SEC-2322: Support StandardReflectionParameterNameDiscoverer

core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java

@@ -9,7 +9,6 @@ import java.util.List;
 import org.aopalliance.intercept.MethodInvocation;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
 import org.springframework.core.ParameterNameDiscoverer;
 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.Expression;
@@ -20,6 +19,7 @@ import org.springframework.security.access.expression.ExpressionUtils;
 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.parameters.DefaultSecurityParameterNameDiscoverer;
 import org.springframework.util.Assert;
 
 /**
@@ -35,7 +35,7 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr
     protected final Log logger = LogFactory.getLog(getClass());
 
     private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
-    private ParameterNameDiscoverer parameterNameDiscoverer = new LocalVariableTableParameterNameDiscoverer();
+    private ParameterNameDiscoverer parameterNameDiscoverer = new DefaultSecurityParameterNameDiscoverer();
     private PermissionCacheOptimizer permissionCacheOptimizer = null;
 
     public DefaultMethodSecurityExpressionHandler() {
@@ -157,6 +157,10 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr
         this.trustResolver = trustResolver;
     }
 
+    /**
+     * Sets the {@link ParameterNameDiscoverer} to use. The default is {@link DefaultSecurityParameterNameDiscoverer}.
+     * @param parameterNameDiscoverer
+     */
     public void setParameterNameDiscoverer(ParameterNameDiscoverer parameterNameDiscoverer) {
         this.parameterNameDiscoverer = parameterNameDiscoverer;
     }

core/src/main/java/org/springframework/security/access/expression/method/MethodSecurityEvaluationContext.java

@@ -7,10 +7,10 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.aop.framework.AopProxyUtils;
 import org.springframework.aop.support.AopUtils;
-import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
 import org.springframework.core.ParameterNameDiscoverer;
 import org.springframework.expression.spel.support.StandardEvaluationContext;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.parameters.DefaultSecurityParameterNameDiscoverer;
 
 /**
  * Internal security-specific EvaluationContext implementation which lazily adds the
@@ -33,7 +33,7 @@ class MethodSecurityEvaluationContext extends StandardEvaluationContext {
      * allowing for caching.
      */
     public MethodSecurityEvaluationContext(Authentication user, MethodInvocation mi) {
-        this(user, mi, new LocalVariableTableParameterNameDiscoverer());
+        this(user, mi, new DefaultSecurityParameterNameDiscoverer());
     }
 
     public MethodSecurityEvaluationContext(Authentication user, MethodInvocation mi,

core/src/main/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscoverer.java

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.springframework.security.core.parameters;
+
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
+import org.springframework.core.ParameterNameDiscoverer;
+import org.springframework.core.PrioritizedParameterNameDiscoverer;
+import org.springframework.util.Assert;
+import org.springframework.util.ClassUtils;
+
+
+/**
+ * Spring Security's default {@link ParameterNameDiscoverer} which tries a
+ * number of {@link ParameterNameDiscoverer} depending on what is found on the
+ * classpath.
+ *
+ * <ul>
+ * <li>If Spring 4 is on the classpath, then DefaultParameterNameDiscoverer is
+ * added. This attempts to use JDK 8 information first and falls back to
+ * {@link LocalVariableTableParameterNameDiscoverer}.</li>
+ * <li>If Spring 4 is not on the classpath, then
+ * {@link LocalVariableTableParameterNameDiscoverer} is added directly.</li>
+ * </ul>
+ *
+ * @author Rob Winch
+ * @since 3.2
+ */
+public class DefaultSecurityParameterNameDiscoverer extends
+        PrioritizedParameterNameDiscoverer {
+
+    private final Log logger = LogFactory.getLog(getClass());
+
+    private static final String DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME =
+            "org.springframework.core.DefaultParameterNameDiscoverer";
+    private static final boolean DEFAULT_PARAM_DISCOVERER_PRESENT =
+            ClassUtils.isPresent(DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME, DefaultSecurityParameterNameDiscoverer.class.getClassLoader());
+
+    /**
+     * Creates a new instance with only the default
+     * {@link ParameterNameDiscoverer} instances.
+     */
+    public DefaultSecurityParameterNameDiscoverer() {
+        this(Collections.<ParameterNameDiscoverer>emptyList());
+    }
+
+    /**
+     * Creates a new instance that first tries the passed in {@link ParameterNameDiscoverer} instances.
+     * @param parameterNameDiscovers the {@link ParameterNameDiscoverer} before trying the defaults. Cannot be null.
+     */
+    @SuppressWarnings("unchecked")
+    public DefaultSecurityParameterNameDiscoverer(List<? extends ParameterNameDiscoverer> parameterNameDiscovers) {
+        Assert.notNull(parameterNameDiscovers, "parameterNameDiscovers cannot be null");
+        for(ParameterNameDiscoverer discover : parameterNameDiscovers) {
+            addDiscoverer(discover);
+        }
+        if (DEFAULT_PARAM_DISCOVERER_PRESENT) {
+            try {
+                Class<? extends ParameterNameDiscoverer> paramNameDiscoverClass = (Class<? extends ParameterNameDiscoverer>) ClassUtils
+                        .forName(DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME,
+                                getClass().getClassLoader());
+                addDiscoverer(paramNameDiscoverClass.newInstance());
+            } catch (Exception e) {
+                logger.warn(
+                        "Could not use "
+                                + DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME
+                                + ". Falling back to LocalVariableTableParameterNameDiscoverer.", e);
+                addDiscoverer(new LocalVariableTableParameterNameDiscoverer());
+            }
+        } else {
+            addDiscoverer(new LocalVariableTableParameterNameDiscoverer());
+        }
+    }
+}

core/src/test/java/org/springframework/core/DefaultParameterNameDiscoverer.java

@@ -0,0 +1,25 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.springframework.core;
+
+/**
+ *
+ * @author Rob Winch
+ *
+ */
+public class DefaultParameterNameDiscoverer extends PrioritizedParameterNameDiscoverer {
+
+}

core/src/test/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscovererTests.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.springframework.security.core.parameters;
+
+import static org.fest.assertions.Assertions.assertThat;
+
+import java.util.Arrays;
+import java.util.List;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.core.DefaultParameterNameDiscoverer;
+import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
+import org.springframework.core.ParameterNameDiscoverer;
+import org.springframework.test.util.ReflectionTestUtils;
+
+/**
+ *
+ * @author Rob Winch
+ * @since 3.2
+ */
+@SuppressWarnings("unchecked")
+public class DefaultSecurityParameterNameDiscovererTests {
+    private DefaultSecurityParameterNameDiscoverer discoverer;
+
+    @Before
+    public void setup() {
+        discoverer = new DefaultSecurityParameterNameDiscoverer();
+    }
+
+    @Test
+    public void constructorDefault() {
+        List<ParameterNameDiscoverer> discoverers = (List<ParameterNameDiscoverer>) ReflectionTestUtils
+                .getField(discoverer, "parameterNameDiscoverers");
+        assertThat(discoverers.size()).isEqualTo(1);
+        assertThat(discoverers.get(0)).isInstanceOf(
+                DefaultParameterNameDiscoverer.class);
+    }
+
+    @Test
+    public void constructorDiscoverers() {
+        discoverer = new DefaultSecurityParameterNameDiscoverer(Arrays.asList(new LocalVariableTableParameterNameDiscoverer()));
+
+        List<ParameterNameDiscoverer> discoverers = (List<ParameterNameDiscoverer>) ReflectionTestUtils
+                .getField(discoverer, "parameterNameDiscoverers");
+
+        assertThat(discoverers.size()).isEqualTo(2);
+        assertThat(discoverers.get(0)).isInstanceOf(
+                LocalVariableTableParameterNameDiscoverer.class);
+        assertThat(discoverers.get(1)).isInstanceOf(
+                DefaultParameterNameDiscoverer.class);
+    }
+}