SEC-1369: Make sure beans aren't registered twice in case allowBeanDefinitionOverriding=false in the app context.

The use of registerBeanComponent() also registers the bean definition, which causes an error if overriding is disallowed and the bean has already been registered using registerBeanDefinition(). I've also set the allowBeanDefinitionOverriding to 'false' on InMemoryXmlApplicationContext to detect future mistakes of this kind in testing.
This commit is contained in:
Luke Taylor 2010-01-14 15:48:14 +00:00
parent 0f90e69004
commit 670297c55d
9 changed files with 28 additions and 32 deletions

View File

@ -35,9 +35,8 @@ public abstract class AbstractUserDetailsServiceBeanDefinitionParser implements
doParse(element, parserContext, builder); doParse(element, parserContext, builder);
RootBeanDefinition userService = (RootBeanDefinition) builder.getBeanDefinition(); RootBeanDefinition userService = (RootBeanDefinition) builder.getBeanDefinition();
String beanId = resolveId(element, userService, parserContext); final String beanId = resolveId(element, userService, parserContext);
parserContext.getRegistry().registerBeanDefinition(beanId, userService);
parserContext.registerBeanComponent(new BeanComponentDefinition(userService, beanId)); parserContext.registerBeanComponent(new BeanComponentDefinition(userService, beanId));
String cacheRef = element.getAttribute(CACHE_REF); String cacheRef = element.getAttribute(CACHE_REF);
@ -49,7 +48,6 @@ public abstract class AbstractUserDetailsServiceBeanDefinitionParser implements
cachingUSBuilder.addPropertyValue("userCache", new RuntimeBeanReference(cacheRef)); cachingUSBuilder.addPropertyValue("userCache", new RuntimeBeanReference(cacheRef));
BeanDefinition cachingUserService = cachingUSBuilder.getBeanDefinition(); BeanDefinition cachingUserService = cachingUSBuilder.getBeanDefinition();
parserContext.getRegistry().registerBeanDefinition(beanId + CACHING_SUFFIX, cachingUserService);
parserContext.registerBeanComponent(new BeanComponentDefinition(cachingUserService, beanId + CACHING_SUFFIX)); parserContext.registerBeanComponent(new BeanComponentDefinition(cachingUserService, beanId + CACHING_SUFFIX));
} }

View File

@ -60,7 +60,7 @@ public class AuthenticationManagerBeanDefinitionParser implements BeanDefinition
} else { } else {
BeanDefinition provider = resolver.resolve(providerElt.getNamespaceURI()).parse(providerElt, pc); BeanDefinition provider = resolver.resolve(providerElt.getNamespaceURI()).parse(providerElt, pc);
Assert.notNull(provider, "Parser for " + providerElt.getNodeName() + " returned a null bean definition"); Assert.notNull(provider, "Parser for " + providerElt.getNodeName() + " returned a null bean definition");
String id = pc.getReaderContext().registerWithGeneratedName(provider); String id = pc.getReaderContext().generateBeanName(provider);
pc.registerBeanComponent(new BeanComponentDefinition(provider, id)); pc.registerBeanComponent(new BeanComponentDefinition(provider, id));
providers.add(new RuntimeBeanReference(id)); providers.add(new RuntimeBeanReference(id));
} }
@ -74,13 +74,12 @@ public class AuthenticationManagerBeanDefinitionParser implements BeanDefinition
providerManagerBldr.addPropertyValue("providers", providers); providerManagerBldr.addPropertyValue("providers", providers);
// Add the default event publisher // Add the default event publisher
BeanDefinition publisher = new RootBeanDefinition(DefaultAuthenticationEventPublisher.class); BeanDefinition publisher = new RootBeanDefinition(DefaultAuthenticationEventPublisher.class);
String id = pc.getReaderContext().registerWithGeneratedName(publisher); String id = pc.getReaderContext().generateBeanName(publisher);
pc.registerBeanComponent(new BeanComponentDefinition(publisher, id)); pc.registerBeanComponent(new BeanComponentDefinition(publisher, id));
providerManagerBldr.addPropertyReference("authenticationEventPublisher", id); providerManagerBldr.addPropertyReference("authenticationEventPublisher", id);
BeanDefinition authManager = providerManagerBldr.getBeanDefinition(); pc.registerBeanComponent(
pc.getRegistry().registerBeanDefinition(BeanIds.AUTHENTICATION_MANAGER, authManager); new BeanComponentDefinition(providerManagerBldr.getBeanDefinition(), BeanIds.AUTHENTICATION_MANAGER));
pc.registerBeanComponent(new BeanComponentDefinition(authManager, BeanIds.AUTHENTICATION_MANAGER));
if (StringUtils.hasText(alias)) { if (StringUtils.hasText(alias)) {
pc.getRegistry().registerAlias(BeanIds.AUTHENTICATION_MANAGER, alias); pc.getRegistry().registerAlias(BeanIds.AUTHENTICATION_MANAGER, alias);

