Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

@EnableMethodSecurity doesn't resolve Method Security annotations on interfaces through a Proxy

Browse Source 
Removed proxy unwrapping in case of resolving Method Security annotations,
this cause an issue when interfaces which are implemented by the proxy was skipped,
resulting in a missing security checks on those methods.

Closes gh-11175
This commit is contained in:
Evgeniy Cheban
2022-04-29 17:44:28 +03:00
committed by Rob Winch
parent 5ac5edc2e6
commit 286e95893a
4 changed files with 88 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/src/main/java/org/springframework/security/authorization/method/AbstractAuthorizationManagerRegistry.java
View File

@@ -22,7 +22,6 @@ import java.util.concurrent.ConcurrentHashMap;
import org.aopalliance.intercept.MethodInvocation;
import org.springframework.aop.support.AopUtils;
import org.springframework.core.MethodClassKey;
import org.springframework.lang.NonNull;
import org.springframework.security.authorization.AuthorizationManager;
@@ -46,7 +45,7 @@ abstract class AbstractAuthorizationManagerRegistry {
final AuthorizationManager<MethodInvocation> getManager(MethodInvocation methodInvocation) {
Method method = methodInvocation.getMethod();
Object target = methodInvocation.getThis();
Class<?> targetClass = (target != null) ? AopUtils.getTargetClass(target) : null;
Class<?> targetClass = (target != null) ? target.getClass() : null;
MethodClassKey cacheKey = new MethodClassKey(method, targetClass);
return this.cachedManagers.computeIfAbsent(cacheKey, (k) -> resolveManager(method, targetClass));
}

3
core/src/main/java/org/springframework/security/authorization/method/AbstractExpressionAttributeRegistry.java
View File

@@ -22,7 +22,6 @@ import java.util.concurrent.ConcurrentHashMap;
import org.aopalliance.intercept.MethodInvocation;
import org.springframework.aop.support.AopUtils;
import org.springframework.core.MethodClassKey;
import org.springframework.lang.NonNull;
@@ -43,7 +42,7 @@ abstract class AbstractExpressionAttributeRegistry<T extends ExpressionAttribute
final T getAttribute(MethodInvocation mi) {
Method method = mi.getMethod();
Object target = mi.getThis();
Class<?> targetClass = (target != null) ? AopUtils.getTargetClass(target) : null;
Class<?> targetClass = (target != null) ? target.getClass() : null;
return getAttribute(method, targetClass);
}