From 5f10d84bf57724e53d2d9b74ff79ee2d99d3e1ff Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Sun, 6 Oct 2013 13:37:51 -0500 Subject: [PATCH] SEC-2303: WebSecurity sets the Bean resolver --- .../annotation/web/builders/WebSecurity.java | 15 ++++- .../WebSecurityConfiguration.java | 6 ++ .../ExpressionUrlAuthorizationConfigurer.java | 2 +- .../WebSecurityConfigurationTests.groovy | 56 +++++++++++++++++++ 4 files changed, 76 insertions(+), 3 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java index c9d3bafa36..98a435bd39 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java @@ -23,6 +23,9 @@ import javax.servlet.http.HttpServletRequest; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; +import org.springframework.beans.BeansException; +import org.springframework.context.ApplicationContext; +import org.springframework.context.ApplicationContextAware; import org.springframework.security.access.expression.SecurityExpressionHandler; import org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder; import org.springframework.security.config.annotation.SecurityBuilder; @@ -68,7 +71,7 @@ import org.springframework.web.filter.DelegatingFilterProxy; * @since 3.2 */ public final class WebSecurity extends - AbstractConfiguredSecurityBuilder implements SecurityBuilder { + AbstractConfiguredSecurityBuilder implements SecurityBuilder, ApplicationContextAware { private final Log logger = LogFactory.getLog(getClass()); private final List ignoredRequests = new ArrayList(); @@ -87,7 +90,10 @@ public final class WebSecurity extends private WebInvocationPrivilegeEvaluator privilegeEvaluator; - private SecurityExpressionHandler expressionHandler = new DefaultWebSecurityExpressionHandler(); + private DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler(); + + private SecurityExpressionHandler expressionHandler = defaultWebSecurityExpressionHandler; + private Runnable postBuildAction = new Runnable() { public void run() {} @@ -325,4 +331,9 @@ public final class WebSecurity extends private IgnoredRequestConfigurer(){} } + + public void setApplicationContext(ApplicationContext applicationContext) + throws BeansException { + defaultWebSecurityExpressionHandler.setApplicationContext(applicationContext); + } } diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java index 67f359ded0..f7a4815894 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java @@ -34,6 +34,7 @@ import org.springframework.core.annotation.AnnotationUtils; import org.springframework.core.annotation.Order; import org.springframework.core.type.AnnotationMetadata; import org.springframework.security.access.expression.SecurityExpressionHandler; +import org.springframework.security.config.annotation.ObjectPostProcessor; import org.springframework.security.config.annotation.SecurityConfigurer; import org.springframework.security.config.annotation.web.WebSecurityConfigurer; import org.springframework.security.config.annotation.web.builders.WebSecurity; @@ -184,4 +185,9 @@ public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAwa public void setBeanClassLoader(ClassLoader classLoader) { this.beanClassLoader = classLoader; } + + @Autowired + public void setObjectPostProcessor(ObjectPostProcessor objectPostProcessor) { + objectPostProcessor.postProcess(webSecurity); + } } diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java index ad5ce2cbe4..36e0fa7e1e 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java @@ -151,7 +151,7 @@ public final class ExpressionUrlAuthorizationConfigurer> parser } @EnableWebSecurity @@ -215,6 +222,13 @@ class WebSecurityConfigurationTests extends BaseSpringSpec { web .expressionHandler(EH) } + @Override + protected void configure(HttpSecurity http) throws Exception { + http + .authorizeRequests() + .expressionHandler(EH) + .anyRequest().authenticated() + } } def "#138 webSecurityExpressionHandler defaults"() { @@ -257,4 +271,46 @@ class WebSecurityConfigurationTests extends BaseSpringSpec { .anyRequest().authenticated() } } + + def "SEC-2303: DefaultExpressionHandler has bean resolver set"() { + when: + loadConfig(DefaultExpressionHandlerSetsBeanResolverConfig) + then: "the exposed bean has a BeanResolver set" + ReflectionTestUtils.getField(context.getBean(SecurityExpressionHandler),"br") + when: + springSecurityFilterChain.doFilter(request, response, chain) + then: "we can use the BeanResolver with a grant" + noExceptionThrown() + when: "we can use the Beanresolver with a deny" + springSecurityFilterChain.doFilter(new MockHttpServletRequest(method:'POST'), response, chain) + then: + noExceptionThrown() + } + + @EnableWebSecurity + @Configuration + static class DefaultExpressionHandlerSetsBeanResolverConfig extends WebSecurityConfigurerAdapter { + + @Override + protected void configure(HttpSecurity http) throws Exception { + http + .authorizeRequests() + .anyRequest().access("request.method == 'GET' ? @b.grant() : @b.deny()") + } + + @Bean + public MyBean b() { + new MyBean() + } + + static class MyBean { + boolean deny() { + false + } + + boolean grant() { + true + } + } + } }