From 3f7355abc66013a5efff7fa52b2b79a47498a6ea Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Thu, 4 Apr 2024 13:13:17 -0600 Subject: [PATCH] Synthesize all annotation attributes Issue gh-14601 --- .../method/configuration/MethodSecurityService.java | 2 +- .../PrePostMethodSecurityConfigurationTests.java | 4 +++- .../authorization/method/AuthorizationAnnotationUtils.java | 5 +++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityService.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityService.java index f8e1889c38..7f335a556d 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityService.java +++ b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityService.java @@ -305,7 +305,7 @@ public interface MethodSecurityService { @Target({ ElementType.METHOD, ElementType.TYPE }) @Retention(RetentionPolicy.RUNTIME) @Inherited - @PostAuthorize(value = "hasRole('{value}')", postProcessorClass = NullPostProcessor.class) + @PostAuthorize(value = "hasRole('{role}')", postProcessorClass = NullPostProcessor.class) @interface NullDenied { String role(); diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java index f9b16350b6..c75a3c2c0e 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java @@ -827,7 +827,9 @@ public class PrePostMethodSecurityConfigurationTests { @Test @WithMockUser void postAuthorizeWhenNullDeniedMetaAnnotationThanWorks() { - this.spring.register(MethodSecurityServiceEnabledConfig.class, MethodSecurityService.NullPostProcessor.class) + this.spring + .register(MethodSecurityServiceEnabledConfig.class, MetaAnnotationPlaceholderConfig.class, + MethodSecurityService.NullPostProcessor.class) .autowire(); MethodSecurityService service = this.spring.getContext().getBean(MethodSecurityService.class); String result = service.postAuthorizeDeniedWithNullDenied(); diff --git a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java index ffeab6ec9d..de0e9c9111 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java +++ b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAnnotationUtils.java @@ -19,7 +19,6 @@ package org.springframework.security.authorization.method; import java.lang.annotation.Annotation; import java.lang.reflect.AnnotatedElement; import java.lang.reflect.Method; -import java.util.Collections; import java.util.HashMap; import java.util.List; import java.util.Map; @@ -76,7 +75,9 @@ final class AuthorizationAnnotationUtils { } AnnotatedElement annotatedElement = (AnnotatedElement) mergedAnnotation.getSource(); String value = helper.replacePlaceholders(expression, stringProperties::get); - return MergedAnnotation.of(annotatedElement, type, Collections.singletonMap("value", value)).synthesize(); + Map properties = new HashMap<>(mergedAnnotation.asMap()); + properties.put("value", value); + return MergedAnnotation.of(annotatedElement, type, properties).synthesize(); }; return (annotatedElement) -> findDistinctAnnotation(annotatedElement, type, map); }