From f20ae1a71c81df00e10de48ffab79fa4b6c35c02 Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Wed, 31 Jul 2024 15:47:40 -0600 Subject: [PATCH] Revert gh-13783 This feature unfortunately regresses pre-existing behavior like that found in gh-15352. As such, this functionality has been removed. Closes gh-15352 --- ...ePostMethodSecurityConfigurationTests.java | 34 ++++++++++++ .../AbstractExpressionAttributeRegistry.java | 7 +-- .../method/Jsr250AuthorizationManager.java | 6 +-- ...tAuthorizeExpressionAttributeRegistry.java | 15 +++--- ...PostFilterExpressionAttributeRegistry.java | 9 ++-- ...eAuthorizeExpressionAttributeRegistry.java | 15 +++--- .../PreFilterExpressionAttributeRegistry.java | 9 ++-- .../method/SecuredAuthorizationManager.java | 11 ++-- .../Jsr250AuthorizationManagerTests.java | 52 +------------------ ...ostAuthorizeAuthorizationManagerTests.java | 25 +-------- ...erAuthorizationMethodInterceptorTests.java | 30 +---------- ...PreAuthorizeAuthorizationManagerTests.java | 24 +-------- ...erAuthorizationMethodInterceptorTests.java | 28 +--------- .../SecuredAuthorizationManagerTests.java | 24 +-------- 14 files changed, 70 insertions(+), 219 deletions(-) diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java index 69a42a7e473..a2f82afe6d6 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java @@ -28,6 +28,7 @@ import java.util.function.Consumer; import java.util.function.Supplier; +import jakarta.annotation.security.DenyAll; import org.aopalliance.intercept.MethodInterceptor; import org.aopalliance.intercept.MethodInvocation; import org.junit.jupiter.api.Test; @@ -50,6 +51,7 @@ import org.springframework.security.access.annotation.BusinessServiceImpl; import org.springframework.security.access.annotation.ExpressionProtectedBusinessServiceImpl; import org.springframework.security.access.annotation.Jsr250BusinessServiceImpl; +import org.springframework.security.access.annotation.Secured; import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler; import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler; import org.springframework.security.access.hierarchicalroles.RoleHierarchy; @@ -944,6 +946,13 @@ void getUserWhenNotAuthorizedThenHandlerUsesCustomAuthorizationDecision() { verify(handler, never()).handleDeniedInvocation(any(), any(Authz.AuthzResult.class)); } + // gh-15352 + @Test + void annotationsInChildClassesDoNotAffectSuperclasses() { + this.spring.register(AbstractClassConfig.class).autowire(); + this.spring.getContext().getBean(ClassInheritingAbstractClassWithNoAnnotations.class).method(); + } + private static Consumer disallowBeanOverriding() { return (context) -> ((AnnotationConfigWebApplicationContext) context).setAllowBeanDefinitionOverriding(false); } @@ -1480,4 +1489,29 @@ MethodAuthorizationDeniedHandler methodAuthorizationDeniedHandler() { } + abstract static class AbstractClassWithNoAnnotations { + + String method() { + return "ok"; + } + + } + + @PreAuthorize("denyAll()") + @Secured("DENIED") + @DenyAll + static class ClassInheritingAbstractClassWithNoAnnotations extends AbstractClassWithNoAnnotations { + + } + + @EnableMethodSecurity(securedEnabled = true, jsr250Enabled = true) + static class AbstractClassConfig { + + @Bean + ClassInheritingAbstractClassWithNoAnnotations inheriting() { + return new ClassInheritingAbstractClassWithNoAnnotations(); + } + + } + } diff --git a/core/src/main/java/org/springframework/security/authorization/method/AbstractExpressionAttributeRegistry.java b/core/src/main/java/org/springframework/security/authorization/method/AbstractExpressionAttributeRegistry.java index d1aa34f8e7d..bb756e54158 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/AbstractExpressionAttributeRegistry.java +++ b/core/src/main/java/org/springframework/security/authorization/method/AbstractExpressionAttributeRegistry.