Skip to content

MOSU fix: 화이트리스트 추가 #234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wlgns12370 merged 1 commit into from
Aug 7, 2025
Merged

MOSU fix: 화이트리스트 추가 #234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/main/java/life/mosu/mosuserver/global/filter/Whitelist.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,9 @@ public enum Whitelist {
NOTICE("/api/v1/notice", WhitelistMethod.GET),
USER_ID_CHECK("/api/v1/user/check-id", WhitelistMethod.GET),
CUSTOMER_KEY_CHECK("/api/v1/user/customer-key", WhitelistMethod.GET),
EXAM("/api/v1/exam", WhitelistMethod.GET),
EXAM_AREAS("/api/v1/exam/areas", WhitelistMethod.GET),
EXAM_ALL("/api/v1/exam/all", WhitelistMethod.GET),
Comment on lines +44 to +46
Copy link

@gemini-code-assist gemini-code-assist bot Aug 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

There are two issues with the new whitelist entries that will prevent them from working as intended:

  1. Incorrect Path: The ExamController is mapped to /exams (plural), but the whitelist paths use /exam (singular). For example, a request to /api/v1/exams/all will not be matched by /api/v1/exam/all.

  2. Incorrect Matching due to Order: The whitelist check uses requestUri.startsWith(path). Because of this, a request to /api/v1/exams/all would be incorrectly matched by the /api/v1/exams rule if it appears first in the enum, as "/api/v1/exams/all".startsWith("/api/v1/exams") is true. More specific paths must be declared before less specific ones to be matched correctly.

I've provided a suggestion that corrects the paths to use exams and reorders the entries to ensure correct matching.

Suggested change
EXAM("/api/v1/exam", WhitelistMethod.GET),
EXAM_AREAS("/api/v1/exam/areas", WhitelistMethod.GET),
EXAM_ALL("/api/v1/exam/all", WhitelistMethod.GET),
EXAM_ALL("/api/v1/exams/all", WhitelistMethod.GET),
EXAM_AREAS("/api/v1/exams/areas", WhitelistMethod.GET),
EXAM("/api/v1/exams", WhitelistMethod.GET),


APPLICATION_GUEST("/api/v1/applications/guest", WhitelistMethod.ALL);
private final String path;
Expand Down
3 changes: 0 additions & 3 deletions src/main/java/life/mosu/mosuserver/presentation/exam/ExamController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,15 +37,13 @@ public ResponseEntity<ApiResponseWrapper<Void>> register(
}

@GetMapping("/all")
@PreAuthorize("isAuthenticated() and hasRole('ADMIN')")
public ResponseEntity<ApiResponseWrapper<List<ExamResponse>>> getExams() {
List<ExamResponse> response = examService.getExams();
return ResponseEntity.ok(
ApiResponseWrapper.success(HttpStatus.OK, "전체 시험 정보 조회 성공", response));
}

@GetMapping
@PreAuthorize("isAuthenticated() and hasRole('USER')")
public ResponseEntity<ApiResponseWrapper<List<ExamResponse>>> getByArea(
@RequestParam String areaName
) {
Expand All @@ -55,7 +53,6 @@ public ResponseEntity<ApiResponseWrapper<List<ExamResponse>>> getByArea(
}

@GetMapping("/areas")
@PreAuthorize("isAuthenticated() and hasRole('USER')")
public ResponseEntity<ApiResponseWrapper<List<String>>> getDistinctAreas() {
List<String> response = examService.getDistinctAreas();
return ResponseEntity.ok(
Expand Down