From 17c58ef088df538797cff15a8dc7a9f2c1a49bcf Mon Sep 17 00:00:00 2001 From: Kim Tae Eun Date: Sun, 24 May 2026 18:57:52 +0900 Subject: [PATCH] Remove BeanResolver Null Checks StandardEvaluationContext.setBeanResolver now accepts a nullable BeanResolver, so the workarounds added for the original limitation are no longer needed. This removes the explicit null guards (and equivalent Optional.ofNullable idiom) as well as the @SuppressWarnings("NullAway") annotations introduced to silence the false positives. In addition to the seven sites that explicitly referenced spring-projects/spring-framework#35371, two sites in spring-security-core followed the same workaround pattern without the comment marker (AbstractSecurityExpressionHandler and DefaultMethodSecurityExpressionHandler) and have also been simplified. Closes gh-17816 Signed-off-by: Kim Tae Eun --- .../expression/AbstractSecurityExpressionHandler.java | 4 +--- .../method/DefaultMethodSecurityExpressionHandler.java | 3 +-- .../DefaultMessageSecurityExpressionHandler.java | 7 +------ .../reactive/CurrentSecurityContextArgumentResolver.java | 5 +---- .../expression/DefaultHttpSecurityExpressionHandler.java | 1 - .../AuthenticationPrincipalArgumentResolver.java | 5 +---- .../annotation/CurrentSecurityContextArgumentResolver.java | 5 +---- .../AuthenticationPrincipalArgumentResolver.java | 1 - .../annotation/CurrentSecurityContextArgumentResolver.java | 1 - 9 files changed, 6 insertions(+), 26 deletions(-) diff --git a/core/src/main/java/org/springframework/security/access/expression/AbstractSecurityExpressionHandler.java b/core/src/main/java/org/springframework/security/access/expression/AbstractSecurityExpressionHandler.java index 79ef23a117..eaae28f93a 100644 --- a/core/src/main/java/org/springframework/security/access/expression/AbstractSecurityExpressionHandler.java +++ b/core/src/main/java/org/springframework/security/access/expression/AbstractSecurityExpressionHandler.java @@ -78,9 +78,7 @@ public abstract class AbstractSecurityExpressionHandler public final EvaluationContext createEvaluationContext(@Nullable Authentication authentication, T invocation) { SecurityExpressionOperations root = createSecurityExpressionRoot(authentication, invocation); StandardEvaluationContext ctx = createEvaluationContextInternal(authentication, invocation); - if (this.beanResolver != null) { - ctx.setBeanResolver(this.beanResolver); - } + ctx.setBeanResolver(this.beanResolver); ctx.setRootObject(root); return ctx; } diff --git a/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java b/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java index 840dc090db..256cdad189 100644 --- a/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java +++ b/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java @@ -23,7 +23,6 @@ import java.util.Collection; import java.util.LinkedHashMap; import java.util.List; import java.util.Map; -import java.util.Optional; import java.util.function.Supplier; import java.util.stream.Stream; @@ -95,7 +94,7 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr MethodSecurityExpressionOperations root = createSecurityExpressionRoot(authentication, mi); MethodSecurityEvaluationContext ctx = new MethodSecurityEvaluationContext(root, mi, getParameterNameDiscoverer()); - Optional.ofNullable(getBeanResolver()).ifPresent(ctx::setBeanResolver); + ctx.setBeanResolver(getBeanResolver()); return ctx; } diff --git a/messaging/src/main/java/org/springframework/security/messaging/access/expression/DefaultMessageSecurityExpressionHandler.java b/messaging/src/main/java/org/springframework/security/messaging/access/expression/DefaultMessageSecurityExpressionHandler.java index 00d0e0f107..d63d7975e7 100644 --- a/messaging/src/main/java/org/springframework/security/messaging/access/expression/DefaultMessageSecurityExpressionHandler.java +++ b/messaging/src/main/java/org/springframework/security/messaging/access/expression/DefaultMessageSecurityExpressionHandler.java @@ -20,7 +20,6 @@ import java.util.function.Supplier; import org.jspecify.annotations.Nullable; -import org.springframework.expression.BeanResolver; import org.springframework.expression.EvaluationContext; import org.springframework.expression.spel.support.StandardEvaluationContext; import org.springframework.messaging.Message; @@ -47,11 +46,7 @@ public class DefaultMessageSecurityExpressionHandler extends AbstractSecurity Message message) { MessageSecurityExpressionRoot root = createSecurityExpressionRoot(authentication, message); StandardEvaluationContext ctx = new StandardEvaluationContext(root); - BeanResolver beanResolver = getBeanResolver(); - if (beanResolver != null) { - // https://github.com/spring-projects/spring-framework/issues/35371 - ctx.setBeanResolver(beanResolver); - } + ctx.setBeanResolver(getBeanResolver()); return ctx; } diff --git a/messaging/src/main/java/org/springframework/security/messaging/handler/invocation/reactive/CurrentSecurityContextArgumentResolver.java b/messaging/src/main/java/org/springframework/security/messaging/handler/invocation/reactive/CurrentSecurityContextArgumentResolver.java index 08044827ea..be64352f47 100644 --- a/messaging/src/main/java/org/springframework/security/messaging/handler/invocation/reactive/CurrentSecurityContextArgumentResolver.java +++ b/messaging/src/main/java/org/springframework/security/messaging/handler/invocation/reactive/CurrentSecurityContextArgumentResolver.java @@ -175,10 +175,7 @@ public class CurrentSecurityContextArgumentResolver implements HandlerMethodArgu StandardEvaluationContext context = new StandardEvaluationContext(); context.setRootObject(securityContext); context.setVariable("this", securityContext); - if (this.beanResolver != null) { - // https://github.com/spring-projects/spring-framework/issues/35371 - context.setBeanResolver(this.beanResolver); - } + context.setBeanResolver(this.beanResolver); Expression expression = this.parser.parseExpression(expressionToParse); securityContext = expression.getValue(context); } diff --git a/web/src/main/java/org/springframework/security/web/access/expression/DefaultHttpSecurityExpressionHandler.java b/web/src/main/java/org/springframework/security/web/access/expression/DefaultHttpSecurityExpressionHandler.java index 43cfa94931..0493693edc 100644 --- a/web/src/main/java/org/springframework/security/web/access/expression/DefaultHttpSecurityExpressionHandler.java +++ b/web/src/main/java/org/springframework/security/web/access/expression/DefaultHttpSecurityExpressionHandler.java @@ -48,7 +48,6 @@ public class DefaultHttpSecurityExpressionHandler extends AbstractSecurityExpres private String defaultRolePrefix = DEFAULT_ROLE_PREFIX; @Override - @SuppressWarnings("NullAway") // https://github.com/spring-projects/spring-framework/issues/35371 public EvaluationContext createEvaluationContext(Supplier authentication, RequestAuthorizationContext context) { WebSecurityExpressionRoot root = createSecurityExpressionRoot(authentication, context); diff --git a/web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java b/web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java index bdc8b8859e..2b4d9ec42e 100644 --- a/web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java +++ b/web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java @@ -126,10 +126,7 @@ public final class AuthenticationPrincipalArgumentResolver implements HandlerMet StandardEvaluationContext context = new StandardEvaluationContext(); context.setRootObject(principal); context.setVariable("this", principal); - // https://github.com/spring-projects/spring-framework/issues/35371 - if (this.beanResolver != null) { - context.setBeanResolver(this.beanResolver); - } + context.setBeanResolver(this.beanResolver); Expression expression = this.parser.parseExpression(expressionToParse); principal = expression.getValue(context); } diff --git a/web/src/main/java/org/springframework/security/web/method/annotation/CurrentSecurityContextArgumentResolver.java b/web/src/main/java/org/springframework/security/web/method/annotation/CurrentSecurityContextArgumentResolver.java index 23b89bd09b..bc915ffcef 100644 --- a/web/src/main/java/org/springframework/security/web/method/annotation/CurrentSecurityContextArgumentResolver.java +++ b/web/src/main/java/org/springframework/security/web/method/annotation/CurrentSecurityContextArgumentResolver.java @@ -160,10 +160,7 @@ public final class CurrentSecurityContextArgumentResolver implements HandlerMeth StandardEvaluationContext context = new StandardEvaluationContext(); context.setRootObject(securityContext); context.setVariable("this", securityContext); - // https://github.com/spring-projects/spring-framework/issues/35371 - if (this.beanResolver != null) { - context.setBeanResolver(this.beanResolver); - } + context.setBeanResolver(this.beanResolver); Expression expression = this.parser.parseExpression(expressionToParse); securityContextResult = expression.getValue(context); } diff --git a/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/AuthenticationPrincipalArgumentResolver.java b/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/AuthenticationPrincipalArgumentResolver.java index 1ef38b32ea..f004c7cf68 100644 --- a/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/AuthenticationPrincipalArgumentResolver.java +++ b/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/AuthenticationPrincipalArgumentResolver.java @@ -95,7 +95,6 @@ public class AuthenticationPrincipalArgumentResolver extends HandlerMethodArgume }); } - @SuppressWarnings("NullAway") // https://github.com/spring-projects/spring-framework/issues/35371 private @Nullable Object resolvePrincipal(MethodParameter parameter, @Nullable Object principal) { AuthenticationPrincipal annotation = findMethodAnnotation(parameter); if (annotation == null) { diff --git a/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/CurrentSecurityContextArgumentResolver.java b/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/CurrentSecurityContextArgumentResolver.java index c085b57932..f3b2950f03 100644 --- a/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/CurrentSecurityContextArgumentResolver.java +++ b/web/src/main/java/org/springframework/security/web/reactive/result/method/annotation/CurrentSecurityContextArgumentResolver.java @@ -141,7 +141,6 @@ public class CurrentSecurityContextArgumentResolver extends HandlerMethodArgumen return securityContext; } - @SuppressWarnings("NullAway") // https://github.com/spring-projects/spring-framework/issues/35371 private @Nullable Object resolveSecurityContextFromAnnotation(CurrentSecurityContext annotation, MethodParameter parameter, Object securityContext) { Object securityContextResult = securityContext;