Restrict EndpointRequest links to the specified HTTP method

EndpointRequest.toAnyEndpoint().withHttpMethod(...) restricted
endpoint paths but still allowed any HTTP method for the links
path, yet the mappings for the links path are only registered
for GET requests.

Restrict the links path using the configured HttpMethod in both
servlet and reactive matchers.

Signed-off-by: Lee JiWon <dlwldnjs1009@gmail.com>

See gh-50095

Author: dlwldnjs1009

spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/EndpointRequest.java

@@ -119,7 +119,7 @@ public static EndpointServerWebExchangeMatcher to(String... endpoints) {
 	 * @return the configured {@link ServerWebExchangeMatcher}
 	 */
 	public static LinksServerWebExchangeMatcher toLinks() {
-		return new LinksServerWebExchangeMatcher();
+		return new LinksServerWebExchangeMatcher(null);
 	}
 
 	/**
@@ -335,7 +335,7 @@ protected ServerWebExchangeMatcher createDelegate(PathMappedEndpoints endpoints)
 			List<ServerWebExchangeMatcher> delegateMatchers = getDelegateMatchers(paths, this.httpMethod);
 			String linksPath = getLinksPath(endpoints.getBasePath());
 			if (this.includeLinks && linksPath != null) {
-				delegateMatchers.add(new LinksServerWebExchangeMatcher());
+				delegateMatchers.add(new LinksServerWebExchangeMatcher(this.httpMethod));
 			}
 			if (delegateMatchers.isEmpty()) {
 				return EMPTY_MATCHER;
@@ -364,18 +364,21 @@ public String toString() {
 	 */
 	public static final class LinksServerWebExchangeMatcher extends AbstractWebExchangeMatcher<WebEndpointProperties> {
 
-		private LinksServerWebExchangeMatcher() {
+		private final HttpMethod httpMethod;
+
+		private LinksServerWebExchangeMatcher(HttpMethod httpMethod) {
 			super(WebEndpointProperties.class);
+			this.httpMethod = httpMethod;
 		}
 
 		@Override
 		protected ServerWebExchangeMatcher createDelegate(WebEndpointProperties properties) {
 			String linksPath = getLinksPath(properties.getBasePath());
 			if (linksPath != null) {
 				List<ServerWebExchangeMatcher> linksMatchers = new ArrayList<>();
-				linksMatchers.add(new PathPatternParserServerWebExchangeMatcher(linksPath));
+				linksMatchers.add(new PathPatternParserServerWebExchangeMatcher(linksPath, this.httpMethod));
 				if (!linksPath.endsWith("/")) {
-					linksMatchers.add(new PathPatternParserServerWebExchangeMatcher(linksPath + "/"));
+					linksMatchers.add(new PathPatternParserServerWebExchangeMatcher(linksPath + "/", this.httpMethod));
 				}
 				return new OrServerWebExchangeMatcher(linksMatchers);
 			}

spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java

@@ -225,11 +225,11 @@ protected final List<RequestMatcher> getDelegateMatchers(RequestMatcherFactory r
 		}
 
 		protected List<RequestMatcher> getLinksMatchers(RequestMatcherFactory requestMatcherFactory,
-				RequestMatcherProvider matcherProvider, String linksPath) {
+				RequestMatcherProvider matcherProvider, HttpMethod httpMethod, String linksPath) {
 			List<RequestMatcher> linksMatchers = new ArrayList<>();
-			linksMatchers.add(requestMatcherFactory.antPath(matcherProvider, null, linksPath));
+			linksMatchers.add(requestMatcherFactory.antPath(matcherProvider, httpMethod, linksPath));
 			if (!linksPath.endsWith("/")) {
-				linksMatchers.add(requestMatcherFactory.antPath(matcherProvider, null, linksPath, "/"));
+				linksMatchers.add(requestMatcherFactory.antPath(matcherProvider, httpMethod, linksPath, "/"));
 			}
 			return linksMatchers;
 		}
@@ -375,7 +375,8 @@ protected RequestMatcher createDelegate(WebApplicationContext context,
 			String basePath = endpoints.getBasePath();
 			String linksPath = getLinksPath(context, basePath);
 			if (this.includeLinks && linksPath != null) {
-				delegateMatchers.addAll(getLinksMatchers(requestMatcherFactory, matcherProvider, linksPath));
+				delegateMatchers
+					.addAll(getLinksMatchers(requestMatcherFactory, matcherProvider, this.httpMethod, linksPath));
 			}
 			if (delegateMatchers.isEmpty()) {
 				return EMPTY_MATCHER;
@@ -411,7 +412,7 @@ protected RequestMatcher createDelegate(WebApplicationContext context,
 			String linksPath = getLinksPath(context, properties.getBasePath());
 			if (linksPath != null) {
 				return new OrRequestMatcher(
-						getLinksMatchers(requestMatcherFactory, getRequestMatcherProvider(context), linksPath));
+						getLinksMatchers(requestMatcherFactory, getRequestMatcherProvider(context), null, linksPath));
 			}
 			return EMPTY_MATCHER;
 		}

spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/reactive/EndpointRequestTests.java

@@ -73,6 +73,10 @@ void toAnyEndpointWithHttpMethodShouldRespectRequestMethod() {
 		ServerWebExchangeMatcher matcher = EndpointRequest.toAnyEndpoint().withHttpMethod(HttpMethod.POST);
 		assertMatcher(matcher, "/actuator").matches(HttpMethod.POST, "/actuator/foo");
 		assertMatcher(matcher, "/actuator").doesNotMatch(HttpMethod.GET, "/actuator/foo");
+		assertMatcher(matcher, "/actuator").matches(HttpMethod.POST, "/actuator");
+		assertMatcher(matcher, "/actuator").doesNotMatch(HttpMethod.GET, "/actuator");
+		assertMatcher(matcher, "/actuator").matches(HttpMethod.POST, "/actuator/");
+		assertMatcher(matcher, "/actuator").doesNotMatch(HttpMethod.GET, "/actuator/");
 	}
 
 	@Test

spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequestTests.java

@@ -73,6 +73,10 @@ void toAnyEndpointWithHttpMethodShouldRespectRequestMethod() {
 			.withHttpMethod(HttpMethod.POST);
 		assertMatcher(matcher, "/actuator").matches(HttpMethod.POST, "/actuator/foo");
 		assertMatcher(matcher, "/actuator").doesNotMatch(HttpMethod.GET, "/actuator/foo");
+		assertMatcher(matcher, "/actuator").matches(HttpMethod.POST, "/actuator");
+		assertMatcher(matcher, "/actuator").doesNotMatch(HttpMethod.GET, "/actuator");
+		assertMatcher(matcher, "/actuator").matches(HttpMethod.POST, "/actuator/");
+		assertMatcher(matcher, "/actuator").doesNotMatch(HttpMethod.GET, "/actuator/");
 	}
 
 	@Test