coheigea commented on code in PR #3331:
URL: https://github.com/apache/cxf/pull/3331#discussion_r3637910470
##########
rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java:
##########
@@ -295,6 +297,28 @@ protected String validateAudiences(List<String> audiences)
{
return null;
}
+ /**
+ * Checks whether a configured audience matches a request URL using safe
prefix semantics.
+ * <p>
+ * This keeps subtree-style matching (for example, "/api/read" matching
"/api/read/item")
+ * but prevents same-prefix sibling matches (for example,
"/api/readadmin").
+ * A match is accepted only when the configured audience is an exact
match, ends with '/',
+ * or is followed by a URL boundary character ('/', '?', '#').
+ */
+ protected boolean matchesAudiencePrefix(String requestPath, String
configuredAudience) {
+ if (requestPath == null || configuredAudience == null) {
+ return false;
+ }
+ if (!requestPath.startsWith(configuredAudience)) {
+ return false;
+ }
+ if (requestPath.length() == configuredAudience.length() ||
configuredAudience.endsWith("/")) {
Review Comment:
I don't think it is redundant. The startsWith check makes sure that the
audience matches the start of the request URI. Then the next check is to make
sure either they're equal or if it ends with a forward slash then we can accept
the match.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