View File

@ -143,7 +143,7 @@ final class AuthenticationConfigBuilder {
provider.getPropertyValues().addPropertyValue("key", key); provider.getPropertyValues().addPropertyValue("key", key);
String id = pc.getReaderContext().registerWithGeneratedName(provider); String id = pc.getReaderContext().generateBeanName(provider);
pc.registerBeanComponent(new BeanComponentDefinition(provider, id)); pc.registerBeanComponent(new BeanComponentDefinition(provider, id));
rememberMeProviderRef = new RuntimeBeanReference(id); rememberMeProviderRef = new RuntimeBeanReference(id);
@ -168,7 +168,7 @@ final class AuthenticationConfigBuilder {
// Id is required by login page filter // Id is required by login page filter
formFilterId = pc.getReaderContext().registerWithGeneratedName(formFilter); formFilterId = pc.getReaderContext().generateBeanName(formFilter);
pc.registerBeanComponent(new BeanComponentDefinition(formFilter, formFilterId)); pc.registerBeanComponent(new BeanComponentDefinition(formFilter, formFilterId));
injectRememberMeServicesRef(formFilter, rememberMeServicesId); injectRememberMeServicesRef(formFilter, rememberMeServicesId);
} }
@ -217,8 +217,7 @@ final class AuthenticationConfigBuilder {
openIDFilter.getPropertyValues().addPropertyValue("allowSessionCreation", new Boolean(allowSessionCreation)); openIDFilter.getPropertyValues().addPropertyValue("allowSessionCreation", new Boolean(allowSessionCreation));
openIDFilter.getPropertyValues().addPropertyValue("authenticationManager", authManager); openIDFilter.getPropertyValues().addPropertyValue("authenticationManager", authManager);
// Required by login page filter // Required by login page filter
openIDFilterId = pc.getReaderContext().registerWithGeneratedName(openIDFilter); openIDFilterId = pc.getReaderContext().generateBeanName(openIDFilter);
pc.getRegistry().registerBeanDefinition(openIDFilterId, openIDFilter);
pc.registerBeanComponent(new BeanComponentDefinition(openIDFilter, openIDFilterId)); pc.registerBeanComponent(new BeanComponentDefinition(openIDFilter, openIDFilterId));
injectRememberMeServicesRef(openIDFilter, rememberMeServicesId); injectRememberMeServicesRef(openIDFilter, rememberMeServicesId);
@ -266,7 +265,7 @@ final class AuthenticationConfigBuilder {
entryPoint.getPropertyValues().addPropertyValue("realmName", realm); entryPoint.getPropertyValues().addPropertyValue("realmName", realm);
String entryPointId = pc.getReaderContext().registerWithGeneratedName(entryPoint); String entryPointId = pc.getReaderContext().generateBeanName(entryPoint);
pc.registerBeanComponent(new BeanComponentDefinition(entryPoint, entryPointId)); pc.registerBeanComponent(new BeanComponentDefinition(entryPoint, entryPointId));
filterBuilder.addPropertyValue("authenticationManager", authManager); filterBuilder.addPropertyValue("authenticationManager", authManager);
@ -398,7 +397,7 @@ final class AuthenticationConfigBuilder {
RootBeanDefinition anonymousProviderBean = new RootBeanDefinition(AnonymousAuthenticationProvider.class); RootBeanDefinition anonymousProviderBean = new RootBeanDefinition(AnonymousAuthenticationProvider.class);
anonymousProviderBean.setSource(anonymousFilter.getSource()); anonymousProviderBean.setSource(anonymousFilter.getSource());
anonymousProviderBean.getPropertyValues().addPropertyValue(keyPV); anonymousProviderBean.getPropertyValues().addPropertyValue(keyPV);
String id = pc.getReaderContext().registerWithGeneratedName(anonymousProviderBean); String id = pc.getReaderContext().generateBeanName(anonymousProviderBean);
pc.registerBeanComponent(new BeanComponentDefinition(anonymousProviderBean, id)); pc.registerBeanComponent(new BeanComponentDefinition(anonymousProviderBean, id));
anonymousProviderRef = new RuntimeBeanReference(id); anonymousProviderRef = new RuntimeBeanReference(id);
@ -430,7 +429,7 @@ final class AuthenticationConfigBuilder {
requestCacheBldr.addPropertyValue("portResolver", portResolver.getBeanDefinition()); requestCacheBldr.addPropertyValue("portResolver", portResolver.getBeanDefinition());
BeanDefinition bean = requestCacheBldr.getBeanDefinition(); BeanDefinition bean = requestCacheBldr.getBeanDefinition();
String id = pc.getReaderContext().registerWithGeneratedName(bean); String id = pc.getReaderContext().generateBeanName(bean);
pc.registerBeanComponent(new BeanComponentDefinition(bean, id)); pc.registerBeanComponent(new BeanComponentDefinition(bean, id));
this.requestCache = new RuntimeBeanReference(id); this.requestCache = new RuntimeBeanReference(id);

