use spring security

Author: rwinch

gradle.properties

@@ -1,2 +1,2 @@
 springVersion=6.1.4
-springSecurityVersion=6.5.7
+springSecurityVersion=7.1.0-SNAPSHOT

ssrf/build.gradle

@@ -12,6 +12,7 @@ plugins {
 repositories {
 	// Use Maven Central for resolving dependencies.
 	mavenCentral()
+	mavenLocal()
 }
 
 dependencies {

ssrf/src/main/java/org/springframework/boot/http/client/HttpComponentsFilteringDnsResolver.java

@@ -23,20 +23,20 @@
 import org.apache.hc.client5.http.DnsResolver;
 import org.apache.hc.client5.http.SystemDefaultDnsResolver;
 
-import org.springframework.security.web.util.matcher.InetAddressFilter;
+import org.springframework.security.web.util.matcher.InetAddressMatcher;
 
 public class HttpComponentsFilteringDnsResolver implements DnsResolver {
 
 	private final DnsResolver delegate;
 
-	private final InetAddressFilter filter;
+	private final InetAddressMatcher filter;
 
 
-	public HttpComponentsFilteringDnsResolver(InetAddressFilter filter) {
+	public HttpComponentsFilteringDnsResolver(InetAddressMatcher filter) {
 		this(SystemDefaultDnsResolver.INSTANCE, filter);
 	}
 
-	public HttpComponentsFilteringDnsResolver(DnsResolver delegate, InetAddressFilter filter) {
+	public HttpComponentsFilteringDnsResolver(DnsResolver delegate, InetAddressMatcher filter) {
 		this.delegate = delegate;
 		this.filter = filter;
 	}
@@ -45,7 +45,7 @@ public HttpComponentsFilteringDnsResolver(DnsResolver delegate, InetAddressFilte
 	@Override
 	public InetAddress[] resolve(String host) throws UnknownHostException {
 		return Arrays.stream(this.delegate.resolve(host))
-				.filter(this.filter::filter).toArray(InetAddress[]::new);
+				.filter(this.filter::matches).toArray(InetAddress[]::new);
 	}
 
 	@Override

ssrf/src/main/java/org/springframework/boot/http/client/JettyHttpClientFilteringDnsResolver.java

@@ -23,16 +23,16 @@
 import org.eclipse.jetty.util.Promise;
 import org.eclipse.jetty.util.SocketAddressResolver;
 
-import org.springframework.security.web.util.matcher.InetAddressFilter;
+import org.springframework.security.web.util.matcher.InetAddressMatcher;
 
 public class JettyHttpClientFilteringDnsResolver implements SocketAddressResolver {
 
 	private final SocketAddressResolver delegate;
 
-	private final InetAddressFilter filter;
+	private final InetAddressMatcher filter;
 
 
-	public JettyHttpClientFilteringDnsResolver(SocketAddressResolver delegate, InetAddressFilter filter) {
+	public JettyHttpClientFilteringDnsResolver(SocketAddressResolver delegate, InetAddressMatcher filter) {
 		this.delegate = delegate;
 		this.filter = filter;
 	}
@@ -42,7 +42,7 @@ public JettyHttpClientFilteringDnsResolver(SocketAddressResolver delegate, InetA
 	 * as the delegate resolver.
 	 * @param filter the filter to apply security rules to the resolved addresses.
 	 */
-	public JettyHttpClientFilteringDnsResolver(InetAddressFilter filter) {
+	public JettyHttpClientFilteringDnsResolver(InetAddressMatcher filter) {
 		// Call the primary constructor, using the fully qualified name for the nested static class
 		SocketAddressResolver resolver = new Sync();
 		this.delegate = resolver;
@@ -58,7 +58,7 @@ public void resolve(String host, int port, Promise<List<InetSocketAddress>> oute
 			public void succeeded(List<InetSocketAddress> candidates) {
 				outerPromise.succeeded(candidates.stream()
 						.map(InetSocketAddress::getAddress)
-						.filter(filter::filter)
+						.filter(filter::matches)
 						.map(address -> new InetSocketAddress(address, port))
 						.toList());
 			}

ssrf/src/main/java/org/springframework/boot/http/client/NettyHttpClientFilteringAddressSelector.java

@@ -28,24 +28,25 @@
 import reactor.netty.transport.ClientTransport.ResolvedAddressSelector;
 import reactor.netty.transport.ClientTransportConfig;
 
-import org.springframework.security.web.util.matcher.InetAddressFilter;
+import org.springframework.security.web.util.matcher.InetAddressMatcher;
+import org.springframework.security.web.util.matcher.InetAddressMatcher;
 
 /**
- * A {@link ResolvedAddressSelector} that uses a {@link InetAddressFilter} to filter a list of
+ * A {@link ResolvedAddressSelector} that uses a {@link InetAddressMatcher} to filter a list of
  * resolved {@link SocketAddress}es for a Reactor Netty client.
  *
  * @see reactor.netty.http.client.HttpClient#resolvedAddressesSelector(ResolvedAddressSelector)
  */
 public class NettyHttpClientFilteringAddressSelector implements ResolvedAddressSelector<ClientTransportConfig<?>> {
 
-	private final InetAddressFilter filter;
+	private final InetAddressMatcher filter;
 
 	/**
 	 * Creates a new instance.
 	 * @param filter The filter to apply security rules to the resolved addresses.
 	 */
-	public NettyHttpClientFilteringAddressSelector(InetAddressFilter filter) {
-		Objects.requireNonNull(filter, "InetAddressFilter must not be null");
+	public NettyHttpClientFilteringAddressSelector(InetAddressMatcher filter) {
+		Objects.requireNonNull(filter, "InetAddressMatcher must not be null");
 		this.filter = filter;
 	}
 
@@ -72,7 +73,7 @@ private List<SocketAddress> filterInternal(List<? extends SocketAddress> socketA
 				.filter(InetSocketAddress.class::isInstance)
 				.map(InetSocketAddress.class::cast)
 				.map(InetSocketAddress::getAddress)
-				.filter(this.filter::filter)
+				.filter(this.filter::matches)
 				.toList();
 
 		return socketAddresses.stream()