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2021 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -35,7 +35,6 @@ * For internal use only, as this contract is likely to change * * @author Evgeniy Cheban - * @author DingHao */ abstract class AbstractExpressionAttributeRegistry { @@ -100,8 +99,4 @@ void setTemplateDefaults(PrePostTemplateDefaults defaults) { @NonNull abstract T resolveAttribute(Method method, Class targetClass); - Class targetClass(Method method, Class targetClass) { - return (targetClass != null) ? targetClass : method.getDeclaringClass(); - } - } diff --git a/core/src/main/java/org/springframework/security/authorization/method/Jsr250AuthorizationManager.java b/core/src/main/java/org/springframework/security/authorization/method/Jsr250AuthorizationManager.java index f913db85f68..beb318ed15f 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/Jsr250AuthorizationManager.java +++ b/core/src/main/java/org/springframework/security/authorization/method/Jsr250AuthorizationManager.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -44,7 +44,6 @@ * * @author Evgeniy Cheban * @author Josh Cummings - * @author DingHao * @since 5.6 */ public final class Jsr250AuthorizationManager implements AuthorizationManager { @@ -122,8 +121,7 @@ AuthorizationManager resolveManager(Method method, Class ta private Annotation findJsr250Annotation(Method method, Class targetClass) { Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass); Annotation annotation = findAnnotation(specificMethod); - return (annotation != null) ? annotation - : findAnnotation((targetClass != null) ? targetClass : specificMethod.getDeclaringClass()); + return (annotation != null) ? annotation : findAnnotation(specificMethod.getDeclaringClass()); } private Annotation findAnnotation(Method method) { diff --git a/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeExpressionAttributeRegistry.java b/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeExpressionAttributeRegistry.java index 7dc43f649a8..bd118bd6c81 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeExpressionAttributeRegistry.java +++ b/core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeExpressionAttributeRegistry.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -33,7 +33,6 @@ * For internal use only, as this contract is likely to change. * * @author Evgeniy Cheban - * @author DingHao * @since 5.8 */ final class PostAuthorizeExpressionAttributeRegistry extends AbstractExpressionAttributeRegistry { @@ -50,33 +49,33 @@ final class PostAuthorizeExpressionAttributeRegistry extends AbstractExpressionA @Override ExpressionAttribute resolveAttribute(Method method, Class targetClass) { Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass); - PostAuthorize postAuthorize = findPostAuthorizeAnnotation(specificMethod, targetClass); + PostAuthorize postAuthorize = findPostAuthorizeAnnotation(specificMethod); if (postAuthorize == null) { return ExpressionAttribute.NULL_ATTRIBUTE; } Expression expression = getExpressionHandler().getExpressionParser().parseExpression(postAuthorize.value()); - MethodAuthorizationDeniedHandler deniedHandler = resolveHandler(method, targetClass); + MethodAuthorizationDeniedHandler deniedHandler = resolveHandler(method); return new PostAuthorizeExpressionAttribute(expression, deniedHandler); } - private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class targetClass) { + private MethodAuthorizationDeniedHandler resolveHandler(Method method) { Function lookup = AuthorizationAnnotationUtils .withDefaults(HandleAuthorizationDenied.class); HandleAuthorizationDenied deniedHandler = lookup.apply(method); if (deniedHandler != null) { return this.handlerResolver.apply(deniedHandler.handlerClass()); } - deniedHandler = lookup.apply(targetClass(method, targetClass)); + deniedHandler = lookup.apply(method.getDeclaringClass()); if (deniedHandler != null) { return this.handlerResolver.apply(deniedHandler.handlerClass()); } return this.defaultHandler; } - private PostAuthorize findPostAuthorizeAnnotation(Method method, Class targetClass) { + private PostAuthorize findPostAuthorizeAnnotation(Method method) { Function lookup = findUniqueAnnotation(PostAuthorize.class); PostAuthorize postAuthorize = lookup.apply(method); - return (postAuthorize != null) ? postAuthorize : lookup.apply(targetClass(method, targetClass)); + return (postAuthorize != null) ? postAuthorize : lookup.apply(method.getDeclaringClass()); } /** diff --git a/core/src/main/java/org/springframework/security/authorization/method/PostFilterExpressionAttributeRegistry.java b/core/src/main/java/org/springframework/security/authorization/method/PostFilterExpressionAttributeRegistry.java index 8b80c5101c6..a212e66602b 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/PostFilterExpressionAttributeRegistry.java +++ b/core/src/main/java/org/springframework/security/authorization/method/PostFilterExpressionAttributeRegistry.