From 0f7c2e41283f9c24160a4222dae750703181970a Mon Sep 17 00:00:00 2001 From: Oliver Gierke Date: Thu, 27 Nov 2014 19:48:42 +0100 Subject: [PATCH] SEC-2773: Prevent premature container initialization in WebSecurityConfiguration. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Changed the bean definition method for the DelegatingApplicationListener to be static to avoid the need to instantiate the configuration class which caused further premature initializations to satisfy the dependencies expressed in setFilterChainProxySecurityConfigurer(…). --- .../annotation/web/configuration/WebSecurityConfiguration.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java index 62d1f99f4c..3ddb4ee862 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java @@ -74,7 +74,7 @@ public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAwa private ClassLoader beanClassLoader; @Bean - public DelegatingApplicationListener delegatingApplicationListener() { + public static DelegatingApplicationListener delegatingApplicationListener() { return new DelegatingApplicationListener(); }