Skip to content

Commit f20ae1a

Browse files
jzheauxjzheaux
committed
Revert gh-13783
This feature unfortunately regresses pre-existing behavior like that found in gh-15352. As such, this functionality has been removed. Closes gh-15352
1 parent f059c05 commit f20ae1a

14 files changed

+70
-219
lines changed

‎config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import java.util.function.Consumer;
2929
import java.util.function.Supplier;
3030

31+
import jakarta.annotation.security.DenyAll;
3132
import org.aopalliance.intercept.MethodInterceptor;
3233
import org.aopalliance.intercept.MethodInvocation;
3334
import org.junit.jupiter.api.Test;
@@ -50,6 +51,7 @@
5051
import org.springframework.security.access.annotation.BusinessServiceImpl;
5152
import org.springframework.security.access.annotation.ExpressionProtectedBusinessServiceImpl;
5253
import org.springframework.security.access.annotation.Jsr250BusinessServiceImpl;
54+
import org.springframework.security.access.annotation.Secured;
5355
import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
5456
import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
5557
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -944,6 +946,13 @@ void getUserWhenNotAuthorizedThenHandlerUsesCustomAuthorizationDecision() {
944946
verify(handler, never()).handleDeniedInvocation(any(), any(Authz.AuthzResult.class));
945947
}
946948

949+
// gh-15352
950+
@Test
951+
void annotationsInChildClassesDoNotAffectSuperclasses() {
952+
this.spring.register(AbstractClassConfig.class).autowire();
953+
this.spring.getContext().getBean(ClassInheritingAbstractClassWithNoAnnotations.class).method();
954+
}
955+
947956
private static Consumer<ConfigurableWebApplicationContext> disallowBeanOverriding() {
948957
return (context) -> ((AnnotationConfigWebApplicationContext) context).setAllowBeanDefinitionOverriding(false);
949958
}
@@ -1480,4 +1489,29 @@ MethodAuthorizationDeniedHandler methodAuthorizationDeniedHandler() {
14801489

14811490
}
14821491

1492+
abstract static class AbstractClassWithNoAnnotations {
1493+
1494+
String method() {
1495+
return "ok";
1496+
}
1497+
1498+
}
1499+
1500+
@PreAuthorize("denyAll()")
1501+
@Secured("DENIED")
1502+
@DenyAll
1503+
static class ClassInheritingAbstractClassWithNoAnnotations extends AbstractClassWithNoAnnotations {
1504+
1505+
}
1506+
1507+
@EnableMethodSecurity(securedEnabled = true, jsr250Enabled = true)
1508+
static class AbstractClassConfig {
1509+
1510+
@Bean
1511+
ClassInheritingAbstractClassWithNoAnnotations inheriting() {
1512+
return new ClassInheritingAbstractClassWithNoAnnotations();
1513+
}
1514+
1515+
}
1516+
14831517
}

‎core/src/main/java/org/springframework/security/authorization/method/AbstractExpressionAttributeRegistry.java

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -35,7 +35,6 @@
3535
* For internal use only, as this contract is likely to change
3636
*
3737
* @author Evgeniy Cheban
38-
* @author DingHao
3938
*/
4039
abstract class AbstractExpressionAttributeRegistry<T extends ExpressionAttribute> {
4140

@@ -100,8 +99,4 @@ void setTemplateDefaults(PrePostTemplateDefaults defaults) {
10099
@NonNull
101100
abstract T resolveAttribute(Method method, Class<?> targetClass);
102101

103-
Class<?> targetClass(Method method, Class<?> targetClass) {
104-
return (targetClass != null) ? targetClass : method.getDeclaringClass();
105-
}
106-
107102
}

‎core/src/main/java/org/springframework/security/authorization/method/Jsr250AuthorizationManager.java

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -44,7 +44,6 @@
4444
*
4545
* @author Evgeniy Cheban
4646
* @author Josh Cummings
47-
* @author DingHao
4847
* @since 5.6
4948
*/
5049
public final class Jsr250AuthorizationManager implements AuthorizationManager<MethodInvocation> {
@@ -122,8 +121,7 @@ AuthorizationManager<MethodInvocation> resolveManager(Method method, Class<?> ta
122121
private Annotation findJsr250Annotation(Method method, Class<?> targetClass) {
123122
Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass);
124123
Annotation annotation = findAnnotation(specificMethod);
125-
return (annotation != null) ? annotation
126-
: findAnnotation((targetClass != null) ? targetClass : specificMethod.getDeclaringClass());
124+
return (annotation != null) ? annotation : findAnnotation(specificMethod.getDeclaringClass());
127125
}
128126