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -29,7 +29,6 @@ * For internal use only, as this contract is likely to change. * * @author Evgeniy Cheban - * @author DingHao * @since 5.8 */ final class PostFilterExpressionAttributeRegistry extends AbstractExpressionAttributeRegistry { @@ -38,7 +37,7 @@ final class PostFilterExpressionAttributeRegistry extends AbstractExpressionAttr @Override ExpressionAttribute resolveAttribute(Method method, Class targetClass) { Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass); - PostFilter postFilter = findPostFilterAnnotation(specificMethod, targetClass); + PostFilter postFilter = findPostFilterAnnotation(specificMethod); if (postFilter == null) { return ExpressionAttribute.NULL_ATTRIBUTE; } @@ -47,10 +46,10 @@ ExpressionAttribute resolveAttribute(Method method, Class targetClass) { return new ExpressionAttribute(postFilterExpression); } - private PostFilter findPostFilterAnnotation(Method method, Class targetClass) { + private PostFilter findPostFilterAnnotation(Method method) { Function lookup = findUniqueAnnotation(PostFilter.class); PostFilter postFilter = lookup.apply(method); - return (postFilter != null) ? postFilter : lookup.apply(targetClass(method, targetClass)); + return (postFilter != null) ? postFilter : lookup.apply(method.getDeclaringClass()); } } diff --git a/core/src/main/java/org/springframework/security/authorization/method/PreAuthorizeExpressionAttributeRegistry.java b/core/src/main/java/org/springframework/security/authorization/method/PreAuthorizeExpressionAttributeRegistry.java index 2bfe20a9324..0a06f64c324 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/PreAuthorizeExpressionAttributeRegistry.java +++ b/core/src/main/java/org/springframework/security/authorization/method/PreAuthorizeExpressionAttributeRegistry.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -33,7 +33,6 @@ * For internal use only, as this contract is likely to change. * * @author Evgeniy Cheban - * @author DingHao * @since 5.8 */ final class PreAuthorizeExpressionAttributeRegistry extends AbstractExpressionAttributeRegistry { @@ -50,33 +49,33 @@ final class PreAuthorizeExpressionAttributeRegistry extends AbstractExpressionAt @Override ExpressionAttribute resolveAttribute(Method method, Class targetClass) { Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass); - PreAuthorize preAuthorize = findPreAuthorizeAnnotation(specificMethod, targetClass); + PreAuthorize preAuthorize = findPreAuthorizeAnnotation(specificMethod); if (preAuthorize == null) { return ExpressionAttribute.NULL_ATTRIBUTE; } Expression expression = getExpressionHandler().getExpressionParser().parseExpression(preAuthorize.value()); - MethodAuthorizationDeniedHandler handler = resolveHandler(method, targetClass); + MethodAuthorizationDeniedHandler handler = resolveHandler(method); return new PreAuthorizeExpressionAttribute(expression, handler); } - private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class targetClass) { + private MethodAuthorizationDeniedHandler resolveHandler(Method method) { Function lookup = AuthorizationAnnotationUtils .withDefaults(HandleAuthorizationDenied.class); HandleAuthorizationDenied deniedHandler = lookup.apply(method); if (deniedHandler != null) { return this.handlerResolver.apply(deniedHandler.handlerClass()); } - deniedHandler = lookup.apply(targetClass(method, targetClass)); + deniedHandler = lookup.apply(method.getDeclaringClass()); if (deniedHandler != null) { return this.handlerResolver.apply(deniedHandler.handlerClass()); } return this.defaultHandler; } - private PreAuthorize findPreAuthorizeAnnotation(Method method, Class targetClass) { + private PreAuthorize findPreAuthorizeAnnotation(Method method) { Function lookup = findUniqueAnnotation(PreAuthorize.class); PreAuthorize preAuthorize = lookup.apply(method); - return (preAuthorize != null) ? preAuthorize : lookup.apply(targetClass(method, targetClass)); + return (preAuthorize != null) ? preAuthorize : lookup.apply(method.getDeclaringClass()); } /** diff --git a/core/src/main/java/org/springframework/security/authorization/method/PreFilterExpressionAttributeRegistry.java b/core/src/main/java/org/springframework/security/authorization/method/PreFilterExpressionAttributeRegistry.java index 95425c438dd..af763c90163 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/PreFilterExpressionAttributeRegistry.java +++ b/core/src/main/java/org/springframework/security/authorization/method/PreFilterExpressionAttributeRegistry.