Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/5.8.x'

Browse Source
This commit is contained in:
Josh Cummings
2022-10-05 22:48:33 -06:00
parent eeb28e4f91 b4d13e7726
commit 72a46ddd31
6 changed files with 29 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java
View File

@@ -49,6 +49,8 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
private static final String ATT_USE_EXPRESSIONS = "use-expressions";
private static final String ATT_ACCESS_DECISION_MANAGER_REF = "access-decision-manager-ref";
private static final String ATT_HTTP_METHOD = "method";
private static final String ATT_PATTERN = "pattern";
@@ -59,6 +61,12 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
private String authorizationManagerRef;
private final BeanMetadataElement securityContextHolderStrategy;
AuthorizationFilterParser(BeanMetadataElement securityContextHolderStrategy) {
this.securityContextHolderStrategy = securityContextHolderStrategy;
}
@Override
public BeanDefinition parse(Element element, ParserContext parserContext) {
if (!isUseExpressions(element)) {
@@ -66,10 +74,16 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
element);
return null;
}
if (StringUtils.hasText(element.getAttribute(ATT_ACCESS_DECISION_MANAGER_REF))) {
parserContext.getReaderContext().error(
"AuthorizationManager cannot be used in conjunction with `access-decision-manager-ref`", element);
return null;
}
this.authorizationManagerRef = createAuthorizationManager(element, parserContext);
BeanDefinitionBuilder filterBuilder = BeanDefinitionBuilder.rootBeanDefinition(AuthorizationFilter.class);
filterBuilder.getRawBeanDefinition().setSource(parserContext.extractSource(element));
BeanDefinition filter = filterBuilder.addConstructorArgReference(this.authorizationManagerRef)
.addPropertyValue("securityContextHolderStrategy", this.securityContextHolderStrategy)
.getBeanDefinition();
String id = element.getAttribute(AbstractBeanDefinitionParser.ID_ATTRIBUTE);
if (StringUtils.hasText(id)) {
@@ -171,7 +185,9 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
@Override
public DefaultHttpSecurityExpressionHandler getBean() {
this.handler.setDefaultRolePrefix(this.rolePrefix);
if (this.rolePrefix != null) {
this.handler.setDefaultRolePrefix(this.rolePrefix);
}
return this.handler;
}

2
config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java
View File

@@ -729,7 +729,7 @@ class HttpConfigurationBuilder {
}
private void createAuthorizationFilter() {
AuthorizationFilterParser authorizationFilterParser = new AuthorizationFilterParser();
AuthorizationFilterParser authorizationFilterParser = new AuthorizationFilterParser(this.holderStrategyRef);
BeanDefinition fsiBean = authorizationFilterParser.parse(this.httpElt, this.pc);
String fsiId = this.pc.getReaderContext().generateBeanName(fsiBean);
this.pc.registerBeanComponent(new BeanComponentDefinition(fsiBean, fsiId));