129127
private Annotation findAnnotation(Method method) {

‎core/src/main/java/org/springframework/security/authorization/method/PostAuthorizeExpressionAttributeRegistry.java

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -33,7 +33,6 @@
3333
* For internal use only, as this contract is likely to change.
3434
*
3535
* @author Evgeniy Cheban
36-
* @author DingHao
3736
* @since 5.8
3837
*/
3938
final class PostAuthorizeExpressionAttributeRegistry extends AbstractExpressionAttributeRegistry<ExpressionAttribute> {
@@ -50,33 +49,33 @@ final class PostAuthorizeExpressionAttributeRegistry extends AbstractExpressionA
5049
@Override
5150
ExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
5251
Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass);
53-
PostAuthorize postAuthorize = findPostAuthorizeAnnotation(specificMethod, targetClass);
52+
PostAuthorize postAuthorize = findPostAuthorizeAnnotation(specificMethod);
5453
if (postAuthorize == null) {
5554
return ExpressionAttribute.NULL_ATTRIBUTE;
5655
}
5756
Expression expression = getExpressionHandler().getExpressionParser().parseExpression(postAuthorize.value());
58-
MethodAuthorizationDeniedHandler deniedHandler = resolveHandler(method, targetClass);
57+
MethodAuthorizationDeniedHandler deniedHandler = resolveHandler(method);
5958
return new PostAuthorizeExpressionAttribute(expression, deniedHandler);
6059
}
6160

62-
private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class<?> targetClass) {
61+
private MethodAuthorizationDeniedHandler resolveHandler(Method method) {
6362
Function<AnnotatedElement, HandleAuthorizationDenied> lookup = AuthorizationAnnotationUtils
6463
.withDefaults(HandleAuthorizationDenied.class);
6564
HandleAuthorizationDenied deniedHandler = lookup.apply(method);
6665
if (deniedHandler != null) {
6766
return this.handlerResolver.apply(deniedHandler.handlerClass());
6867
}
69-
deniedHandler = lookup.apply(targetClass(method, targetClass));
68+
deniedHandler = lookup.apply(method.getDeclaringClass());
7069
if (deniedHandler != null) {
7170
return this.handlerResolver.apply(deniedHandler.handlerClass());
7271
}
7372
return this.defaultHandler;
7473
}
7574

76-
private PostAuthorize findPostAuthorizeAnnotation(Method method, Class<?> targetClass) {
75+
private PostAuthorize findPostAuthorizeAnnotation(Method method) {
7776
Function<AnnotatedElement, PostAuthorize> lookup = findUniqueAnnotation(PostAuthorize.class);
7877
PostAuthorize postAuthorize = lookup.apply(method);
79-
return (postAuthorize != null) ? postAuthorize : lookup.apply(targetClass(method, targetClass));
78+
return (postAuthorize != null) ? postAuthorize : lookup.apply(method.getDeclaringClass());
8079
}
8180

8281
/**

‎core/src/main/java/org/springframework/security/authorization/method/PostFilterExpressionAttributeRegistry.java

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -29,7 +29,6 @@
2929
* For internal use only, as this contract is likely to change.
3030
*
3131
* @author Evgeniy Cheban
32-
* @author DingHao
3332
* @since 5.8
3433
*/
3534
final class PostFilterExpressionAttributeRegistry extends AbstractExpressionAttributeRegistry<ExpressionAttribute> {
@@ -38,7 +37,7 @@ final class PostFilterExpressionAttributeRegistry extends AbstractExpressionAttr
3837
@Override
3938
ExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
4039
Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass);
41-
PostFilter postFilter = findPostFilterAnnotation(specificMethod, targetClass);
40+
PostFilter postFilter = findPostFilterAnnotation(specificMethod);
4241
if (postFilter == null) {
4342
return ExpressionAttribute.NULL_ATTRIBUTE;
4443
}
@@ -47,10 +46,10 @@ ExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
4746
return new ExpressionAttribute(postFilterExpression);
4847
}
4948