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -29,7 +29,6 @@ * For internal use only, as this contract is likely to change. * * @author Evgeniy Cheban - * @author DingHao * @since 5.8 */ final class PreFilterExpressionAttributeRegistry @@ -39,7 +38,7 @@ final class PreFilterExpressionAttributeRegistry @Override PreFilterExpressionAttribute resolveAttribute(Method method, Class targetClass) { Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass); - PreFilter preFilter = findPreFilterAnnotation(specificMethod, targetClass); + PreFilter preFilter = findPreFilterAnnotation(specificMethod); if (preFilter == null) { return PreFilterExpressionAttribute.NULL_ATTRIBUTE; } @@ -48,10 +47,10 @@ PreFilterExpressionAttribute resolveAttribute(Method method, Class targetClas return new PreFilterExpressionAttribute(preFilterExpression, preFilter.filterTarget()); } - private PreFilter findPreFilterAnnotation(Method method, Class targetClass) { + private PreFilter findPreFilterAnnotation(Method method) { Function lookup = findUniqueAnnotation(PreFilter.class); PreFilter preFilter = lookup.apply(method); - return (preFilter != null) ? preFilter : lookup.apply(targetClass(method, targetClass)); + return (preFilter != null) ? preFilter : lookup.apply(method.getDeclaringClass()); } static final class PreFilterExpressionAttribute extends ExpressionAttribute { diff --git a/core/src/main/java/org/springframework/security/authorization/method/SecuredAuthorizationManager.java b/core/src/main/java/org/springframework/security/authorization/method/SecuredAuthorizationManager.java index 63553503d21..dcfc8a8511f 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/SecuredAuthorizationManager.java +++ b/core/src/main/java/org/springframework/security/authorization/method/SecuredAuthorizationManager.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -41,7 +41,6 @@ * contains a specified authority from the Spring Security's {@link Secured} annotation. * * @author Evgeniy Cheban - * @author DingHao * @since 5.6 */ public final class SecuredAuthorizationManager implements AuthorizationManager { @@ -87,14 +86,14 @@ private Set getAuthorities(MethodInvocation methodInvocation) { private Set resolveAuthorities(Method method, Class targetClass) { Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass); - Secured secured = findSecuredAnnotation(specificMethod, targetClass); + Secured secured = findSecuredAnnotation(specificMethod); return (secured != null) ? Set.of(secured.value()) : Collections.emptySet(); } - private Secured findSecuredAnnotation(Method method, Class targetClass) { + private Secured findSecuredAnnotation(Method method) { Secured secured = AuthorizationAnnotationUtils.findUniqueAnnotation(method, Secured.class); - return (secured != null) ? secured : AuthorizationAnnotationUtils - .findUniqueAnnotation((targetClass != null) ? targetClass : method.getDeclaringClass(), Secured.class); + return (secured != null) ? secured + : AuthorizationAnnotationUtils.findUniqueAnnotation(method.getDeclaringClass(), Secured.class); } } diff --git a/core/src/test/java/org/springframework/security/authorization/method/Jsr250AuthorizationManagerTests.java b/core/src/test/java/org/springframework/security/authorization/method/Jsr250AuthorizationManagerTests.java index 59187469232..5a35b884895 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/Jsr250AuthorizationManagerTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/Jsr250AuthorizationManagerTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -225,56 +225,6 @@ public void checkInheritedAnnotationsWhenConflictingThenAnnotationConfigurationE .isThrownBy(() -> manager.check(authentication, methodInvocation)); } - @Test - public void checkRequiresUserWhenMethodsFromInheritThenApplies() throws Exception { - MockMethodInvocation methodInvocation = new MockMethodInvocation(new