Skip to content

Commit f478022

Browse files
jonah1und1jonah1und1
committed
Merge branch 'main' into spring-projectsgh-15818 
2 parents 157267a + 1782668 commit f478022

File tree

398 files changed

+29468
-3186
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

398 files changed

+29468
-3186
lines changed

‎.github/workflows/pr-build-workflow.yml

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@ name: PR Build
22

33
on: pull_request
44

5-
env:
6-
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
7-
85
permissions:
96
contents: read
107

@@ -21,7 +18,7 @@ jobs:
2118
java-version: '17'
2219
distribution: 'temurin'
2320
- name: Build with Gradle
24-
run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue
21+
run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue --scan
2522
generate-docs:
2623
name: Generate Docs
2724
runs-on: ubuntu-latest

‎acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ public boolean isGranted(List<Permission> permission, List<Sid> sids, boolean ad
202202
public boolean isSidLoaded(List<Sid> sids) {
203203
// If loadedSides is null, this indicates all SIDs were loaded
204204
// Also return true if the caller didn't specify a SID to find
205-
if ((this.loadedSids == null) || (sids == null) || (sids.size() == 0)) {
205+
if ((this.loadedSids == null) || (sids == null) || sids.isEmpty()) {
206206
return true;
207207
}
208208

‎acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionFactory.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -140,7 +140,7 @@ public Permission buildFromName(String name) {
140140

141141
@Override
142142
public List<Permission> buildFromNames(List<String> names) {
143-
if ((names == null) || (names.size() == 0)) {
143+
if ((names == null) || names.isEmpty()) {
144144
return Collections.emptyList();
145145
}
146146
List<Permission> permissions = new ArrayList<>(names.size());

‎build.gradle

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ develocity {
106106
}
107107

108108
nohttp {
109-
source.exclude "buildSrc/build/**"
109+
source.exclude "buildSrc/build/**", "javascript/.gradle/**", "javascript/package-lock.json", "javascript/node_modules/**", "javascript/build/**", "javascript/dist/**"
110110
source.builtBy(project(':spring-security-config').tasks.withType(RncToXsd))
111111
}
112112

‎buildSrc/src/main/java/org/springframework/gradle/maven/PublishAllJavaComponentsPlugin.java

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@
77
import org.gradle.api.plugins.JavaPlatformPlugin;
88
import org.gradle.api.plugins.JavaPlugin;
99
import org.gradle.api.publish.PublishingExtension;
10-
import org.gradle.api.publish.VariantVersionMappingStrategy;
11-
import org.gradle.api.publish.VersionMappingStrategy;
1210
import org.gradle.api.publish.maven.MavenPublication;
1311
import org.gradle.api.publish.maven.plugins.MavenPublishPlugin;
1412

‎buildSrc/src/main/java/org/springframework/security/convention/versions/VerifyDependenciesVersionsPlugin.java

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -23,7 +23,6 @@
2323
import org.gradle.api.artifacts.MinimalExternalModuleDependency;
2424
import org.gradle.api.artifacts.VersionCatalog;
2525
import org.gradle.api.artifacts.VersionCatalogsExtension;
26-
import org.gradle.api.file.RegularFile;
2726
import org.gradle.api.file.RegularFileProperty;
2827
import org.gradle.api.plugins.JavaBasePlugin;
2928
import org.gradle.api.provider.Property;
@@ -36,7 +35,6 @@
3635
import org.gradle.api.tasks.TaskProvider;
3736
import org.gradle.api.tasks.VerificationException;
3837

39-
import java.io.File;
4038
import java.io.IOException;
4139
import java.nio.file.Files;
4240
import java.util.Optional;

‎cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationToken.java

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -115,15 +115,8 @@ public boolean equals(final Object obj) {
115115
if (!super.equals(obj)) {
116116
return false;
117117
}
118-
if (obj instanceof CasAuthenticationToken) {
119-
CasAuthenticationToken test = (CasAuthenticationToken) obj;
120-
if (!this.assertion.equals(test.getAssertion())) {
121-
return false;
122-
}
123-
if (this.getKeyHash() != test.getKeyHash()) {
124-
return false;
125-
}
126-
return true;
118+
if (obj instanceof CasAuthenticationToken test) {
119+
return this.assertion.equals(test.getAssertion()) && this.getKeyHash() == test.getKeyHash();
127120
}
128121
return false;
129122
}

‎config/spring-security-config.gradle

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ dependencies {
4343
optional 'org.jetbrains.kotlin:kotlin-reflect'
4444
optional 'org.jetbrains.kotlin:kotlin-stdlib-jdk8'
4545
optional 'jakarta.annotation:jakarta.annotation-api'
46+
optional libs.webauthn4j.core
4647

4748
provided 'jakarta.servlet:jakarta.servlet-api'
4849

‎config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeAuthenticationProviderBeanManagerConfigurer.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -95,7 +95,7 @@ private <T> List<BeanWithName<T>> getBeansWithName(Class<T> type) {
9595
.getBeanNamesForType(type);
9696
for (String beanName : beanNames) {
9797
T bean = InitializeAuthenticationProviderBeanManagerConfigurer.this.context.getBean(beanName, type);
98-
beanWithNames.add(new BeanWithName<T>(bean, beanName));
98+
beanWithNames.add(new BeanWithName<>(bean, beanName));
9999
}
100100
return beanWithNames;
101101
}

