Skip to content

Spring-security.xsd schema validates request-matcher incorrectly #18641

@etherid

Description

@etherid

Describe the bug
As of Spring Security 7 the AntPathRequestMatcher and the MvcRequestMatcher have been consolidated into the PathPatternRequestMatcher.
Therefore, all occurrences of request-matcher="ant" or request-matcher="mvc" should be replaced by request-matcher="path", at least if I understand the changes correctly.

However, the spring-security.xsd does not reflect the changes to the MatcherType correctly.
It still validates against the previous value set of mvc, ant, regex and ciRegex
It should instead validate agains the set path, regex and ciRegex

To Reproduce
Use the value "path" for the attribute "request-matcher" in some xml configuration.

Expected behavior
The value "path" should be accepted as valid value for the attribute request-matcher.

Sample

See: https://www.springframework.org/schema/security/spring-security.xsd
Or: https://www.springframework.org/schema/security/spring-security-7.0.xsd

Also described here: #18211

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions