Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert "Polish AuthorizationAdvisorProxyFactory advisor configuration" 

This commit had some unintended consequences when the advisor
interceptor was published in a Spring Boot application. As such,
15497 will be reopened to investigate. In the meantime, this commit
reverts the previous change so as to allow the build to pass.

Issue gh-15497
This commit is contained in:
Josh Cummings 2024-08-10 16:36:59 -06:00
parent 12a9f9240c
commit 59ec1f6480
No known key found for this signature in database
GPG Key ID: A306A51F43B8E5A5
3 changed files with 14 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
config/src/main/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyConfiguration.java
View File

@ -41,18 +41,22 @@ final class AuthorizationProxyConfiguration implements AopInfrastructureBean {
ObjectProvider<Customizer<AuthorizationAdvisorProxyFactory>> customizers) { ObjectProvider<Customizer<AuthorizationAdvisorProxyFactory>> customizers) {
List<AuthorizationAdvisor> advisors = new ArrayList<>(); List<AuthorizationAdvisor> advisors = new ArrayList<>();
provider.forEach(advisors::add); provider.forEach(advisors::add);
AuthorizationAdvisorProxyFactory factory = new AuthorizationAdvisorProxyFactory(advisors); AuthorizationAdvisorProxyFactory factory = AuthorizationAdvisorProxyFactory.withDefaults();
customizers.forEach((c) -> c.customize(factory)); customizers.forEach((c) -> c.customize(factory));
factory.setAdvisors(advisors);
return factory; return factory;
} }
@Bean @Bean
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
static MethodInterceptor authorizeReturnObjectMethodInterceptor( static MethodInterceptor authorizeReturnObjectMethodInterceptor(ObjectProvider<AuthorizationAdvisor> provider,
AuthorizationAdvisorProxyFactory authorizationProxyFactory) { AuthorizationAdvisorProxyFactory authorizationProxyFactory) {
AuthorizeReturnObjectMethodInterceptor interceptor = new AuthorizeReturnObjectMethodInterceptor( AuthorizeReturnObjectMethodInterceptor interceptor = new AuthorizeReturnObjectMethodInterceptor(
authorizationProxyFactory); authorizationProxyFactory);
authorizationProxyFactory.addAdvisors(interceptor); List<AuthorizationAdvisor> advisors = new ArrayList<>();
provider.forEach(advisors::add);
advisors.add(interceptor);
authorizationProxyFactory.setAdvisors(advisors);
return interceptor; return interceptor;
} }

43
core/src/main/java/org/springframework/security/authorization/method/AuthorizationAdvisorProxyFactory.java
View File

