RegexRequestMatcher.matches() allocates LogMessage wrapper on every request even when debug disabled

[onukristo]

Describe the bug
web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:136 allocates memory and wastes CPU when debug logging is disabled - a typical production scenario.

OrRequestMatcher.matches calls every child matcher per request, so this multiplies by the number of regex rules in the security config.

Proposed fix: wrap with isDebugEnabled()

Stacktrace:

  org.springframework.core.log.LogMessage$FormatMessage2.<init>(String, Object, Object)
  org.springframework.core.log.LogMessage.format(String, Object, Object)
  org.springframework.security.web.util.matcher.RegexRequestMatcher.matches(HttpServletRequest)
  org.springframework.security.web.util.matcher.OrRequestMatcher.matches(HttpServletRequest)
  org.springframework.security.web.DefaultSecurityFilterChain.matches(HttpServletRequest)
  org.springframework.security.web.FilterChainProxy.getFilters(HttpServletRequest)
  org.springframework.security.web.FilterChainProxy.doFilterInternal(ServletRequest, ServletResponse, FilterChain)
  org.springframework.security.web.FilterChainProxy.doFilter(ServletRequest, ServletResponse, FilterChain)

[therepanic]

Hi, @onukristo. Thanks for the report. This issue is not straightforward to resolve completely, as it occurs in other places as well. Therefore, I decided to fix what I believe are the most heavily loaded areas where this problem occurs, with the intention of later opening a full issue to resolve the problem. All changes and discussion can be viewed in the PR I opened: #19253