Hide utility class constructors

Update all utility classes so that they have a private constructor. This
prevents users from accidentally creating an instance, when they should
just use the static methods directly.

Issue gh-8945

core/src/main/java/org/springframework/security/access/expression/ExpressionUtils.java

@@ -22,6 +22,9 @@ import org.springframework.expression.Expression;
 
 public final class ExpressionUtils {
 
+	private ExpressionUtils() {
+	}
+
 	public static boolean evaluateAsBoolean(Expression expr, EvaluationContext ctx) {
 		try {
 			return expr.getValue(ctx, Boolean.class);

core/src/main/java/org/springframework/security/converter/RsaKeyConverters.java

@@ -38,7 +38,7 @@ import org.springframework.util.Assert;
  * @author Josh Cummings
  * @since 5.2
  */
-public class RsaKeyConverters {
+public final class RsaKeyConverters {
 
 	private static final String DASHES = "-----";
 
@@ -50,6 +50,9 @@ public class RsaKeyConverters {
 
 	private static final String X509_PEM_FOOTER = DASHES + "END PUBLIC KEY" + DASHES;
 
+	private RsaKeyConverters() {
+	}
+
 	/**
 	 * Construct a {@link Converter} for converting a PEM-encoded PKCS#8 RSA Private Key
 	 * into a {@link RSAPrivateKey}.

core/src/main/java/org/springframework/security/core/SpringSecurityCoreVersion.java

@@ -30,7 +30,7 @@ import org.springframework.core.SpringVersion;
  * @author Luke Taylor
  * @author Rob Winch
  */
-public class SpringSecurityCoreVersion {
+public final class SpringSecurityCoreVersion {
 
 	private static final String DISABLE_CHECKS = SpringSecurityCoreVersion.class.getName().concat(".DISABLE_CHECKS");
 
@@ -50,6 +50,9 @@ public class SpringSecurityCoreVersion {
 		performVersionChecks();
 	}
 
+	private SpringSecurityCoreVersion() {
+	}
+
 	public static String getVersion() {
 		Package pkg = SpringSecurityCoreVersion.class.getPackage();
 		return (pkg != null ? pkg.getImplementationVersion() : null);

core/src/main/java/org/springframework/security/core/context/ReactiveSecurityContextHolder.java

@@ -29,10 +29,13 @@ import org.springframework.security.core.Authentication;
  * @author Rob Winch
  * @since 5.0
  */
-public class ReactiveSecurityContextHolder {
+public final class ReactiveSecurityContextHolder {
 
 	private static final Class<?> SECURITY_CONTEXT_KEY = SecurityContext.class;
 
+	private ReactiveSecurityContextHolder() {
+	}
+
 	/**
 	 * Gets the {@code Mono<SecurityContext>} from Reactor {@link Context}
 	 * @return the {@code Mono<SecurityContext>}

core/src/main/java/org/springframework/security/util/FieldUtils.java

@@ -29,6 +29,9 @@ import org.springframework.util.StringUtils;
  */
 public final class FieldUtils {
 
+	private FieldUtils() {
+	}
+
 	/**
 	 * Attempts to locate the specified field on the class.
 	 * @param clazz the class definition containing the field

core/src/main/java/org/springframework/security/util/MethodInvocationUtils.java

@@ -35,6 +35,9 @@ import org.springframework.util.Assert;
  */
 public final class MethodInvocationUtils {
 
+	private MethodInvocationUtils() {
+	}
+
 	/**
 	 * Generates a <code>MethodInvocation</code> for specified <code>methodName</code> on
 	 * the passed object, using the <code>args</code> to locate the method.

core/src/test/java/org/springframework/security/access/annotation/sec2150/MethodInvocationFactory.java

@@ -19,7 +19,10 @@ package org.springframework.security.access.annotation.sec2150;
 import org.springframework.aop.framework.ProxyFactory;
 import org.springframework.security.access.intercept.method.MockMethodInvocation;
 
-public class MethodInvocationFactory {
+public final class MethodInvocationFactory {
+
+	private MethodInvocationFactory() {
+	}
 
 	/**
 	 * In order to reproduce the bug for SEC-2150, we must have a proxy object that

core/src/test/java/org/springframework/security/access/expression/method/SecurityRules.java

@@ -16,7 +16,10 @@
 
 package org.springframework.security.access.expression.method;
 
-public class SecurityRules {
+public final class SecurityRules {
+
+	private SecurityRules() {
+	}
 
 	public static boolean disallow() {
 		return false;

core/src/test/java/org/springframework/security/util/FieldUtilsTests.java

@@ -27,8 +27,6 @@ public class FieldUtilsTests {
 
 	@Test
 	public void gettingAndSettingProtectedFieldIsSuccessful() throws Exception {
-		new FieldUtils();
-
 		Object tc = new TestClass();
 
 		assertThat(FieldUtils.getProtectedFieldValue("protectedField", tc)).isEqualTo("x");

core/src/test/java/org/springframework/security/util/MethodInvocationUtilsTests.java

@@ -33,8 +33,6 @@ public class MethodInvocationUtilsTests {
 
 	@Test
 	public void createFromClassReturnsMethodWithNoArgInfoForMethodWithNoArgs() {
-		new MethodInvocationUtils();
-
 		MethodInvocation mi = MethodInvocationUtils.createFromClass(String.class, "length");
 		assertThat(mi).isNotNull();
 	}