@ -86,28 +86,14 @@ public final class AuthorizationAdvisorProxyFactory
private static final TargetVisitor DEFAULT_VISITOR_SKIP_VALUE_TYPES = TargetVisitor.of(new ClassVisitor(), private static final TargetVisitor DEFAULT_VISITOR_SKIP_VALUE_TYPES = TargetVisitor.of(new ClassVisitor(),
new IgnoreValueTypeVisitor(), DEFAULT_VISITOR); new IgnoreValueTypeVisitor(), DEFAULT_VISITOR);
private List<AuthorizationAdvisor> advisors = new ArrayList<>(); private List<AuthorizationAdvisor> advisors;
private TargetVisitor visitor = DEFAULT_VISITOR; private TargetVisitor visitor = DEFAULT_VISITOR;
/** private AuthorizationAdvisorProxyFactory(List<AuthorizationAdvisor> advisors) {
* Construct an {@link AuthorizationAdvisorProxyFactory} with the following advisors this.advisors = new ArrayList<>(advisors);
* @param advisors the list of advisors to wrap around proxied objects this.advisors.add(new AuthorizeReturnObjectMethodInterceptor(this));
* @since 6.4 setAdvisors(this.advisors);
*/
public AuthorizationAdvisorProxyFactory(List<AuthorizationAdvisor> advisors) {
this.advisors.addAll(advisors);
AnnotationAwareOrderComparator.sort(this.advisors);
}
/**
* Construct an {@link AuthorizationAdvisorProxyFactory} with the following advisors
* @param advisors the list of advisors to wrap around proxied objects
* @since 6.4
*/
public AuthorizationAdvisorProxyFactory(AuthorizationAdvisor... advisors) {
this.advisors.addAll(List.of(advisors));
AnnotationAwareOrderComparator.sort(this.advisors);
} }
/** /**
@ -122,9 +108,7 @@ public final class AuthorizationAdvisorProxyFactory
advisors.add(AuthorizationManagerAfterMethodInterceptor.postAuthorize()); advisors.add(AuthorizationManagerAfterMethodInterceptor.postAuthorize());
advisors.add(new PreFilterAuthorizationMethodInterceptor()); advisors.add(new PreFilterAuthorizationMethodInterceptor());
advisors.add(new PostFilterAuthorizationMethodInterceptor()); advisors.add(new PostFilterAuthorizationMethodInterceptor());
AuthorizationAdvisorProxyFactory proxyFactory = new AuthorizationAdvisorProxyFactory(advisors); return new AuthorizationAdvisorProxyFactory(advisors);
proxyFactory.addAdvisors(new AuthorizeReturnObjectMethodInterceptor(proxyFactory));
return proxyFactory;
} }
/** /**
@ -139,9 +123,7 @@ public final class AuthorizationAdvisorProxyFactory
advisors.add(AuthorizationManagerAfterReactiveMethodInterceptor.postAuthorize()); advisors.add(AuthorizationManagerAfterReactiveMethodInterceptor.postAuthorize());
advisors.add(new PreFilterAuthorizationReactiveMethodInterceptor()); advisors.add(new PreFilterAuthorizationReactiveMethodInterceptor());
advisors.add(new PostFilterAuthorizationReactiveMethodInterceptor()); advisors.add(new PostFilterAuthorizationReactiveMethodInterceptor());
AuthorizationAdvisorProxyFactory proxyFactory = new AuthorizationAdvisorProxyFactory(advisors); return new AuthorizationAdvisorProxyFactory(advisors);
proxyFactory.addAdvisors(new AuthorizeReturnObjectMethodInterceptor(proxyFactory));
return proxyFactory;
} }
/** /**
@ -179,21 +161,13 @@ public final class AuthorizationAdvisorProxyFactory
return factory.getProxy(); return factory.getProxy();
} }
public void addAdvisors(AuthorizationAdvisor... advisors) {
this.advisors.addAll(List.of(advisors));
AnnotationAwareOrderComparator.sort(this.advisors);
}
/** /**
* Add advisors that should be included to each proxy created. * Add advisors that should be included to each proxy created.
* *
* <p> * <p>
* All advisors are re-sorted by their advisor order. * All advisors are re-sorted by their advisor order.
* @param advisors the advisors to add * @param advisors the advisors to add
* @deprecated Either use the constructor to provide a complete set of advisors or use
* {@link #addAdvisors(AuthorizationAdvisor...)} to add to the existing list
*/ */
@Deprecated
public void setAdvisors(AuthorizationAdvisor... advisors) { public void setAdvisors(AuthorizationAdvisor... advisors) {
this.advisors = new ArrayList<>(List.of(advisors)); this.advisors = new ArrayList<>(List.of(advisors));
AnnotationAwareOrderComparator.sort(this.advisors); AnnotationAwareOrderComparator.sort(this.advisors);
@ -205,10 +179,7 @@ public final class AuthorizationAdvisorProxyFactory
* <p> * <p>
* All advisors are re-sorted by their advisor order. * All advisors are re-sorted by their advisor order.
* @param advisors the advisors to add * @param advisors the advisors to add
* @deprecated Either use the constructor to provide a complete set of advisors or use
* {@link #addAdvisors(AuthorizationAdvisor...)} to add to the existing list
*/ */
@Deprecated
public void setAdvisors(Collection<AuthorizationAdvisor> advisors) { public void setAdvisors(Collection<AuthorizationAdvisor> advisors) {
this.advisors = new ArrayList<>(advisors); this.advisors = new ArrayList<>(advisors);
AnnotationAwareOrderComparator.sort(this.advisors); AnnotationAwareOrderComparator.sort(this.advisors);

23
core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java
View File

@ -319,29 +319,6 @@ public class AuthorizationAdvisorProxyFactoryTests {
verify(advisor, atLeastOnce()).getPointcut(); verify(advisor, atLeastOnce()).getPointcut();
} }
@Test
public void addAdvisorsWhenProxyThenVisits() {
AuthorizationAdvisor advisor = mock(AuthorizationAdvisor.class);
given(advisor.getAdvice()).willReturn(advisor);
given(advisor.getPointcut()).willReturn(Pointcut.TRUE);
AuthorizationAdvisorProxyFactory factory = AuthorizationAdvisorProxyFactory.withDefaults();
factory.addAdvisors(advisor);
Flight flight = proxy(factory, this.flight);
flight.getAltitude();
verify(advisor, atLeastOnce()).getPointcut();
}
@Test
public void constructWhenProxyThenVisitsAdvisors() {
AuthorizationAdvisor advisor = mock(AuthorizationAdvisor.class);
given(advisor.getAdvice()).willReturn(advisor);
given(advisor.getPointcut()).willReturn(Pointcut.TRUE);
AuthorizationAdvisorProxyFactory factory = new AuthorizationAdvisorProxyFactory(advisor);
Flight flight = proxy(factory, this.flight);
flight.getAltitude();
verify(advisor, atLeastOnce()).getPointcut();
}
@Test @Test
public void setTargetVisitorThenUses() { public void setTargetVisitorThenUses() {
TargetVisitor visitor = mock(TargetVisitor.class); TargetVisitor visitor = mock(TargetVisitor.class);