From 268a1dc06ede0fe998bc7bf66fc6533f4a520239 Mon Sep 17 00:00:00 2001 From: Joe Grandja Date: Tue, 19 Dec 2017 09:07:17 -0500 Subject: [PATCH] DefaultOAuth2User is Serializable Fixes gh-4917 --- .../security/oauth2/core/user/DefaultOAuth2User.java | 3 ++- .../security/oauth2/core/user/DefaultOAuth2UserTests.java | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java b/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java index e313dc6c97..1d5a66f483 100644 --- a/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java +++ b/oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java @@ -24,6 +24,7 @@ import java.util.Collection; import java.util.Collections; import java.util.Comparator; import java.util.LinkedHashMap; +import java.util.LinkedHashSet; import java.util.Map; import java.util.Set; import java.util.SortedSet; @@ -58,7 +59,7 @@ public class DefaultOAuth2User implements OAuth2User, Serializable { if (!attributes.containsKey(nameAttributeKey)) { throw new IllegalArgumentException("Missing attribute '" + nameAttributeKey + "' in attributes"); } - this.authorities = Collections.unmodifiableSet(this.sortAuthorities(authorities)); + this.authorities = Collections.unmodifiableSet(new LinkedHashSet<>(this.sortAuthorities(authorities))); this.attributes = Collections.unmodifiableMap(new LinkedHashMap<>(attributes)); this.nameAttributeKey = nameAttributeKey; } diff --git a/oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java b/oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java index 63ceeb65d9..00d5bf3f75 100644 --- a/oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java +++ b/oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java @@ -19,6 +19,7 @@ package org.springframework.security.oauth2.core.user; import org.junit.Test; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; +import org.springframework.util.SerializationUtils; import java.util.Collections; import java.util.Map; @@ -79,4 +80,11 @@ public class DefaultOAuth2UserTests { assertThat(user.getAuthorities().iterator().next()).isEqualTo(AUTHORITY); assertThat(user.getAttributes()).containsOnlyKeys(ATTRIBUTE_NAME_KEY); } + + // gh-4917 + @Test + public void constructorWhenCreatedThenIsSerializable() { + DefaultOAuth2User user = new DefaultOAuth2User(AUTHORITIES, ATTRIBUTES, ATTRIBUTE_NAME_KEY); + SerializationUtils.serialize(user); + } }