Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1522: Treat empty attribute collection the same as null when returned by SecurityMetadataSource. Both are now treated as public invocations.

Browse Source
This commit is contained in:
Luke Taylor
2010-07-27 02:18:18 +01:00
parent a74077f9b1
commit b854e67952
3 changed files with 31 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
core/src/main/java/org/springframework/security/access/SecurityMetadataSource.java
View File

@@ -31,13 +31,12 @@ public interface SecurityMetadataSource extends AopInfrastructureBean {
//~ Methods ========================================================================================================
/**
* Accesses the <code>ConfigAttribute</code>s that apply to a given secure object.
* <p>
* Returns <code>null</code> if no attributes apply.
* Accesses the {@code ConfigAttribute}s that apply to a given secure object.
*
* @param object the object being secured
*
* @return the attributes that apply to the passed in secured object or null if there are no applicable attributes.
* @return the attributes that apply to the passed in secured object. Can return either {@code null} or an
* empty collection if there are no applicable attributes.
*
* @throws IllegalArgumentException if the passed object is not of a type supported by the
* <code>SecurityMetadataSource</code> implementation
@@ -45,18 +44,18 @@ public interface SecurityMetadataSource extends AopInfrastructureBean {
Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException;
/**
* If available, returns all of the <code>ConfigAttribute</code>s defined by the implementing class.
* If available, returns all of the {@code ConfigAttribute}s defined by the implementing class.
* <p>
* This is used by the {@link AbstractSecurityInterceptor} to perform startup time validation of each
* <code>ConfigAttribute</code> configured against it.
* {@code ConfigAttribute} configured against it.
*
* @return the <code>ConfigAttribute</code>s or <code>null</code> if unsupported
* @return the {@code ConfigAttribute}s or {@code null} if unsupported
*/
Collection<ConfigAttribute> getAllConfigAttributes();
/**
* Indicates whether the <code>SecurityMetadataSource</code> implementation is able to provide
* <code>ConfigAttribute</code>s for the indicated secure object type.
* Indicates whether the {@code SecurityMetadataSource} implementation is able to provide
* {@code ConfigAttribute}s for the indicated secure object type.
*
* @param clazz the class that is being queried
*

15
core/src/main/java/org/springframework/security/access/intercept/AbstractSecurityInterceptor.java
View File

@@ -170,7 +170,7 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource().getAttributes(object);
if (attributes == null) {
if (attributes == null || attributes.isEmpty()) {
if (rejectPublicInvocations) {
throw new IllegalArgumentException("Secure object invocation " + object +
" was denied as public invocations are not allowed via this interceptor. "
@@ -203,8 +203,7 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
this.accessDecisionManager.decide(authenticated, object, attributes);
}
catch (AccessDeniedException accessDeniedException) {
publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
accessDeniedException));
publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated, accessDeniedException));
throw accessDeniedException;
}
@@ -266,8 +265,8 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
token.getAttributes(), returnedObject);
}
catch (AccessDeniedException accessDeniedException) {
AuthorizationFailureEvent event = new AuthorizationFailureEvent(token.getSecureObject(), token
.getAttributes(), token.getAuthentication(), accessDeniedException);
AuthorizationFailureEvent event = new AuthorizationFailureEvent(token.getSecureObject(),
token.getAttributes(), token.getAuthentication(), accessDeniedException);
publishEvent(event);
throw accessDeniedException;
@@ -310,7 +309,7 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
/**
* Helper method which generates an exception containing the passed reason,
* and publishes an event to the application context.
* <p/>
* <p>
* Always throws an exception.
*
* @param reason to be provided in the exception detail
@@ -346,12 +345,12 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
/**
* Indicates the type of secure objects the subclass will be presenting to
* the abstract parent for processing. This is used to ensure collaborators
* wired to the <code>AbstractSecurityInterceptor</code> all support the
* wired to the {@code AbstractSecurityInterceptor} all support the
* indicated secure object class.
*
* @return the type of secure object the subclass provides services for
*/
public abstract Class<? extends Object> getSecureObjectClass();
public abstract Class<?> getSecureObjectClass();
public boolean isAlwaysReauthenticate() {
return alwaysReauthenticate;