50-
private PostFilter findPostFilterAnnotation(Method method, Class<?> targetClass) {
49+
private PostFilter findPostFilterAnnotation(Method method) {
5150
Function<AnnotatedElement, PostFilter> lookup = findUniqueAnnotation(PostFilter.class);
5251
PostFilter postFilter = lookup.apply(method);
53-
return (postFilter != null) ? postFilter : lookup.apply(targetClass(method, targetClass));
52+
return (postFilter != null) ? postFilter : lookup.apply(method.getDeclaringClass());
5453
}
5554

5655
}

‎core/src/main/java/org/springframework/security/authorization/method/PreAuthorizeExpressionAttributeRegistry.java

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -33,7 +33,6 @@
3333
* For internal use only, as this contract is likely to change.
3434
*
3535
* @author Evgeniy Cheban
36-
* @author DingHao
3736
* @since 5.8
3837
*/
3938
final class PreAuthorizeExpressionAttributeRegistry extends AbstractExpressionAttributeRegistry<ExpressionAttribute> {
@@ -50,33 +49,33 @@ final class PreAuthorizeExpressionAttributeRegistry extends AbstractExpressionAt
5049
@Override
5150
ExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
5251
Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass);
53-
PreAuthorize preAuthorize = findPreAuthorizeAnnotation(specificMethod, targetClass);
52+
PreAuthorize preAuthorize = findPreAuthorizeAnnotation(specificMethod);
5453
if (preAuthorize == null) {
5554
return ExpressionAttribute.NULL_ATTRIBUTE;
5655
}
5756
Expression expression = getExpressionHandler().getExpressionParser().parseExpression(preAuthorize.value());
58-
MethodAuthorizationDeniedHandler handler = resolveHandler(method, targetClass);
57+
MethodAuthorizationDeniedHandler handler = resolveHandler(method);
5958
return new PreAuthorizeExpressionAttribute(expression, handler);
6059
}
6160

62-
private MethodAuthorizationDeniedHandler resolveHandler(Method method, Class<?> targetClass) {
61+
private MethodAuthorizationDeniedHandler resolveHandler(Method method) {
6362
Function<AnnotatedElement, HandleAuthorizationDenied> lookup = AuthorizationAnnotationUtils
6463
.withDefaults(HandleAuthorizationDenied.class);
6564
HandleAuthorizationDenied deniedHandler = lookup.apply(method);
6665
if (deniedHandler != null) {
6766
return this.handlerResolver.apply(deniedHandler.handlerClass());
6867
}
69-
deniedHandler = lookup.apply(targetClass(method, targetClass));
68+
deniedHandler = lookup.apply(method.getDeclaringClass());
7069
if (deniedHandler != null) {
7170
return this.handlerResolver.apply(deniedHandler.handlerClass());
7271
}
7372
return this.defaultHandler;
7473
}
7574

76-
private PreAuthorize findPreAuthorizeAnnotation(Method method, Class<?> targetClass) {
75+
private PreAuthorize findPreAuthorizeAnnotation(Method method) {
7776
Function<AnnotatedElement, PreAuthorize> lookup = findUniqueAnnotation(PreAuthorize.class);
7877
PreAuthorize preAuthorize = lookup.apply(method);
79-
return (preAuthorize != null) ? preAuthorize : lookup.apply(targetClass(method, targetClass));
78+
return (preAuthorize != null) ? preAuthorize : lookup.apply(method.getDeclaringClass());
8079
}
8180

8281
/**

‎core/src/main/java/org/springframework/security/authorization/method/PreFilterExpressionAttributeRegistry.java

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -29,7 +29,6 @@
2929
* For internal use only, as this contract is likely to change.
3030
*
3131
* @author Evgeniy Cheban
32-
* @author DingHao
3332
* @since 5.8
3433
*/
3534
final class PreFilterExpressionAttributeRegistry
@@ -39,7 +38,7 @@ final class PreFilterExpressionAttributeRegistry
3938
@Override
4039
PreFilterExpressionAttribute resolveAttribute(Method method, Class<?> targetClass) {
4140
Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass);
42-
PreFilter preFilter = findPreFilterAnnotation(specificMethod, targetClass);
41+
PreFilter preFilter = findPreFilterAnnotation(specificMethod);
4342
if (preFilter == null) {
4443
return PreFilterExpressionAttribute.NULL_ATTRIBUTE;
4544
}
@@ -48,10 +47,10 @@ PreFilterExpressionAttribute resolveAttribute(Method method, Class<?> targetClas
4847
return new PreFilterExpressionAttribute(preFilterExpression, preFilter.filterTarget());
4948
}
5049

