Suggestions

Hello,

I'm looking to use securityfilter in a project soon. It seems like just
what I need, but looking at the code I do have a few questions/comments:

a) "replace '/' chars with '/+' to match one or more consecutive slashes"
  seems wrong to me. Can you give me a pointer to the relevant portion
  of the Servlet spec?

b) I really do not see a need for a regular expression library. Here is
an alternative implementation:

   private String matchAgainst; // new field
   protected void initPatternType() {
      if (pattern.startsWith("*.")) {
         patternType = URLPattern.EXTENSION_TYPE;
         matchAgainst = pattern.substring(1);
      } else if (pattern.startsWith("/") && pattern.endsWith("/*")) {
         patternType = URLPattern.PATH_TYPE;
         matchAgainst = pattern.substring(0, pattern.length() - 1);
      } else {
         patternType = URLPattern.EXACT_TYPE;
         matchAgainst = pattern;
      }
   }
   // new method
   protected boolean match(String path) {
        switch (type) {
        case PATH_TYPE:
            return path.startsWith(matchAgainst);
        case EXTENSION_TYPE:
            return path.endsWith(matchAgainst);
        default:
            return path.equals(matchAgainst);
        }
    }

I'm sure this is faster, and doesn't have threading issues (I have
similar code in a web.xml parser I wrote recently).

c) URLPattern is missing the concept of the "default" servlet. A
URLPattern of "/" should match against any path (after all exact, path,
and extension mappings have failed, of course). See section 11.2 of the
Servlet 2.3 spec.

d) What is the status of user-data-constraint support?

I'm happy to produce patches for any or all of these things if you
agree.

Thanks,
Chris


-------------------------------------------------------
This SF.NET email is sponsored by: Geek Gift Procrastinating?
Get the perfect geek gift now!  Before the Holidays pass you by.
T H I N K G E E K . C O M      http://www.thinkgeek.com/sf/