Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-25 05:22:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2066: ProtectPointcutPostProcessor is now ThreadSafe

Browse Source 
Previously a ConcurrentModificationException could occur when
PointcutExpression.matchesMethodExecution was performed in multiple threads. Another
issue was that beans may get processed multiple times.

Now a lock is performed to ensure that only a single thread has access to
PointcutExpression.matchesMethodExecution and that each bean only gets processed once.
This commit is contained in:
Rob Winch 2012-11-09 14:34:00 -06:00
parent 51fd83060e
commit 1a7aaa85c4
1 changed files with 24 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
config/src/main/java/org/springframework/security/config/method/ProtectPointcutPostProcessor.java
View File

@ -51,6 +51,7 @@ final class ProtectPointcutPostProcessor implements BeanPostProcessor {
private final PointcutParser parser; private final PointcutParser parser;
private final Set<String> processedBeans = new HashSet<String>(); private final Set<String> processedBeans = new HashSet<String>();
public ProtectPointcutPostProcessor(MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource) { public ProtectPointcutPostProcessor(MapBasedMethodSecurityMetadataSource mapBasedMethodSecurityMetadataSource) {
Assert.notNull(mapBasedMethodSecurityMetadataSource, "MapBasedMethodSecurityMetadataSource to populate is required"); Assert.notNull(mapBasedMethodSecurityMetadataSource, "MapBasedMethodSecurityMetadataSource to populate is required");
this.mapBasedMethodSecurityMetadataSource = mapBasedMethodSecurityMetadataSource; this.mapBasedMethodSecurityMetadataSource = mapBasedMethodSecurityMetadataSource;
@ -80,6 +81,12 @@ final class ProtectPointcutPostProcessor implements BeanPostProcessor {
return bean; return bean;
} }
synchronized(processedBeans) {
// check again synchronized this time
if (processedBeans.contains(beanName)) {
return bean;
}
// Obtain methods for the present bean // Obtain methods for the present bean
Method[] methods; Method[] methods;
try { try {
@ -100,6 +107,8 @@ final class ProtectPointcutPostProcessor implements BeanPostProcessor {
} }
processedBeans.add(beanName); processedBeans.add(beanName);
}
return bean; return bean;
} }