From 2686af0c4dea7c7423915da3dc592b3076b2a60a Mon Sep 17 00:00:00 2001 From: Marcus Da Coregio Date: Mon, 19 Jun 2023 10:26:03 -0300 Subject: [PATCH] Revert "Only Register as Advisor in Proxy Mode" This reverts commit 35ad1f85 --- .../Jsr250MethodSecurityConfiguration.java | 5 +- .../MethodSecurityAdvisorRegistrar.java | 52 ------------------- .../configuration/MethodSecuritySelector.java | 5 +- .../PrePostMethodSecurityConfiguration.java | 14 ++--- .../SecuredMethodSecurityConfiguration.java | 5 +- 5 files changed, 11 insertions(+), 70 deletions(-) delete mode 100644 config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityAdvisorRegistrar.java diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/Jsr250MethodSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/Jsr250MethodSecurityConfiguration.java index 8ad32205935..e3a799f1e9e 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/Jsr250MethodSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/Jsr250MethodSecurityConfiguration.java @@ -17,9 +17,9 @@ package org.springframework.security.config.annotation.method.configuration; import io.micrometer.observation.ObservationRegistry; -import org.aopalliance.intercept.MethodInterceptor; import org.aopalliance.intercept.MethodInvocation; +import org.springframework.aop.Advisor; import org.springframework.beans.factory.ObjectProvider; import org.springframework.beans.factory.config.BeanDefinition; import org.springframework.context.annotation.Bean; @@ -46,8 +46,7 @@ final class Jsr250MethodSecurityConfiguration { @Bean @Role(BeanDefinition.ROLE_INFRASTRUCTURE) - static MethodInterceptor jsr250AuthorizationMethodInterceptor( - ObjectProvider defaultsProvider, + Advisor jsr250AuthorizationMethodInterceptor(ObjectProvider defaultsProvider, ObjectProvider strategyProvider, ObjectProvider registryProvider) { Jsr250AuthorizationManager jsr250 = new Jsr250AuthorizationManager(); diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityAdvisorRegistrar.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityAdvisorRegistrar.java deleted file mode 100644 index 3735117cf37..00000000000 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityAdvisorRegistrar.java +++ /dev/null @@ -1,52 +0,0 @@ -/* - * Copyright 2002-2023 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.security.config.annotation.method.configuration; - -import org.springframework.aop.Advisor; -import org.springframework.beans.factory.config.BeanDefinition; -import org.springframework.beans.factory.support.BeanDefinitionRegistry; -import org.springframework.beans.factory.support.RootBeanDefinition; -import org.springframework.context.annotation.ImportBeanDefinitionRegistrar; -import org.springframework.core.type.AnnotationMetadata; - -class MethodSecurityAdvisorRegistrar implements ImportBeanDefinitionRegistrar { - - @Override - public void registerBeanDefinitions(AnnotationMetadata importingClassMetadata, BeanDefinitionRegistry registry) { - registerAsAdvisor("preFilterAuthorization", registry); - registerAsAdvisor("preAuthorizeAuthorization", registry); - registerAsAdvisor("postFilterAuthorization", registry); - registerAsAdvisor("postAuthorizeAuthorization", registry); - registerAsAdvisor("securedAuthorization", registry); - registerAsAdvisor("jsr250Authorization", registry); - } - - private void registerAsAdvisor(String prefix, BeanDefinitionRegistry registry) { - String interceptorName = prefix + "MethodInterceptor"; - if (!registry.containsBeanDefinition(interceptorName)) { - return; - } - BeanDefinition definition = registry.getBeanDefinition(interceptorName); - if (!(definition instanceof RootBeanDefinition)) { - return; - } - RootBeanDefinition advisor = new RootBeanDefinition((RootBeanDefinition) definition); - advisor.setTargetType(Advisor.class); - registry.registerBeanDefinition(prefix + "Advisor", advisor); - } - -} diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecuritySelector.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecuritySelector.java index 9a0d08a902b..f0ee6d46302 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecuritySelector.java +++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecuritySelector.