SEC-1262: Added new (replacement) AspectJ interceptor which wraps the JoinPoint in a MethodInvocation adapter to provide compatibility with classes which only support MethodInvocation instances.

Also deprecated the existing AspectJ interceptors. This will also allow future simplification of the AbstractMethodSecurityMetadataSource, as it no longer needs to support JoinPoints.

core/src/main/java/org/springframework/security/access/intercept/aspectj/AspectJAnnotationCallback.java

@@ -6,8 +6,9 @@ package org.springframework.security.access.intercept.aspectj;
  * AspectJ processing to continue.
  *
  * @author Mike Wiesner
+ * @deprecated
  */
-
+@Deprecated
 public interface AspectJAnnotationCallback {
     //~ Methods ========================================================================================================
 

core/src/main/java/org/springframework/security/access/intercept/aspectj/AspectJAnnotationSecurityInterceptor.java

@@ -11,7 +11,9 @@ import org.aspectj.lang.JoinPoint;
  * AspectJ interceptor that supports @Aspect notation.
  *
  * @author Mike Wiesner
+ * @deprecated Use AspectJMethodSecurityInterceptor instead
  */
+@Deprecated
 public class AspectJAnnotationSecurityInterceptor extends AbstractSecurityInterceptor {
     //~ Instance fields ================================================================================================
 

core/src/main/java/org/springframework/security/access/intercept/aspectj/AspectJMethodSecurityInterceptor.java

@@ -0,0 +1,51 @@
+package org.springframework.security.access.intercept.aspectj;
+
+import org.aspectj.lang.JoinPoint;
+import org.springframework.security.access.intercept.InterceptorStatusToken;
+import org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor;
+
+/**
+ * AspectJ {@code JoinPoint} security interceptor which wraps the {@code JoinPoint} in a {@code MethodInvocation}
+ * adapter to make it compatible with security infrastructure classes which only support {@code MethodInvocation}s.
+ * <p>
+ * One of the {@code invoke} methods should be called from the {@code around()} advice in your aspect.
+ * Alternatively you can use one of the pre-defined aspects from the aspects module.
+ *
+ * @author Luke Taylor
+ * @since 3.0.3
+ */
+public final class AspectJMethodSecurityInterceptor extends MethodSecurityInterceptor {
+
+    /**
+     * Method that is suitable for user with @Aspect notation.
+     *
+     * @param jp The AspectJ joint point being invoked which requires a security decision
+     * @return The returned value from the method invocation
+     * @throws Throwable if the invocation throws one
+     */
+    public Object invoke(JoinPoint jp) throws Throwable {
+        return super.invoke(new MethodInvocationAdapter(jp));
+    }
+
+    /**
+     * Method that is suitable for user with traditional AspectJ-code aspects.
+     *
+     * @param jp The AspectJ joint point being invoked which requires a security decision
+     * @param advisorProceed the advice-defined anonymous class that implements {@code AspectJCallback} containing
+     *        a simple {@code return proceed();} statement
+     *
+     * @return The returned value from the method invocation
+     */
+    public Object invoke(JoinPoint jp, AspectJCallback advisorProceed) {
+        Object result = null;
+        InterceptorStatusToken token = super.beforeInvocation(new MethodInvocationAdapter(jp));
+
+        try {
+            result = advisorProceed.proceedWithObject();
+        } finally {
+            result = super.afterInvocation(token, result);
+        }
+
+        return result;
+    }
+}

core/src/main/java/org/springframework/security/access/intercept/aspectj/AspectJSecurityInterceptor.java

@@ -37,7 +37,9 @@ import org.aspectj.lang.JoinPoint;
  * Refer to {@link AbstractSecurityInterceptor} for details on the workflow.
  *
  * @author Ben Alex
+ * @deprecated Use AspectJMethodSecurityInterceptor instead
  */
+@Deprecated
 public class AspectJSecurityInterceptor extends AbstractSecurityInterceptor {
     //~ Instance fields ================================================================================================
 

core/src/main/java/org/springframework/security/access/intercept/aspectj/MethodInvocationAdapter.java

@@ -0,0 +1,61 @@
+package org.springframework.security.access.intercept.aspectj;
+
+import java.lang.reflect.AccessibleObject;
+import java.lang.reflect.Method;
+
+import org.aopalliance.intercept.MethodInvocation;
+import org.aspectj.lang.JoinPoint;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.reflect.CodeSignature;
+import org.springframework.util.Assert;
+import org.springframework.util.ClassUtils;
+
+/**
+ * Decorates a JoinPoint to allow it to be used with method-security infrastructure
+ * classes which support {@code MethodInvocation} instances.
+ *
+ * @author Luke Taylor
+ * @since 3.0.3
+ */
+public final class MethodInvocationAdapter implements MethodInvocation {
+    private final ProceedingJoinPoint jp;
+    private final Method method;
+    private final Object target;
+
+    MethodInvocationAdapter(JoinPoint jp) {
+        this.jp = (ProceedingJoinPoint)jp;
+        if (jp.getTarget() != null) {
+            target = jp.getTarget();
+        } else {
+            // SEC-1295: target may be null if an ITD is in use
+            target = jp.getSignature().getDeclaringType();
+        }
+        String targetMethodName = jp.getStaticPart().getSignature().getName();
+        Class<?>[] types = ((CodeSignature) jp.getStaticPart().getSignature()).getParameterTypes();
+        Class<?> declaringType = ((CodeSignature) jp.getStaticPart().getSignature()).getDeclaringType();
+
+        method = ClassUtils.getMethodIfAvailable(declaringType, targetMethodName, types);
+        Assert.notNull(method, "Could not obtain target method from JoinPoint: '"+ jp + "'");
+
+    }
+
+    public Method getMethod() {
+        return method;
+    }
+
+    public Object[] getArguments() {
+        return jp.getArgs();
+    }
+
+    public AccessibleObject getStaticPart() {
+        return method;
+    }
+
+    public Object getThis() {
+        return target;
+    }
+
+    public Object proceed() throws Throwable {
+        return jp.proceed();
+    }
+}

core/src/main/java/org/springframework/security/access/method/AbstractMethodSecurityMetadataSource.java

@@ -49,7 +49,13 @@ public abstract class AbstractMethodSecurityMetadataSource implements MethodSecu
         if (object instanceof MethodInvocation) {
             MethodInvocation mi = (MethodInvocation) object;
             Object target = mi.getThis();
-            return getAttributes(mi.getMethod(), target == null ? null : target.getClass());
+            Class<?> targetClass = null;
+
+            if (target != null) {
+                targetClass = target instanceof Class<?> ? (Class<?>)target : target.getClass();
+            }
+
+            return getAttributes(mi.getMethod(), targetClass);
         }
 
         if (object instanceof JoinPoint) {