RolesAllowedClass(), - RolesAllowedClass.class, "securedUser"); - Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager(); - AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation); - assertThat(decision.isGranted()).isTrue(); - } - - @Test - public void checkPermitAllWhenMethodsFromInheritThenApplies() throws Exception { - MockMethodInvocation methodInvocation = new MockMethodInvocation(new PermitAllClass(), PermitAllClass.class, - "securedUser"); - Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager(); - AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation); - assertThat(decision.isGranted()).isTrue(); - } - - @Test - public void checkDenyAllWhenMethodsFromInheritThenApplies() throws Exception { - MockMethodInvocation methodInvocation = new MockMethodInvocation(new DenyAllClass(), DenyAllClass.class, - "securedUser"); - Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager(); - AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation); - assertThat(decision.isGranted()).isFalse(); - } - - @RolesAllowed("USER") - public static class RolesAllowedClass extends ParentClass { - - } - - @PermitAll - public static class PermitAllClass extends ParentClass { - - } - - @DenyAll - public static class DenyAllClass extends ParentClass { - - } - - public static class ParentClass { - - public void securedUser() { - - } - - } - public static class TestClass implements InterfaceAnnotationsOne, InterfaceAnnotationsTwo { public void doSomething() { diff --git a/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java b/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java index 8d0cbbf61aa..37383b40d57 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/PostAuthorizeAuthorizationManagerTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -167,29 +167,6 @@ public void checkInheritedAnnotationsWhenConflictingThenAnnotationConfigurationE .isThrownBy(() -> manager.check(authentication, result)); } - @Test - public void checkRequiresUserWhenMethodsFromInheritThenApplies() throws Exception { - MockMethodInvocation methodInvocation = new MockMethodInvocation(new PostAuthorizeClass(), - PostAuthorizeClass.class, "securedUser"); - MethodInvocationResult result = new MethodInvocationResult(methodInvocation, null); - PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager(); - AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, result); - assertThat(decision.isGranted()).isTrue(); - } - - @PostAuthorize("hasRole('USER')") - public static class PostAuthorizeClass extends ParentClass { - - } - - public static class ParentClass { - - public void securedUser() { - - } - - } - public static class TestClass implements InterfaceAnnotationsOne, InterfaceAnnotationsTwo { public void doSomething() { diff --git a/core/src/test/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodInterceptorTests.java b/core/src/test/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodInterceptorTests.java index 48eec006186..00f2aed42dd 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodInterceptorTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodInterceptorTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -170,34 +170,6 @@ public Object proceed() { SecurityContextHolder.setContextHolderStrategy(saved); } - @Test - public void checkPostFilterWhenMethodsFromInheritThenApplies() throws Throwable { - String[] array = { "john", "bob" }; - MockMethodInvocation methodInvocation = new MockMethodInvocation(new PostFilterClass(), PostFilterClass.class, - "inheritMethod", new Class[] { String[].class }, new Object[] { array }) { - @Override - public Object proceed() { - return array; - } - }; - PostFilterAuthorizationMethodInterceptor advice = new PostFilterAuthorizationMethodInterceptor(); - Object result = advice.invoke(methodInvocation); - assertThat(result).asInstanceOf(InstanceOfAssertFactories.array(String[].class)).containsOnly("john"); - } - - @PostFilter("filterObject == 'john'") - public static class PostFilterClass extends ParentClass { - - } - - public static class ParentClass { - - public String[] inheritMethod(String[] array) { - return array; - } - - } - @PostFilter("filterObject == 'john'") public static class TestClass implements InterfaceAnnotationsOne, InterfaceAnnotationsTwo { diff --git