View File

@ -78,7 +78,7 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
logger.info("Using bean '" + expressionHandlerRef + "' as web SecurityExpressionHandler implementation"); logger.info("Using bean '" + expressionHandlerRef + "' as web SecurityExpressionHandler implementation");
} else { } else {
BeanDefinition expressionHandler = BeanDefinitionBuilder.rootBeanDefinition(DefaultWebSecurityExpressionHandler.class).getBeanDefinition(); BeanDefinition expressionHandler = BeanDefinitionBuilder.rootBeanDefinition(DefaultWebSecurityExpressionHandler.class).getBeanDefinition();
expressionHandlerRef = pc.getReaderContext().registerWithGeneratedName(expressionHandler); expressionHandlerRef = pc.getReaderContext().generateBeanName(expressionHandler);
pc.registerBeanComponent(new BeanComponentDefinition(expressionHandler, expressionHandlerRef)); pc.registerBeanComponent(new BeanComponentDefinition(expressionHandler, expressionHandlerRef));
} }

View File

@ -175,7 +175,7 @@ class HttpConfigurationBuilder {
} }
BeanDefinition repoBean = contextRepo.getBeanDefinition(); BeanDefinition repoBean = contextRepo.getBeanDefinition();
repoRef = pc.getReaderContext().registerWithGeneratedName(repoBean); repoRef = pc.getReaderContext().generateBeanName(repoBean);
pc.registerBeanComponent(new BeanComponentDefinition(repoBean, repoRef)); pc.registerBeanComponent(new BeanComponentDefinition(repoBean, repoRef));
} }
@ -261,7 +261,7 @@ class HttpConfigurationBuilder {
sessionStrategy.addPropertyValue("migrateSessionAttributes", sessionStrategy.addPropertyValue("migrateSessionAttributes",
Boolean.valueOf(sessionFixationAttribute.equals(OPT_SESSION_FIXATION_MIGRATE_SESSION))); Boolean.valueOf(sessionFixationAttribute.equals(OPT_SESSION_FIXATION_MIGRATE_SESSION)));
} }
sessionAuthStratRef = pc.getReaderContext().registerWithGeneratedName(strategyBean); sessionAuthStratRef = pc.getReaderContext().generateBeanName(strategyBean);
pc.registerBeanComponent(new BeanComponentDefinition(strategyBean, sessionAuthStratRef)); pc.registerBeanComponent(new BeanComponentDefinition(strategyBean, sessionAuthStratRef));
} }
@ -427,7 +427,7 @@ class HttpConfigurationBuilder {
String accessManagerId = httpElt.getAttribute(ATT_ACCESS_MGR); String accessManagerId = httpElt.getAttribute(ATT_ACCESS_MGR);
if (!StringUtils.hasText(accessManagerId)) { if (!StringUtils.hasText(accessManagerId)) {
accessManagerId = pc.getReaderContext().registerWithGeneratedName(accessDecisionMgr); accessManagerId = pc.getReaderContext().generateBeanName(accessDecisionMgr);
pc.registerBeanComponent(new BeanComponentDefinition(accessDecisionMgr, accessManagerId)); pc.registerBeanComponent(new BeanComponentDefinition(accessDecisionMgr, accessManagerId));
} }
@ -442,14 +442,14 @@ class HttpConfigurationBuilder {
builder.addPropertyValue("securityMetadataSource", securityMds); builder.addPropertyValue("securityMetadataSource", securityMds);
BeanDefinition fsiBean = builder.getBeanDefinition(); BeanDefinition fsiBean = builder.getBeanDefinition();
String fsiId = pc.getReaderContext().registerWithGeneratedName(fsiBean); String fsiId = pc.getReaderContext().generateBeanName(fsiBean);
pc.registerBeanComponent(new BeanComponentDefinition(fsiBean,fsiId)); pc.registerBeanComponent(new BeanComponentDefinition(fsiBean,fsiId));
// Create and register a DefaultWebInvocationPrivilegeEvaluator for use with taglibs etc. // Create and register a DefaultWebInvocationPrivilegeEvaluator for use with taglibs etc.
BeanDefinition wipe = new RootBeanDefinition(DefaultWebInvocationPrivilegeEvaluator.class); BeanDefinition wipe = new RootBeanDefinition(DefaultWebInvocationPrivilegeEvaluator.class);
wipe.getConstructorArgumentValues().addGenericArgumentValue(new RuntimeBeanReference(fsiId)); wipe.getConstructorArgumentValues().addGenericArgumentValue(new RuntimeBeanReference(fsiId));
String wipeId = pc.getReaderContext().registerWithGeneratedName(wipe);
pc.registerBeanComponent(new BeanComponentDefinition(wipe, wipeId)); pc.registerBeanComponent(new BeanComponentDefinition(wipe, pc.getReaderContext().generateBeanName(wipe)));
this.fsi = new RuntimeBeanReference(fsiId); this.fsi = new RuntimeBeanReference(fsiId);
} }

