\{)/ -
MATCHERS_RULE =
/\.(antMatchers|requestMatchers|mvcMatchers)\s*\(([^)]+)\)\s*\.\s*(permitAll|authenticated|hasRole|hasAnyRole|hasAuthority|hasAnyAuthority|access)\s*(?:\(|\{)/ -
Patterns for security config URL rules.
access { ... }is a protected rule too;permitAll()is intentionally tracked so a more-specific public matcher can suppress a broader protected one. -
SCOPE_MATCHER_CALL =
/\b(?:securityMatcher|antMatcher)\s*\(/ -
A chain is "scoped" only when restricted by a singular
securityMatcher(/antMatcher(call. The pluralantMatchers(...)/requestMatchers(...)forms are authorization rules, not scope restrictions, so a substring test likeincludes?("antMatcher")wrongly flips a rule-based chain to scoped and drops itsanyRequest()fallback. The\s*\(boundary rejects the plural.