[SLING-4701] SlingAuthenticator.isAnonAllowed matches for all paths starting with the same characters

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: Auth Core 1.3.6
• Component/s: Authentication
• Labels: authentication
• Assignee: Konrad Windszus
• Reporter: Lars Krapf
• Created: 07/May/15 14:15
• Updated: 14/Sep/16 11:22
• Resolved: 03/Nov/15 13:17

Description

The SlingAuthenticator check if anonymous access is allowed compares paths with String.startsWith. If the holder.path does not end with a '/' it will erroneously match a different path that starts with the same characters, even if it is not a descendant of the first path.

Example:

• Allow anonymous acces on '/'
• Deny anonymous access on a path '/blubb'
  -> Authentication is enforced on a request to '/blubb-blah' - which is wrong.

Issue Links

• relates to: SLING-6053 SlingAuthenticator identifies wrong sibling node with AuthenticationInfo