SEC-1723: Use standard SpEL syntax for accessing beans in the app context by name.
This commit is contained in:
@@ -2,6 +2,8 @@ package org.springframework.security.access.expression;
|
||||
|
||||
import org.springframework.context.ApplicationContext;
|
||||
import org.springframework.context.ApplicationContextAware;
|
||||
import org.springframework.context.expression.BeanFactoryResolver;
|
||||
import org.springframework.expression.BeanResolver;
|
||||
import org.springframework.expression.EvaluationContext;
|
||||
import org.springframework.expression.ExpressionParser;
|
||||
import org.springframework.expression.spel.standard.SpelExpressionParser;
|
||||
@@ -21,7 +23,7 @@ import org.springframework.security.core.Authentication;
|
||||
public abstract class AbstractSecurityExpressionHandler<T> implements SecurityExpressionHandler<T>, ApplicationContextAware {
|
||||
private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
|
||||
private final ExpressionParser expressionParser = new SpelExpressionParser();
|
||||
private ApplicationContextPropertyAccessor sxrpa = new ApplicationContextPropertyAccessor(null);
|
||||
private BeanResolver br;
|
||||
private RoleHierarchy roleHierarchy;
|
||||
|
||||
public final ExpressionParser getExpressionParser() {
|
||||
@@ -42,7 +44,7 @@ public abstract class AbstractSecurityExpressionHandler<T> implements SecurityEx
|
||||
root.setTrustResolver(trustResolver);
|
||||
root.setRoleHierarchy(roleHierarchy);
|
||||
StandardEvaluationContext ctx = createEvaluationContextInternal(authentication, invocation);
|
||||
ctx.addPropertyAccessor(sxrpa);
|
||||
ctx.setBeanResolver(br);
|
||||
ctx.setRootObject(root);
|
||||
|
||||
return ctx;
|
||||
@@ -76,6 +78,6 @@ public abstract class AbstractSecurityExpressionHandler<T> implements SecurityEx
|
||||
}
|
||||
|
||||
public void setApplicationContext(ApplicationContext applicationContext) {
|
||||
sxrpa = new ApplicationContextPropertyAccessor(applicationContext);
|
||||
br = new BeanFactoryResolver(applicationContext);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
package org.springframework.security.access.expression;
|
||||
|
||||
import org.springframework.context.ApplicationContext;
|
||||
import org.springframework.expression.AccessException;
|
||||
import org.springframework.expression.EvaluationContext;
|
||||
import org.springframework.expression.PropertyAccessor;
|
||||
import org.springframework.expression.TypedValue;
|
||||
|
||||
/**
|
||||
* General property accessor which resolves properties as bean names within an {@code ApplicationContext}.
|
||||
*/
|
||||
final class ApplicationContextPropertyAccessor implements PropertyAccessor {
|
||||
private final ApplicationContext ctx;
|
||||
|
||||
ApplicationContextPropertyAccessor(ApplicationContext ctx) {
|
||||
this.ctx = ctx;
|
||||
}
|
||||
|
||||
public boolean canRead(EvaluationContext context, Object target, String name) throws AccessException {
|
||||
if (ctx == null) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return ctx.containsBean(name);
|
||||
}
|
||||
|
||||
public TypedValue read(EvaluationContext context, Object target, String name) throws AccessException {
|
||||
return new TypedValue(ctx.getBean(name));
|
||||
}
|
||||
|
||||
public boolean canWrite(EvaluationContext context, Object target, String name) throws AccessException {
|
||||
return false;
|
||||
}
|
||||
|
||||
public void write(EvaluationContext context, Object target, String name, Object newValue) throws AccessException {
|
||||
}
|
||||
|
||||
public Class[] getSpecificTargetClasses() {
|
||||
return null;
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user