Skip to content

Bugfix: default case insensitive filters for programmatic and Spring / Spring Boot configurations #2857

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lprimak merged 2 commits into from
Aug 16, 2026
Merged

Bugfix: default case insensitive filters for programmatic and Spring / Spring Boot configurations #2857

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
38462d8
bugfix: set case-insensitive filter behavior by default for Spring, S…
lprimak Aug 14, 2026
3d17744
chore: fix warnings and simplify code
lprimak Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions core/src/main/java/org/apache/shiro/util/AntPathMatcher.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ public class AntPathMatcher implements PatternMatcher {
public static final String DEFAULT_PATH_SEPARATOR = "/";

private String pathSeparator = DEFAULT_PATH_SEPARATOR;
private boolean caseInsensitive;
private boolean caseInsensitive = true;
Comment thread
steinarb marked this conversation as resolved.


/**
Expand Down Expand Up @@ -157,8 +157,7 @@ protected boolean doMatch(String pattern, String path, boolean fullMatch) {
if (pathIdxStart > pathIdxEnd) {
// Path is exhausted, only match if rest of pattern is * or **'s
if (pattIdxStart > pattIdxEnd) {
return (pattern.endsWith(this.pathSeparator)
? path.endsWith(this.pathSeparator) : !path.endsWith(this.pathSeparator));
return (pattern.endsWith(this.pathSeparator) == path.endsWith(this.pathSeparator));
Comment thread
steinarb marked this conversation as resolved.
}
if (!fullMatch) {
return true;
Expand Down Expand Up @@ -225,8 +224,8 @@ protected boolean doMatch(String pattern, String path, boolean fullMatch) {
strLoop:
for (int i = 0; i <= strLength - patLength; i++) {
for (int j = 0; j < patLength; j++) {
String subPat = (String) pattDirs[pattIdxStart + j + 1];
String subStr = (String) pathDirs[pathIdxStart + i + j];
String subPat = pattDirs[pattIdxStart + j + 1];
Comment thread
steinarb marked this conversation as resolved.
String subStr = pathDirs[pathIdxStart + i + j];
if (!matchStrings(subPat, subStr)) {
continue strLoop;
}
Expand Down
2 changes: 1 addition & 1 deletion core/src/main/java/org/apache/shiro/util/RegExPatternMatcher.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ public class RegExPatternMatcher implements PatternMatcher {

private static final int CASE_INSENSITIVE = DEFAULT | Pattern.CASE_INSENSITIVE;

private boolean caseInsensitive;
private boolean caseInsensitive = true;

/**
* Simple implementation that merely uses the default pattern comparison logic provided by the
Expand Down
4 changes: 3 additions & 1 deletion core/src/test/java/org/apache/shiro/util/RegExPatternMatcherTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,9 @@ private void assertPatternMatch(String pattern, String path, PatternMatcher pm)
}

private void assertPatternNotMatch(String pattern, String path) {
assertPatternNotMatch(pattern, path, new RegExPatternMatcher());
var matcher = new RegExPatternMatcher();
matcher.setCaseInsensitive(false);
assertPatternNotMatch(pattern, path, matcher);
}

private void assertPatternNotMatch(String pattern, String path, PatternMatcher pm) {
Expand Down
2 changes: 1 addition & 1 deletion ...es/spring-mvc/src/main/java/org/apache/shiro/samples/spring/config/ApplicationConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ public ShiroFilterChainDefinition shiroFilterChainDefinition() {
chainDefinition.addPathDefinition("/WEB-INF/resources/login.jsp", "anon");
//allow WebStart to pull the jars for the swing app
chainDefinition.addPathDefinition("/*.jar", "anon");

chainDefinition.addPathDefinition("/**", "anon");
Comment thread
steinarb marked this conversation as resolved.

return chainDefinition;
}
Expand Down
2 changes: 1 addition & 1 deletion ...src/main/java/org/apache/shiro/spring/web/config/AbstractShiroWebFilterConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ public class AbstractShiroWebFilterConfiguration {
@Value("#{ @environment['shiro.unauthorizedUrl'] ?: null }")
protected String unauthorizedUrl;

@Value("#{ @environment['shiro.caseInsensitive'] ?: false }")
@Value("#{ @environment['shiro.caseInsensitive'] ?: true }")
protected boolean caseInsensitive;

protected List<String> globalFilters() {
Expand Down
10 changes: 5 additions & 5 deletions web/src/main/java/org/apache/shiro/web/filter/mgt/DefaultFilterChainManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,18 +66,18 @@ public class DefaultFilterChainManager implements FilterChainManager {
*/
private Map<String, NamedFilterList> filterChains;

private boolean caseInsensitive;
private boolean caseInsensitive = true;

public DefaultFilterChainManager() {
this.filters = new LinkedHashMap<String, Filter>();
this.filterChains = new LinkedHashMap<String, NamedFilterList>();
this.filters = new LinkedHashMap<>();
this.filterChains = new LinkedHashMap<>();
this.globalFilterNames = new ArrayList<>();
addDefaultFilters(false);
}

public DefaultFilterChainManager(FilterConfig filterConfig) {
this.filters = new LinkedHashMap<String, Filter>();
this.filterChains = new LinkedHashMap<String, NamedFilterList>();
this.filters = new LinkedHashMap<>();
this.filterChains = new LinkedHashMap<>();
this.globalFilterNames = new ArrayList<>();
setFilterConfig(filterConfig);
addDefaultFilters(true);
Expand Down
Loading