reta commented on code in PR #3331:
URL: https://github.com/apache/cxf/pull/3331#discussion_r3637833719
##########
rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java:
##########
@@ -295,6 +297,28 @@ protected String validateAudiences(List<String> audiences)
{
return null;
}
+ /**
+ * Checks whether a configured audience matches a request URL using safe
prefix semantics.
+ * <p>
+ * This keeps subtree-style matching (for example, "/api/read" matching
"/api/read/item")
+ * but prevents same-prefix sibling matches (for example,
"/api/readadmin").
+ * A match is accepted only when the configured audience is an exact
match, ends with '/',
+ * or is followed by a URL boundary character ('/', '?', '#').
+ */
+ protected boolean matchesAudiencePrefix(String requestPath, String
configuredAudience) {
+ if (requestPath == null || configuredAudience == null) {
+ return false;
+ }
+ if (!requestPath.startsWith(configuredAudience)) {
+ return false;
+ }
+ if (requestPath.length() == configuredAudience.length() ||
configuredAudience.endsWith("/")) {
Review Comment:
```suggestion
if (configuredAudience.endsWith("/")) {
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