View File

@ -155,7 +155,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
// Register the portMapper. A default will always be created, even if no element exists. // Register the portMapper. A default will always be created, even if no element exists.
BeanDefinition portMapper = new PortMappingsBeanDefinitionParser().parse( BeanDefinition portMapper = new PortMappingsBeanDefinitionParser().parse(
DomUtils.getChildElementByTagName(elt, Elements.PORT_MAPPINGS), pc); DomUtils.getChildElementByTagName(elt, Elements.PORT_MAPPINGS), pc);
String portMapperName = pc.getReaderContext().registerWithGeneratedName(portMapper); String portMapperName = pc.getReaderContext().generateBeanName(portMapper);
pc.registerBeanComponent(new BeanComponentDefinition(portMapper, portMapperName)); pc.registerBeanComponent(new BeanComponentDefinition(portMapper, portMapperName));
return portMapperName; return portMapperName;
@ -179,7 +179,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
} }
authManager.getRawBeanDefinition().setSource(pc.extractSource(element)); authManager.getRawBeanDefinition().setSource(pc.extractSource(element));
BeanDefinition authMgrBean = authManager.getBeanDefinition(); BeanDefinition authMgrBean = authManager.getBeanDefinition();
String id = pc.getReaderContext().registerWithGeneratedName(authMgrBean); String id = pc.getReaderContext().generateBeanName(authMgrBean);
pc.registerBeanComponent(new BeanComponentDefinition(authMgrBean, id)); pc.registerBeanComponent(new BeanComponentDefinition(authMgrBean, id));
return new RuntimeBeanReference(id); return new RuntimeBeanReference(id);
@ -263,9 +263,8 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
fcpBldr.addPropertyValue("stripQueryStringFromUrls", Boolean.valueOf(matcher instanceof AntUrlPathMatcher)); fcpBldr.addPropertyValue("stripQueryStringFromUrls", Boolean.valueOf(matcher instanceof AntUrlPathMatcher));
fcpBldr.addPropertyValue("filterChainMap", filterChainMap); fcpBldr.addPropertyValue("filterChainMap", filterChainMap);
BeanDefinition fcpBean = fcpBldr.getBeanDefinition(); BeanDefinition fcpBean = fcpBldr.getBeanDefinition();
pc.getRegistry().registerBeanDefinition(BeanIds.FILTER_CHAIN_PROXY, fcpBean);
pc.getRegistry().registerAlias(BeanIds.FILTER_CHAIN_PROXY, BeanIds.SPRING_SECURITY_FILTER_CHAIN);
pc.registerBeanComponent(new BeanComponentDefinition(fcpBean, BeanIds.FILTER_CHAIN_PROXY)); pc.registerBeanComponent(new BeanComponentDefinition(fcpBean, BeanIds.FILTER_CHAIN_PROXY));
pc.getRegistry().registerAlias(BeanIds.FILTER_CHAIN_PROXY, BeanIds.SPRING_SECURITY_FILTER_CHAIN);
} }
static UrlMatcher createUrlMatcher(Element element) { static UrlMatcher createUrlMatcher(Element element) {

View File

@ -105,7 +105,7 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser {
} }
services.setSource(source); services.setSource(source);
services.getPropertyValues().addPropertyValue("key", key); services.getPropertyValues().addPropertyValue("key", key);
servicesName = pc.getReaderContext().registerWithGeneratedName(services); servicesName = pc.getReaderContext().generateBeanName(services);
pc.registerBeanComponent(new BeanComponentDefinition(services, servicesName)); pc.registerBeanComponent(new BeanComponentDefinition(services, servicesName));
} else { } else {
servicesName = rememberMeServicesRef; servicesName = rememberMeServicesRef;

