You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by jo...@apache.org on 2026/10/08 07:44:17 UTC
(sling-org-apache-sling-api) branch SLING-13380 created (now d40296d)
This is an automated email from the ASF dual-hosted git repository.
joerghoh pushed a change to branch SLING-13380
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-api.git
at d40296d SLING-13380 document existing (incorrect) behavior of Path.matches() and PathSet.matches()
This branch includes the following new commits:
new d40296d SLING-13380 document existing (incorrect) behavior of Path.matches() and PathSet.matches()
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(sling-org-apache-sling-api) 01/01: SLING-13380 document existing (incorrect) behavior of Path.matches() and PathSet.matches()
Posted by jo...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
joerghoh pushed a commit to branch SLING-13380
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-api.git
commit d40296d3c778c7403dcdf34e41340176a29ed8f5
Author: Joerg Hoh <jo...@apache.org>
AuthorDate: Thu Oct 8 09:44:00 2026 +0200
SLING-13380 document existing (incorrect) behavior of Path.matches() and PathSet.matches()
---
src/main/java/org/apache/sling/api/resource/path/Path.java | 14 ++++++++++++--
.../java/org/apache/sling/api/resource/path/PathSet.java | 8 ++++++++
.../org/apache/sling/api/resource/path/PathSetTest.java | 10 ++++++++++
.../java/org/apache/sling/api/resource/path/PathTest.java | 10 ++++++++++
4 files changed, 40 insertions(+), 2 deletions(-)
diff --git a/src/main/java/org/apache/sling/api/resource/path/Path.java b/src/main/java/org/apache/sling/api/resource/path/Path.java
index 77326aa..bccd814 100644
--- a/src/main/java/org/apache/sling/api/resource/path/Path.java
+++ b/src/main/java/org/apache/sling/api/resource/path/Path.java
@@ -102,8 +102,18 @@ public class Path implements Comparable<Path> {
* provided path matches the pattern. If this path object holds a pattern
* and a pattern is provided as the argument, it returns only {@code true}
* if the pattern is the same.
- * If the provided argument is not an absolute path (e.g. if it is a relative
- * path or a pattern), this method returns {@code false}.
+ * If the provided argument is not an absolute path or an absolute glob
+ * pattern, this method throws {@code IllegalArgumentException}.
+ *
+ * <p><strong>Warning:</strong> A glob pattern supplied as {@code otherPath}
+ * can produce an incorrect result if this method is used as a containment
+ * check. For example, {@code new Path("/apps").matches("glob:/**")} returns
+ * {@code true}, although {@code glob:/**} is not a concrete path inside
+ * {@code /apps} and also matches paths outside that subtree. Pattern
+ * arguments establish overlap, not containment of all matching paths.
+ * For concrete-path containment or authorization checks, callers must
+ * ensure that {@code otherPath} is a concrete absolute path, not a glob
+ * pattern. See <a href="https://issues.apache.org/jira/browse/SLING-13380">SLING-13380</a>.</p>
*
* @param otherPath Absolute path to check.
* @return {@code true} If other path is within the sub tree of this path
diff --git a/src/main/java/org/apache/sling/api/resource/path/PathSet.java b/src/main/java/org/apache/sling/api/resource/path/PathSet.java
index 3bb6324..fb9fd3a 100644
--- a/src/main/java/org/apache/sling/api/resource/path/PathSet.java
+++ b/src/main/java/org/apache/sling/api/resource/path/PathSet.java
@@ -125,6 +125,14 @@ public class PathSet implements Iterable<Path> {
/**
* Check whether the provided path is in the sub tree of any
* of the paths in this set.
+ *
+ * <p><strong>Warning:</strong> Glob patterns supplied as {@code otherPath}
+ * can produce incorrect containment results. See {@link Path#matches(String)}
+ * for an example and the distinction between pattern overlap and containment.
+ * For concrete-path containment or authorization checks, callers must
+ * ensure that {@code otherPath} is a concrete absolute path, not a glob
+ * pattern. See <a href="https://issues.apache.org/jira/browse/SLING-13380">SLING-13380</a>.</p>
+ *
* @param otherPath The path to match
* @return The path which matches the provided path, {@code null} otherwise.
* @see Path#matches(String)
diff --git a/src/test/java/org/apache/sling/api/resource/path/PathSetTest.java b/src/test/java/org/apache/sling/api/resource/path/PathSetTest.java
index 734eadd..4704443 100644
--- a/src/test/java/org/apache/sling/api/resource/path/PathSetTest.java
+++ b/src/test/java/org/apache/sling/api/resource/path/PathSetTest.java
@@ -113,6 +113,16 @@ public class PathSetTest {
assertEquals(new Path("/x/y"), set.matches("/x/y/g/e"));
}
+ @Test
+ public void testGlobArgumentProducesIncorrectContainmentResult() {
+ final PathSet set = PathSet.fromStrings("/apps");
+
+ // Document known incorrect containment behavior inherited from Path.matches().
+ assertEquals(new Path("/apps"), set.matches("glob:/**"));
+ assertEquals(new Path("/apps"), set.matches("glob:/apps/**"));
+ assertNull(set.matches("/etc/secret"));
+ }
+
@Test
public void testToStringSet() {
final PathSet set = PathSet.fromStrings("/a", "/x/y");
diff --git a/src/test/java/org/apache/sling/api/resource/path/PathTest.java b/src/test/java/org/apache/sling/api/resource/path/PathTest.java
index 0450693..f35c7ec 100644
--- a/src/test/java/org/apache/sling/api/resource/path/PathTest.java
+++ b/src/test/java/org/apache/sling/api/resource/path/PathTest.java
@@ -63,6 +63,16 @@ public class PathTest {
assertMatch(p, "/content", "/content/a", "/content/a/b");
}
+ @Test
+ public void testGlobArgumentProducesIncorrectContainmentResult() {
+ final Path path = new Path("/apps");
+
+ // Document known incorrect containment behavior, not a desired membership result.
+ assertTrue(path.matches("glob:/**"));
+ assertTrue(path.matches("glob:/apps/**"));
+ assertFalse(path.matches("/etc/secret"));
+ }
+
@Test
public void testPatternMatchingA() {
final Path p = new Path("glob:/apps/**/*.html");