SEC-922: Spring Security should respect Spring XML boolean operators for AJ pointcut
http://jira.springframework.org/browse/SEC-922. Added method to substitute boolean operators "and, not, or" with aspectj versions "&&, !, ||".
This commit is contained in:
@@ -17,6 +17,7 @@ import org.springframework.beans.factory.config.BeanPostProcessor;
|
||||
import org.springframework.security.ConfigAttributeDefinition;
|
||||
import org.springframework.security.intercept.method.aopalliance.MethodDefinitionSourceAdvisor;
|
||||
import org.springframework.util.Assert;
|
||||
import org.springframework.util.StringUtils;
|
||||
|
||||
/**
|
||||
* Parses AspectJ pointcut expressions, registering methods that match the pointcut with a
|
||||
@@ -141,9 +142,10 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
|
||||
}
|
||||
}
|
||||
|
||||
public void addPointcut(String pointcutExpression, ConfigAttributeDefinition definition) {
|
||||
private void addPointcut(String pointcutExpression, ConfigAttributeDefinition definition) {
|
||||
Assert.hasText(pointcutExpression, "An AspectJ pointcut expression is required");
|
||||
Assert.notNull(definition, "ConfigAttributeDefinition required");
|
||||
pointcutExpression = replaceBooleanOperators(pointcutExpression);
|
||||
pointcutMap.put(pointcutExpression, definition);
|
||||
|
||||
if (logger.isDebugEnabled()) {
|
||||
@@ -151,4 +153,14 @@ public final class ProtectPointcutPostProcessor implements BeanPostProcessor {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @see org.springframework.aop.aspectj.AspectJExpressionPointcut#replaceBooleanOperators
|
||||
*/
|
||||
private String replaceBooleanOperators(String pcExpr) {
|
||||
pcExpr = StringUtils.replace(pcExpr," and "," && ");
|
||||
pcExpr = StringUtils.replace(pcExpr, " or ", " || ");
|
||||
pcExpr = StringUtils.replace(pcExpr, " not ", " ! ");
|
||||
return pcExpr;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user