Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2026-02-24 22:25:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Handle null authority string in AuthoritiesAuthorizationManager

Browse Source 
This prevents NPE when GrantedAuthority.getAuthority() returns null. Closes gh-18543

Signed-off-by: Khyojae <khjae201@gmail.com>
This commit is contained in:
Khyojae 2026-01-22 03:48:06 +09:00 committed by Robert Winch
parent ac556a45f9
commit d87dc9ae57
No known key found for this signature in database
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
core/src/main/java/org/springframework/security/authorization/AuthoritiesAuthorizationManager.java
View File

@ -67,7 +67,11 @@ public final class AuthoritiesAuthorizationManager implements AuthorizationManag
private boolean isAuthorized(Authentication authentication, Collection<String> authorities) {
for (GrantedAuthority grantedAuthority : getGrantedAuthorities(authentication)) {
if (authorities.contains(grantedAuthority.getAuthority())) {
String authority = grantedAuthority.getAuthority();
if (authority == null) {
continue;
}
if (authorities.contains(authority)) {
return true;
}
}

16
core/src/test/java/org/springframework/security/authorization/AuthoritiesAuthorizationManagerTests.java
View File

@ -14,9 +14,11 @@
* limitations under the License.
*/
package org.springframework.security.authorization;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.function.Supplier;
@ -35,6 +37,7 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
* Tests for {@link AuthoritiesAuthorizationManager}.
*
* @author Evgeniy Cheban
* @author Khyojae
*/
class AuthoritiesAuthorizationManagerTests {
@ -42,7 +45,7 @@ class AuthoritiesAuthorizationManagerTests {
void setRoleHierarchyWhenNullThenIllegalArgumentException() {
AuthoritiesAuthorizationManager manager = new AuthoritiesAuthorizationManager();
assertThatIllegalArgumentException().isThrownBy(() -> manager.setRoleHierarchy(null))
.withMessage("roleHierarchy cannot be null");
.withMessage("roleHierarchy cannot be null");
}
@Test
@ -84,4 +87,15 @@ class AuthoritiesAuthorizationManagerTests {
assertThat(manager.check(authentication, Collections.singleton("ROLE_USER")).isGranted()).isTrue();
}
@Test
void authorizeWhenAuthorityIsNullThenDoesNotThrowNullPointerException() {
AuthoritiesAuthorizationManager manager = new AuthoritiesAuthorizationManager();
Authentication authentication = new TestingAuthenticationToken("user", "password",
Collections.singletonList(() -> null));
Collection<String> authorities = Collections.singleton("ROLE_USER");
assertThat(manager.authorize(() -> authentication, authorities).isGranted()).isFalse();
}
}