From d7921daa13ccc33d025f8c5de851820121f93e1e Mon Sep 17 00:00:00 2001
From: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Date: Thu, 23 Jan 2025 16:44:10 -0700
Subject: [PATCH] Support Serialization for SecurityConfig

Issue gh-16276
---
 ...pringSecurityCoreVersionSerializableTests.java |   2 ++
 ...work.security.access.SecurityConfig.serialized | Bin 0 -> 109 bytes
 .../security/access/SecurityConfig.java           |   4 ++++
 .../access/annotation/Jsr250SecurityConfig.java   |   1 +
 4 files changed, 7 insertions(+)
 create mode 100644 config/src/test/resources/serialized/6.4.x/org.springframework.security.access.SecurityConfig.serialized

diff --git a/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java b/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java
index ecac0f4da5..49e800cae0 100644
--- a/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java
+++ b/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java
@@ -60,6 +60,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpSession;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.AuthorizationServiceException;
+import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.access.intercept.RunAsUserToken;
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.authentication.AccountExpiredException;
@@ -442,6 +443,7 @@ class SpringSecurityCoreVersionSerializableTests {
 		generatorByClassName.put(JaasAuthenticationSuccessEvent.class,
 				(r) -> new JaasAuthenticationSuccessEvent(authentication));
 		generatorByClassName.put(AbstractSessionEvent.class, (r) -> new AbstractSessionEvent(securityContext));
+		generatorByClassName.put(SecurityConfig.class, (r) -> new SecurityConfig("value"));
 
 		// cas
 		generatorByClassName.put(CasServiceTicketAuthenticationToken.class, (r) -> {
diff --git a/config/src/test/resources/serialized/6.4.x/org.springframework.security.access.SecurityConfig.serialized b/config/src/test/resources/serialized/6.4.x/org.springframework.security.access.SecurityConfig.serialized
new file mode 100644
index 0000000000000000000000000000000000000000..ae659612d7304086cc379fafb84075a5e5d1f7db
GIT binary patch
literal 109
zcmZ4UmVvdnh`}hoC|$3(peQphJ*_A)H?=&!C|j>MHMz7Xv!qflF*!N4xL7Y3%6HDs
zOUq23^C9;|nf9jwCI&_y2DZeKlA_F{5(Xikti-ZJ{hY+Sbp2qUP+q!qML`JzYguAW
GX(|8>RVfkx

literal 0
HcmV?d00001

diff --git a/core/src/main/java/org/springframework/security/access/SecurityConfig.java b/core/src/main/java/org/springframework/security/access/SecurityConfig.java
index 3079174e52..2cbc640b3a 100644
--- a/core/src/main/java/org/springframework/security/access/SecurityConfig.java
+++ b/core/src/main/java/org/springframework/security/access/SecurityConfig.java
@@ -16,6 +16,7 @@
 
 package org.springframework.security.access;
 
+import java.io.Serial;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -29,6 +30,9 @@ import org.springframework.util.StringUtils;
  */
 public class SecurityConfig implements ConfigAttribute {
 
+	@Serial
+	private static final long serialVersionUID = -7138084564199804304L;
+
 	private final String attrib;
 
 	public SecurityConfig(String config) {
diff --git a/core/src/main/java/org/springframework/security/access/annotation/Jsr250SecurityConfig.java b/core/src/main/java/org/springframework/security/access/annotation/Jsr250SecurityConfig.java
index 3a3ccdf91e..f129fdbe17 100644
--- a/core/src/main/java/org/springframework/security/access/annotation/Jsr250SecurityConfig.java
+++ b/core/src/main/java/org/springframework/security/access/annotation/Jsr250SecurityConfig.java
@@ -30,6 +30,7 @@ import org.springframework.security.authorization.method.AuthorizationManagerBef
  * @deprecated Use {@link AuthorizationManagerBeforeMethodInterceptor#jsr250()} instead
  */
 @Deprecated
+@SuppressWarnings("serial")
 public class Jsr250SecurityConfig extends SecurityConfig {
 
 	public static final Jsr250SecurityConfig PERMIT_ALL_ATTRIBUTE = new Jsr250SecurityConfig(PermitAll.class.getName());