51-
private PreFilter findPreFilterAnnotation(Method method, Class<?> targetClass) {
50+
private PreFilter findPreFilterAnnotation(Method method) {
5251
Function<AnnotatedElement, PreFilter> lookup = findUniqueAnnotation(PreFilter.class);
5352
PreFilter preFilter = lookup.apply(method);
54-
return (preFilter != null) ? preFilter : lookup.apply(targetClass(method, targetClass));
53+
return (preFilter != null) ? preFilter : lookup.apply(method.getDeclaringClass());
5554
}
5655

5756
static final class PreFilterExpressionAttribute extends ExpressionAttribute {

‎core/src/main/java/org/springframework/security/authorization/method/SecuredAuthorizationManager.java

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -41,7 +41,6 @@
4141
* contains a specified authority from the Spring Security's {@link Secured} annotation.
4242
*
4343
* @author Evgeniy Cheban
44-
* @author DingHao
4544
* @since 5.6
4645
*/
4746
public final class SecuredAuthorizationManager implements AuthorizationManager<MethodInvocation> {
@@ -87,14 +86,14 @@ private Set<String> getAuthorities(MethodInvocation methodInvocation) {
8786

8887
private Set<String> resolveAuthorities(Method method, Class<?> targetClass) {
8988
Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass);
90-
Secured secured = findSecuredAnnotation(specificMethod, targetClass);
89+
Secured secured = findSecuredAnnotation(specificMethod);
9190
return (secured != null) ? Set.of(secured.value()) : Collections.emptySet();
9291
}
9392

94-
private Secured findSecuredAnnotation(Method method, Class<?> targetClass) {
93+
private Secured findSecuredAnnotation(Method method) {
9594
Secured secured = AuthorizationAnnotationUtils.findUniqueAnnotation(method, Secured.class);
96-
return (secured != null) ? secured : AuthorizationAnnotationUtils
97-
.findUniqueAnnotation((targetClass != null) ? targetClass : method.getDeclaringClass(), Secured.class);
95+
return (secured != null) ? secured
96+
: AuthorizationAnnotationUtils.findUniqueAnnotation(method.getDeclaringClass(), Secured.class);
9897
}
9998

10099
}

‎core/src/test/java/org/springframework/security/authorization/method/Jsr250AuthorizationManagerTests.java

Lines changed: 1 addition & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -225,56 +225,6 @@ public void checkInheritedAnnotationsWhenConflictingThenAnnotationConfigurationE
225225
.isThrownBy(() -> manager.check(authentication, methodInvocation));
226226
}
227227

228-
@Test
229-
public void checkRequiresUserWhenMethodsFromInheritThenApplies() throws Exception {
230-
MockMethodInvocation methodInvocation = new MockMethodInvocation(new RolesAllowedClass(),
231-
RolesAllowedClass.class, "securedUser");
232-
Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager();
233-
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation);
234-
assertThat(decision.isGranted()).isTrue();
235-
}
236-
237-
@Test
238-
public void checkPermitAllWhenMethodsFromInheritThenApplies() throws Exception {
239-
MockMethodInvocation methodInvocation = new MockMethodInvocation(new PermitAllClass(), PermitAllClass.class,
240-
"securedUser");
241-
Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager();
242-
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation);
243-
assertThat(decision.isGranted()).isTrue();
244-
}
245-
246-
@Test
247-
public void checkDenyAllWhenMethodsFromInheritThenApplies() throws Exception {
248-
MockMethodInvocation methodInvocation = new MockMethodInvocation(new DenyAllClass(), DenyAllClass.class,
249-
"securedUser");
250-
Jsr250AuthorizationManager manager = new Jsr250AuthorizationManager();
251-
AuthorizationDecision decision = manager.check(TestAuthentication::authenticatedUser, methodInvocation);
252-
assertThat(decision.isGranted()).isFalse();
253-
}
254-
255-
@RolesAllowed("USER")
256-
public static class RolesAllowedClass extends ParentClass {
257-
258-
}
259-
260-
@PermitAll
261-
public static class PermitAllClass extends ParentClass {
262-
263-
}
264-
265-
@DenyAll
266-
public static class DenyAllClass extends ParentClass {
267-
268-
}
269-
270-
public static class ParentClass {
271-
272-
public void securedUser() {
273-
274-
}
275-
276-
}
277-
278228
public static class TestClass implements InterfaceAnnotationsOne, InterfaceAnnotationsTwo {
279229

280230
public void doSomething() {

0 commit comments

Comments
 (0)