View File

@ -128,7 +128,7 @@ public class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionP
logger.info("Using bean '" + expressionHandlerRef + "' as method ExpressionHandler implementation"); logger.info("Using bean '" + expressionHandlerRef + "' as method ExpressionHandler implementation");
} else { } else {
BeanDefinition expressionHandler = new RootBeanDefinition(DefaultMethodSecurityExpressionHandler.class); BeanDefinition expressionHandler = new RootBeanDefinition(DefaultMethodSecurityExpressionHandler.class);
expressionHandlerRef = pc.getReaderContext().registerWithGeneratedName(expressionHandler); expressionHandlerRef = pc.getReaderContext().generateBeanName(expressionHandler);
pc.registerBeanComponent(new BeanComponentDefinition(expressionHandler, expressionHandlerRef)); pc.registerBeanComponent(new BeanComponentDefinition(expressionHandler, expressionHandlerRef));
logger.info("Expressions were enabled for method security but no SecurityExpressionHandler was configured. " + logger.info("Expressions were enabled for method security but no SecurityExpressionHandler was configured. " +
"All hasPermision() expressions will evaluate to false."); "All hasPermision() expressions will evaluate to false.");
@ -167,7 +167,7 @@ public class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionP
if (pointcutMap.size() > 0) { if (pointcutMap.size() > 0) {
// Only add it if there are actually any pointcuts defined. // Only add it if there are actually any pointcuts defined.
BeanDefinition mapBasedMetadataSource = new RootBeanDefinition(MapBasedMethodSecurityMetadataSource.class); BeanDefinition mapBasedMetadataSource = new RootBeanDefinition(MapBasedMethodSecurityMetadataSource.class);
BeanReference ref = new RuntimeBeanReference(pc.getReaderContext().registerWithGeneratedName(mapBasedMetadataSource)); BeanReference ref = new RuntimeBeanReference(pc.getReaderContext().generateBeanName(mapBasedMetadataSource));
delegates.add(ref); delegates.add(ref);
pc.registerBeanComponent(new BeanComponentDefinition(mapBasedMetadataSource, ref.getBeanName())); pc.registerBeanComponent(new BeanComponentDefinition(mapBasedMetadataSource, ref.getBeanName()));
@ -226,7 +226,7 @@ public class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionP
accessMgrBuilder.addPropertyValue("decisionVoters", voters); accessMgrBuilder.addPropertyValue("decisionVoters", voters);
BeanDefinition accessManager = accessMgrBuilder.getBeanDefinition(); BeanDefinition accessManager = accessMgrBuilder.getBeanDefinition();