‎config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeUserDetailsBeanManagerConfigurer.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ private <T> List<BeanWithName<T>> getBeansWithName(Class<T> type) {
134134
String[] beanNames = InitializeUserDetailsBeanManagerConfigurer.this.context.getBeanNamesForType(type);
135135
for (String beanName : beanNames) {
136136
T bean = InitializeUserDetailsBeanManagerConfigurer.this.context.getBean(beanName, type);
137-
beanWithNames.add(new BeanWithName<T>(bean, beanName));
137+
beanWithNames.add(new BeanWithName<>(bean, beanName));
138138
}
139139
return beanWithNames;
140140
}

‎config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ public class GlobalMethodSecurityConfiguration implements ImportAware, SmartInit
9797

9898
private static final Log logger = LogFactory.getLog(GlobalMethodSecurityConfiguration.class);
9999

100-
private ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<Object>() {
100+
private ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<>() {
101101

102102
@Override
103103
public <T> T postProcess(T object) {

‎config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@
6767
import org.springframework.security.config.annotation.web.configurers.SecurityContextConfigurer;
6868
import org.springframework.security.config.annotation.web.configurers.ServletApiConfigurer;
6969
import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer;
70+
import org.springframework.security.config.annotation.web.configurers.WebAuthnConfigurer;
7071
import org.springframework.security.config.annotation.web.configurers.X509Configurer;
7172
import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer;
7273
import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer;
@@ -3003,8 +3004,8 @@ public HttpSecurity oauth2ResourceServer(
30033004
* }
30043005
*
30053006
* &#064;Bean
3006-
* public GeneratedOneTimeTokenHandler generatedOneTimeTokenHandler() {
3007-
* return new MyMagicLinkGeneratedOneTimeTokenHandler();
3007+
* public OneTimeTokenGenerationSuccessHandler oneTimeTokenGenerationSuccessHandler() {
3008+
* return new MyMagicLinkOneTimeTokenGenerationSuccessHandler();
30083009
* }
30093010
*
30103011
* }
@@ -3674,6 +3675,31 @@ public HttpSecurity securityMatcher(String... patterns) {
36743675
return this;
36753676
}
36763677

3678+
/**
3679+
* Specifies webAuthn/passkeys based authentication.
3680+
*
3681+
* <pre>
3682+
* &#064;Bean
3683+
* SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
3684+
* http
3685+
* // ...
3686+
* .webAuthn((webAuthn) -&gt; webAuthn
3687+
* .rpName("Spring Security Relying Party")
3688+
* .rpId("example.com")
3689+
* .allowedOrigins("https://example.com")
3690+
* );
3691+
* return http.build();
3692+
* }
3693+
* </pre>
3694+
* @param webAuthn the customizer to apply
3695+
* @return the {@link HttpSecurity} for further customizations
3696+
* @throws Exception
3697+
*/
3698+
public HttpSecurity webAuthn(Customizer<WebAuthnConfigurer<HttpSecurity>> webAuthn) throws Exception {
3699+
webAuthn.customize(getOrApply(new WebAuthnConfigurer<>()));
3700+
return HttpSecurity.this;
3701+
}
3702+
36773703
private List<RequestMatcher> createAntMatchers(String... patterns) {
36783704
List<RequestMatcher> matchers = new ArrayList<>(patterns.length);
36793705
for (String pattern : patterns) {

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ private AuthorizationManager<HttpServletRequest> createAuthorizationManager() {
170170
+ ". Try completing it with something like requestUrls().<something>.hasRole('USER')");
171171
Assert.state(this.mappingCount > 0,
172172
"At least one mapping is required (for example, authorizeHttpRequests().anyRequest().authenticated())");
173-
RequestMatcherDelegatingAuthorizationManager manager = postProcess(this.managerBuilder.build());
173+
AuthorizationManager<HttpServletRequest> manager = postProcess(
174+
(AuthorizationManager<HttpServletRequest>) this.managerBuilder.build());
174175
return AuthorizeHttpRequestsConfigurer.this.postProcessor.postProcess(manager);
175176
}
176177

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/HttpBasicConfigurer.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -179,8 +179,7 @@ private void registerDefaults(B http) {
179179
allMatcher.setUseEquals(true);
180180
RequestMatcher notHtmlMatcher = new NegatedRequestMatcher(
181181
new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.TEXT_HTML));
182-
RequestMatcher restNotHtmlMatcher = new AndRequestMatcher(
183-
Arrays.<RequestMatcher>asList(notHtmlMatcher, restMatcher));
182+
RequestMatcher restNotHtmlMatcher = new AndRequestMatcher(Arrays.asList(notHtmlMatcher, restMatcher));
184183
RequestMatcher preferredMatcher = new OrRequestMatcher(
185184
Arrays.asList(X_REQUESTED_WITH, restNotHtmlMatcher, allMatcher));
186185
registerDefaultEntryPoint(http, preferredMatcher);

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
3434
import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter;
3535
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices;
36+
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
3637
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
3738
import org.springframework.security.web.context.SecurityContextRepository;
3839
import org.springframework.util.Assert;
@@ -296,6 +297,13 @@ public void configure(H http) {
296297
rememberMeFilter.setSecurityContextRepository(securityContextRepository);
297298
}
298299
rememberMeFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
300+
301+
SessionAuthenticationStrategy sessionAuthenticationStrategy = http
302+
.getSharedObject(SessionAuthenticationStrategy.class);
303+
if (sessionAuthenticationStrategy != null) {
304+
rememberMeFilter.setSessionAuthenticationStrategy(sessionAuthenticationStrategy);
305+
}
306+
299307
rememberMeFilter = postProcess(rememberMeFilter);
300308
http.addFilter(rememberMeFilter);
301309
}

0 commit comments

Comments
 (0)