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2023 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -60,8 +60,7 @@ public String[] selectImports(@NonNull AnnotationMetadata importMetadata) { private static final class AutoProxyRegistrarSelector extends AdviceModeImportSelector { - private static final String[] IMPORTS = new String[] { AutoProxyRegistrar.class.getName(), - MethodSecurityAdvisorRegistrar.class.getName() }; + private static final String[] IMPORTS = new String[] { AutoProxyRegistrar.class.getName() }; private static final String[] ASPECTJ_IMPORTS = new String[] { MethodSecurityAspectJAutoProxyRegistrar.class.getName() }; diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java index c3bb88c8f4c..3f1e14723bc 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java @@ -17,8 +17,8 @@ package org.springframework.security.config.annotation.method.configuration; import io.micrometer.observation.ObservationRegistry; -import org.aopalliance.intercept.MethodInterceptor; +import org.springframework.aop.Advisor; import org.springframework.beans.factory.ObjectProvider; import org.springframework.beans.factory.config.BeanDefinition; import org.springframework.context.ApplicationContext; @@ -52,8 +52,7 @@ final class PrePostMethodSecurityConfiguration { @Bean @Role(BeanDefinition.ROLE_INFRASTRUCTURE) - static MethodInterceptor preFilterAuthorizationMethodInterceptor( - ObjectProvider defaultsProvider, + Advisor preFilterAuthorizationMethodInterceptor(ObjectProvider defaultsProvider, ObjectProvider expressionHandlerProvider, ObjectProvider strategyProvider, ApplicationContext context) { PreFilterAuthorizationMethodInterceptor preFilter = new PreFilterAuthorizationMethodInterceptor(); @@ -65,8 +64,7 @@ static MethodInterceptor preFilterAuthorizationMethodInterceptor( @Bean @Role(BeanDefinition.ROLE_INFRASTRUCTURE) - static MethodInterceptor preAuthorizeAuthorizationMethodInterceptor( - ObjectProvider defaultsProvider, + Advisor preAuthorizeAuthorizationMethodInterceptor(ObjectProvider defaultsProvider, ObjectProvider expressionHandlerProvider, ObjectProvider strategyProvider, ObjectProvider eventPublisherProvider, @@ -83,8 +81,7 @@ static MethodInterceptor preAuthorizeAuthorizationMethodInterceptor( @Bean @Role(BeanDefinition.ROLE_INFRASTRUCTURE) - static MethodInterceptor postAuthorizeAuthorizationMethodInterceptor( - ObjectProvider defaultsProvider, + Advisor postAuthorizeAuthorizationMethodInterceptor(ObjectProvider defaultsProvider, ObjectProvider expressionHandlerProvider, ObjectProvider strategyProvider, ObjectProvider eventPublisherProvider, @@ -101,8 +98,7 @@ static MethodInterceptor postAuthorizeAuthorizationMethodInterceptor( @Bean @Role(BeanDefinition.ROLE_INFRASTRUCTURE) - static MethodInterceptor postFilterAuthorizationMethodInterceptor( - ObjectProvider defaultsProvider, + Advisor postFilterAuthorizationMethodInterceptor(ObjectProvider defaultsProvider, ObjectProvider expressionHandlerProvider, ObjectProvider strategyProvider, ApplicationContext context) { PostFilterAuthorizationMethodInterceptor postFilter = new PostFilterAuthorizationMethodInterceptor(); diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/SecuredMethodSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/SecuredMethodSecurityConfiguration.java index 9e60170a640..adf94985a52 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/SecuredMethodSecurityConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/SecuredMethodSecurityConfiguration.java @@ -17,9 +17,9 @@ package org.springframework.security.config.annotation.method.configuration; import io.micrometer.observation.ObservationRegistry; -import org.aopalliance.intercept.MethodInterceptor; import org.aopalliance.intercept.MethodInvocation; +import org.springframework.aop.Advisor; import org.springframework.beans.factory.ObjectProvider; import org.springframework.beans.factory.config.BeanDefinition; import org.springframework.context.annotation.Bean; @@ -46,8 +46,7 @@ final class SecuredMethodSecurityConfiguration { @Bean @Role(BeanDefinition.ROLE_INFRASTRUCTURE) - static MethodInterceptor securedAuthorizationMethodInterceptor( - ObjectProvider strategyProvider, + Advisor securedAuthorizationMethodInterceptor(ObjectProvider strategyProvider, ObjectProvider registryProvider) { SecuredAuthorizationManager secured = new SecuredAuthorizationManager(); SecurityContextHolderStrategy strategy = strategyProvider