String id = pc.getReaderContext().registerWithGeneratedName(accessManager); String id = pc.getReaderContext().generateBeanName(accessManager);
pc.registerBeanComponent(new BeanComponentDefinition(accessManager, id)); pc.registerBeanComponent(new BeanComponentDefinition(accessManager, id));
return id; return id;
@ -238,7 +238,7 @@ public class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionP
delegatingMethodSecurityMetadataSource.setSource(source); delegatingMethodSecurityMetadataSource.setSource(source);
delegatingMethodSecurityMetadataSource.getPropertyValues().addPropertyValue("methodSecurityMetadataSources", delegates); delegatingMethodSecurityMetadataSource.getPropertyValues().addPropertyValue("methodSecurityMetadataSources", delegates);
String id = pc.getReaderContext().registerWithGeneratedName(delegatingMethodSecurityMetadataSource); String id = pc.getReaderContext().generateBeanName(delegatingMethodSecurityMetadataSource);
pc.registerBeanComponent(new BeanComponentDefinition(delegatingMethodSecurityMetadataSource, id)); pc.registerBeanComponent(new BeanComponentDefinition(delegatingMethodSecurityMetadataSource, id));
return new RuntimeBeanReference(id); return new RuntimeBeanReference(id);
@ -302,7 +302,7 @@ public class GlobalMethodSecurityBeanDefinitionParser implements BeanDefinitionP
} }
BeanDefinition bean = bldr.getBeanDefinition(); BeanDefinition bean = bldr.getBeanDefinition();
String id = pc.getReaderContext().registerWithGeneratedName(bean); String id = pc.getReaderContext().generateBeanName(bean);
pc.registerBeanComponent(new BeanComponentDefinition(bean, id)); pc.registerBeanComponent(new BeanComponentDefinition(bean, id));
return new RuntimeBeanReference(id); return new RuntimeBeanReference(id);

View File

@ -32,6 +32,7 @@ public class InMemoryXmlApplicationContext extends AbstractXmlApplicationContext
public InMemoryXmlApplicationContext(String xml, String secVersion, ApplicationContext parent) { public InMemoryXmlApplicationContext(String xml, String secVersion, ApplicationContext parent) {
String fullXml = BEANS_OPENING + secVersion + ".xsd'>\n" + xml + BEANS_CLOSE; String fullXml = BEANS_OPENING + secVersion + ".xsd'>\n" + xml + BEANS_CLOSE;
inMemoryXml = new InMemoryResource(fullXml); inMemoryXml = new InMemoryResource(fullXml);
setAllowBeanDefinitionOverriding(false);
setParent(parent); setParent(parent);
refresh(); refresh();
} }