From 5b49433ed14274762e038f3ca798363ad32a6404 Mon Sep 17 00:00:00 2001
From: Josh Cummings <josh.cummings@gmail.com>
Date: Tue, 8 Jun 2021 17:18:11 -0600
Subject: [PATCH] Add GlobalMethodSecurityConfiguration Test

Issue gh-9845
---
 ...lobalMethodSecurityConfigurationTests.java | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.java
index 5182cd9508..1cdaafba5b 100644
--- a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.java
+++ b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.java
@@ -37,6 +37,7 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
 import org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor;
@@ -194,6 +195,15 @@ public class GlobalMethodSecurityConfigurationTests {
 		assertThat(pp.afterInit).containsKeys("dataSource");
 	}
 
+	// SEC-9845
+	@Test
+	public void enableGlobalMethodSecurityWhenBeanPostProcessorThenInvokedForDefaultMethodSecurityExpressionHandler() {
+		this.spring.register(Sec9845Config.class).autowire();
+		MockBeanPostProcessor pp = this.spring.getContext().getBean(MockBeanPostProcessor.class);
+		assertThat(pp.beforeInitClass).containsKeys(DefaultMethodSecurityExpressionHandler.class);
+		assertThat(pp.afterInitClass).containsKeys(DefaultMethodSecurityExpressionHandler.class);
+	}
+
 	// SEC-3045
 	@Test
 	public void globalSecurityProxiesSecurity() {
@@ -441,21 +451,37 @@ public class GlobalMethodSecurityConfigurationTests {
 
 	}
 
+	@EnableGlobalMethodSecurity(prePostEnabled = true)
+	static class Sec9845Config {
+
+		@Bean
+		BeanPostProcessor mockBeanPostProcessor() {
+			return new MockBeanPostProcessor();
+		}
+
+	}
+
 	static class MockBeanPostProcessor implements BeanPostProcessor {
 
 		Map<String, Object> beforeInit = new HashMap<>();
 
 		Map<String, Object> afterInit = new HashMap<>();
 
+		Map<Class<?>, Object> beforeInitClass = new HashMap<>();
+
+		Map<Class<?>, Object> afterInitClass = new HashMap<>();
+
 		@Override
 		public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
 			this.beforeInit.put(beanName, bean);
+			this.beforeInitClass.put(bean.getClass(), bean);
 			return bean;
 		}
 
 		@Override
 		public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
 			this.afterInit.put(beanName, bean);
+			this.afterInitClass.put(bean.getClass(), bean);
 			return bean;
 		}