ResourceUrlEncodingFilter fails to look up full path when Spring Security is enabled [SPR-12332]

[spring-projects-issues]

David Kerwick opened SPR-12332 and commented

Very similar to #16886, when springSecurityFilterChain is on the project ResourceUrlEncodingFilter fails to look up full paths. Without Spring security the url's are correctly encoded with the version.

With no Spring Security

2014-10-13 21:24:27,376 - TRACE - ResourceUrlProvider - Getting resource URL for requestURL=/test-app/static/test.js
2014-10-13 21:24:27,376 - TRACE - ResourceUrlProvider - Getting resource URL for lookupPath=/static/test.js
2014-10-13 21:24:27,376 - TRACE - ResourceUrlProvider - Invoking ResourceResolverChain for URL pattern="/static/**"
2014-10-13 21:24:27,377 - TRACE - VersionResourceResolver - Resolving public URL for path="/test.js"
2014-10-13 21:24:27,377 - TRACE - PathResourceResolver - Resolving public URL for path="/test.js"
2014-10-13 21:24:27,378 - TRACE - PathResourceResolver - Checking location=[class path resource [META-INF/resources/static/]]
2014-10-13 21:24:27,378 - TRACE - PathResourceResolver - Found match
2014-10-13 21:24:27,378 - TRACE - VersionResourceResolver - Getting the original resource to determine version
2014-10-13 21:24:27,378 - TRACE - PathResourceResolver - Resolving resource: requestPath="/test.js"
2014-10-13 21:24:27,379 - TRACE - PathResourceResolver - Checking location=[class path resource [META-INF/resources/static/]]
2014-10-13 21:24:27,379 - TRACE - PathResourceResolver - Found match
2014-10-13 21:24:27,382 - TRACE - VersionResourceResolver - Version=e524ca0e83caa5e899c99b155588a9e6
2014-10-13 21:24:27,382 - TRACE - ResourceUrlProvider - Resolved public resource URL path="/test-e524ca0e83caa5e899c99b155588a9e6.js"
2014-10-13 21:24:27,382 - TRACE - ResourceUrlProvider - Getting resource URL for requestURL=/test-app/static/test.js
2014-10-13 21:24:27,382 - TRACE - ResourceUrlProvider - Getting resource URL for lookupPath=/static/test.js
2014-10-13 21:24:27,382 - TRACE - ResourceUrlProvider - Invoking ResourceResolverChain for URL pattern="/static/**"
2014-10-13 21:24:27,383 - TRACE - VersionResourceResolver - Resolving public URL for path="/test.js"
2014-10-13 21:24:27,383 - TRACE - PathResourceResolver - Resolving public URL for path="/test.js"
2014-10-13 21:24:27,383 - TRACE - PathResourceResolver - Checking location=[class path resource [META-INF/resources/static/]]
2014-10-13 21:24:27,383 - TRACE - PathResourceResolver - Found match
2014-10-13 21:24:27,383 - TRACE - VersionResourceResolver - Getting the original resource to determine version
2014-10-13 21:24:27,383 - TRACE - PathResourceResolver - Resolving resource: requestPath="/test.js"
2014-10-13 21:24:27,383 - TRACE - PathResourceResolver - Checking location=[class path resource [META-INF/resources/static/]]
2014-10-13 21:24:27,383 - TRACE - PathResourceResolver - Found match
2014-10-13 21:24:27,384 - TRACE - VersionResourceResolver - Version=e524ca0e83caa5e899c99b155588a9e6
2014-10-13 21:24:27,384 - TRACE - ResourceUrlProvider - Resolved public resource URL path="/test-e524ca0e83caa5e899c99b155588a9e6.js"

When Spring Security is enabled

2014-10-13 21:30:10,872 - ResourceUrlProvider - Getting resource URL for requestURL=/test-app/static/test.js
Oct 13, 2014 9:30:10 PM org.apache.catalina.core.ApplicationDispatcher invoke
SEVERE: Servlet.service() for servlet jsp threw exception
java.lang.IllegalStateException: Failed to determine lookup path: /test-app/static/test.js
	at org.springframework.util.Assert.state(Assert.java:385)
	at org.springframework.web.servlet.resource.ResourceUrlProvider.getForRequestUrl(ResourceUrlProvider.java:183)
	at org.springframework.web.servlet.resource.ResourceUrlEncodingFilter$ResourceUrlEncodingResponseWrapper.encodeURL(ResourceUrlEncodingFilter.java:71)
	at org.apache.taglibs.standard.tag.common.core.UrlSupport.doEndTag(UrlSupport.java:119)
	at org.apache.jsp.WEB_002dINF.views.home_jsp._jspx_meth_c_005furl_005f0(home_jsp.java:196)
	at org.apache.jsp.WEB_002dINF.views.home_jsp._jspService(home_jsp.java:94)
       ...

---

Affects: 4.1.1

Issue Links:

• Failure to insert version in full path URLs within CSS file [SPR-12281] #16886 Failure to insert version in full path URLs within CSS file

[spring-projects-issues]

Rossen Stoyanchev commented

Okay once #16886 is fixed we can verify if this is resolved as well.

[spring-projects-issues]

Rossen Stoyanchev commented

Okay there is a fix now for #16886. Once a snapshot is available would you be able to try again with 4.1.2.BUILD-SNAPSHOT?

Thanks

[spring-projects-issues]

David Kerwick commented

That hasn't fixed the problem for me.

https://github.com/david-kerwick/spring-framework-issues/tree/master/SPR-12332

Strangely if you go to http://localhost:8080/SPR-12332/ it gives no error but at the same time doesn't add versioning to the url's
That uses

@Override
   public void addViewControllers(ViewControllerRegistry registry) {
       registry.addViewController("/").setViewName("home");
   }

When I go through a controller to the same page
http://localhost:8080/SPR-12332/test

It will give the error

If you remove SecurityWebApplicationInitializer http://localhost:8080/SPR-12332/test will work and also add versioning to the links.

Hope this helps

David

[spring-projects-issues]

Rossen Stoyanchev commented

This should now be fixed. It was actually not related to the use of Spring Security (at least not with the fix for #16886 in place). I've committed you sample project to the spring-framework-issues repository (thanks for that!) without the Spring Security configuration. If you can please give 4.1.2.BUILD-SNAPSHOT a try to confirm it works.

[spring-projects-issues]

David Kerwick commented

That works great. With the ViewControllerRegistry, the normal controller and behind a Spring security filter.

Thanks
David

[spring-projects-issues]

Rossen Stoyanchev commented

Thanks for trying it out!