SEC-1867: Perform null check on Authentication.getCredentials() prior to calling toString()

remoting/src/test/java/org/springframework/security/remoting/rmi/ContextPropagatingRemoteInvocationTests.java

@@ -22,6 +22,7 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.util.SimpleMethodInvocation;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import java.lang.reflect.Method;
 
@@ -95,4 +96,13 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
 
         assertEquals("some_string Authentication empty", remoteInvocation.invoke(new TargetObject()));
     }
+
+    // SEC-1867
+    public void testNullCredentials() throws Exception {
+        Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("rod", null);
+        SecurityContextHolder.getContext().setAuthentication(clientSideAuthentication);
+
+        ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation();
+        assertEquals(null, ReflectionTestUtils.getField(remoteInvocation, "credentials"));
+    }
 }