Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1867: Perform null check on Authentication.getCredentials() prior to calling toString()

Browse Source
This commit is contained in:
Rob Winch
2011-12-30 13:59:04 -06:00
parent 448a42916d
commit 1f835fec43
4 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/src/main/java/org/springframework/security/authentication/rcp/RemoteAuthenticationProvider.java
View File

@@ -57,7 +57,8 @@ public class RemoteAuthenticationProvider implements AuthenticationProvider, Ini
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
String username = authentication.getPrincipal().toString();
String password = authentication.getCredentials().toString();
Object credentials = authentication.getCredentials();
String password = credentials == null ? null : credentials.toString();
Collection<? extends GrantedAuthority> authorities = remoteAuthenticationManager.attemptAuthentication(username, password);
return new UsernamePasswordAuthenticationToken(username, password, authorities);