Add Test Coverage for Implicit CORS Bean Detection

Verify that <cors> detects a PreFlightRequestHandler bean and uses a
PreFlightRequestFilter when no explicit ref or
configuration-source-ref is given and no mvcHandlerMappingIntrospector
bean is present.

See gh-19542

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>

config/src/test/java/org/springframework/security/config/http/HttpCorsConfigTests.java

@@ -18,6 +18,8 @@ package org.springframework.security.config.http;
 
 import java.util.Arrays;
 
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -36,6 +38,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.PreFlightRequestHandler;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -115,6 +118,19 @@ public class HttpCorsConfigTests {
 		// @formatter:on
 	}
 
+	@Test
+	public void optionsWhenUsingPreFlightRequestHandlerThenHandlesPreFlightRequest() throws Exception {
+		this.spring.configLocations(this.xml("WithPreFlightRequestHandler")).autowire();
+		// @formatter:off
+		this.mvc.perform(get("/").with(this.approved()))
+				.andExpect(header().doesNotExist("X-Pre-Flight"))
+				.andExpect(status().isIAmATeapot());
+		this.mvc.perform(options("/").with(this.preflight()))
+				.andExpect(status().isOk())
+				.andExpect(header().exists("X-Pre-Flight"));
+		// @formatter:on
+	}
+
 	private String xml(String configName) {
 		return CONFIG_LOCATION_PREFIX + "-" + configName + ".xml";
 	}
@@ -167,4 +183,13 @@ public class HttpCorsConfigTests {
 
 	}
 
+	static class MyPreFlightRequestHandler implements PreFlightRequestHandler {
+
+		@Override
+		public void handlePreFlight(HttpServletRequest request, HttpServletResponse response) {
+			response.addHeader("X-Pre-Flight", "Handled");
+		}
+
+	}
+
 }

config/src/test/resources/org/springframework/security/config/http/HttpCorsConfigTests-WithPreFlightRequestHandler.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2004-present the original author or authors.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~       https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<b:beans xmlns:b="http://www.springframework.org/schema/beans"
+		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		xmlns="http://www.springframework.org/schema/security"
+		xsi:schemaLocation="
+			http://www.springframework.org/schema/security
+			https://www.springframework.org/schema/security/spring-security.xsd
+			http://www.springframework.org/schema/beans
+			https://www.springframework.org/schema/beans/spring-beans.xsd">
+
+	<http entry-point-ref="ep">
+		<intercept-url pattern="/**" access="authenticated"/>
+		<cors/>
+	</http>
+
+	<b:bean name="ep" class="org.springframework.security.web.authentication.HttpStatusEntryPoint">
+		<b:constructor-arg value="I_AM_A_TEAPOT"/>
+	</b:bean>
+
+	<b:bean name="preFlightRequestHandler"
+			class="org.springframework.security.config.http.HttpCorsConfigTests.MyPreFlightRequestHandler"/>
+
+	<b:import resource="userservice.xml"/>
+</b:beans>