a/core/src/test/java/org/springframework/security/authorization/method/PreAuthorizeAuthorizationManagerTests.java b/core/src/test/java/org/springframework/security/authorization/method/PreAuthorizeAuthorizationManagerTests.java index 6b8153ba618..cb43868dbf0 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/PreAuthorizeAuthorizationManagerTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/PreAuthorizeAuthorizationManagerTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -147,28 +147,6 @@ public void checkTargetClassAwareWhenInterfaceLevelAnnotationsThenApplies() thro assertThat(decision.isGranted()).isTrue(); } - @Test - public void checkRequiresUserWhenMethodsFromInheritThenApplies() throws Exception { - MockMethodInvocation methodInvocation = new MockMethodInvocation(new PreAuthorizeClass(), - PreAuthorizeClass.class, "securedUser"); - PreAuthorizeAuthorizationManager manager = new PreAuthorizeAuthorizationManager(); - AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation); - assertThat(decision.isGranted()).isTrue(); - } - - @PreAuthorize("hasRole('USER')") - public static class PreAuthorizeClass extends ParentClass { - - } - - public static class ParentClass { - - public void securedUser() { - - } - - } - public static class TestClass implements InterfaceAnnotationsOne, InterfaceAnnotationsTwo { public void doSomething() { diff --git a/core/src/test/java/org/springframework/security/authorization/method/PreFilterAuthorizationMethodInterceptorTests.java b/core/src/test/java/org/springframework/security/authorization/method/PreFilterAuthorizationMethodInterceptorTests.java index 30d40a369fe..4f1d56fb146 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/PreFilterAuthorizationMethodInterceptorTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/PreFilterAuthorizationMethodInterceptorTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -224,32 +224,6 @@ public void preFilterWhenStaticSecurityContextHolderStrategyAfterConstructorThen SecurityContextHolder.setContextHolderStrategy(saved); } - @Test - public void checkPreFilterWhenMethodsFromInheritThenApplies() throws Throwable { - List list = new ArrayList<>(); - list.add("john"); - list.add("bob"); - MockMethodInvocation invocation = new MockMethodInvocation(new PreFilterClass(), PreFilterClass.class, - "inheritMethod", new Class[] { List.class }, new Object[] { list }); - PreFilterAuthorizationMethodInterceptor advice = new PreFilterAuthorizationMethodInterceptor(); - advice.invoke(invocation); - assertThat(list).hasSize(1); - assertThat(list.get(0)).isEqualTo("john"); - } - - @PreFilter("filterObject == 'john'") - public static class PreFilterClass extends ParentClass { - - } - - public static class ParentClass { - - public void inheritMethod(List list) { - - } - - } - @PreFilter("filterObject == 'john'") public static class TestClass implements InterfaceAnnotationsOne, InterfaceAnnotationsTwo { diff --git a/core/src/test/java/org/springframework/security/authorization/method/SecuredAuthorizationManagerTests.java b/core/src/test/java/org/springframework/security/authorization/method/SecuredAuthorizationManagerTests.java index 5567ad7ae64..5d8651df9e8 100644 --- a/core/src/test/java/org/springframework/security/authorization/method/SecuredAuthorizationManagerTests.java +++ b/core/src/test/java/org/springframework/security/authorization/method/SecuredAuthorizationManagerTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -167,28 +167,6 @@ public void checkTargetClassAwareWhenInterfaceLevelAnnotationsThenApplies() thro assertThat(decision.isGranted()).isTrue(); } - @Test - public void checkRequiresUserWhenMethodsFromInheritThenApplies() throws Exception { - MockMethodInvocation methodInvocation = new MockMethodInvocation(new SecuredSonClass(), SecuredSonClass.class, - "securedUser"); - SecuredAuthorizationManager manager = new SecuredAuthorizationManager(); - AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation); - assertThat(decision.isGranted()).isTrue(); - } - - @Secured("ROLE_USER") - public static class SecuredSonClass extends ParentClass { - - } - - public static class ParentClass { - - public void securedUser() { - - } - - } - public static class TestClass implements InterfaceAnnotationsOne, InterfaceAnnotationsTwo { public void doSomething() {