Use consistent "@" tag order in Javadoc

Ensure that Javadoc "@" tags appear in a consistent and well defined order. Issue gh-8945
2026-08-05 17:57:15 +00:00 · 2020-07-24 15:03:32 -07:00
parent 7f0653fa34
commit 5f64f53c3f
195 changed files with 556 additions and 607 deletions
@@ -267,9 +267,8 @@ public class FilterChainProxy extends GenericFilterBean {
 	/**
 	 * Sets the {@link RequestRejectedHandler} to be used for requests rejected by the
 	 * firewall.
-	 *
-	 * @since 5.2
 	 * @param requestRejectedHandler the {@link RequestRejectedHandler}
+	 * @since 5.2
 	 */
 	public void setRequestRejectedHandler(RequestRejectedHandler requestRejectedHandler) {
 		Assert.notNull(requestRejectedHandler, "requestRejectedHandler may not be null");
@@ -45,8 +45,8 @@ public final class WebAttributes {
 	 * Set as a request attribute to override the default
 	 * {@link WebInvocationPrivilegeEvaluator}
 	 *
-	 * @see WebInvocationPrivilegeEvaluator
 	 * @since 3.1.3
+	 * @see WebInvocationPrivilegeEvaluator
 	 */
 	public static final String WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE = WebAttributes.class.getName()
 			+ ".WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE";
@@ -25,9 +25,9 @@ import org.springframework.expression.EvaluationContext;
 * This API is intentionally kept package scope as it may evolve over time.
 * </p>
 *
+ * @param <I> the invocation to use for post processing
 * @author Rob Winch
 * @since 4.1
- * @param <I> the invocation to use for post processing
 */
 interface EvaluationContextPostProcessor<I> {

@@ -38,10 +38,10 @@ import org.springframework.security.web.AuthenticationEntryPoint;
 * The <code>commence</code> method will always return an
 * <code>HttpServletResponse.SC_FORBIDDEN</code> (403 error).
 *
- * @see org.springframework.security.web.access.ExceptionTranslationFilter
 * @author Luke Taylor
 * @author Ruud Senden
 * @since 2.0
+ * @see org.springframework.security.web.access.ExceptionTranslationFilter
 */
 public class Http403ForbiddenEntryPoint implements AuthenticationEntryPoint {

@@ -55,8 +55,8 @@ public final class CookieClearingLogoutHandler implements LogoutHandler {
 	}

 	/**
-	 * @since 5.2
 	 * @param cookiesToClear - One or more Cookie objects that must have maxAge of 0
+	 * @since 5.2
 	 */
 	public CookieClearingLogoutHandler(Cookie... cookiesToClear) {
 		Assert.notNull(cookiesToClear, "List of cookies cannot be null");
@@ -34,7 +34,7 @@ public final class HeaderWriterLogoutHandler implements LogoutHandler {
 	/**
 	 * Constructs a new instance using the passed {@link HeaderWriter} implementation
 	 * @param headerWriter
-	 * @throws {@link IllegalArgumentException} if headerWriter is null.
+	 * @throws IllegalArgumentException if headerWriter is null.
 	 */
 	public HeaderWriterLogoutHandler(HeaderWriter headerWriter) {
 		Assert.notNull(headerWriter, "headerWriter cannot be null");
@@ -21,10 +21,10 @@ import java.util.Date;
 * The abstraction used by {@link PersistentTokenBasedRememberMeServices} to store the
 * persistent login tokens for a user.
 *
- * @see JdbcTokenRepositoryImpl
- * @see InMemoryTokenRepositoryImpl
 * @author Luke Taylor
 * @since 2.0
+ * @see JdbcTokenRepositoryImpl
+ * @see InMemoryTokenRepositoryImpl
 */
 public interface PersistentTokenRepository {

@@ -61,10 +61,10 @@ import org.springframework.util.Assert;
 * {@link CompositeSessionAuthenticationStrategy}.
 * </p>
 *
- * @see CompositeSessionAuthenticationStrategy
 * @author Luke Taylor
 * @author Rob Winch
 * @since 3.2
+ * @see CompositeSessionAuthenticationStrategy
 */
 public class ConcurrentSessionControlAuthenticationStrategy
 		implements MessageSourceAware, SessionAuthenticationStrategy {
@@ -38,10 +38,10 @@ import org.springframework.util.Assert;
 * timed out sessions) are removed. This is typically done by adding
 * {@link HttpSessionEventPublisher}.
 *
- * @see CompositeSessionAuthenticationStrategy
 * @author Luke Taylor
 * @author Rob Winch
 * @since 3.2
+ * @see CompositeSessionAuthenticationStrategy
 */
 public class RegisterSessionAuthenticationStrategy implements SessionAuthenticationStrategy {

@@ -279,9 +279,8 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo

 	/**
 	 * Wrapper that is applied to every request/response to update the
-	 * <code>HttpSession<code> with
-	 * the <code>SecurityContext</code> when a <code>sendError()</code> or
-	 * <code>sendRedirect</code> happens. See SEC-398.
+	 * <code>HttpSession</code> with the <code>SecurityContext</code> when a
+	 * <code>sendError()</code> or <code>sendRedirect</code> happens. See SEC-398.
 	 * <p>
 	 * Stores the necessary state from the start of the request in order to make a
 	 * decision about whether the security context has changed before saving it.
@@ -40,9 +40,9 @@ public abstract class SecurityWebApplicationContextUtils extends WebApplicationC
 	 * {@code DispatcherServlet} registrations in the web app.
 	 * @param servletContext ServletContext to find the web application context for
 	 * @return the desired WebApplicationContext for this web app
+	 * @throws IllegalStateException if no WebApplicationContext can be found
 	 * @see #getWebApplicationContext(ServletContext)
 	 * @see ServletContext#getAttributeNames()
-	 * @throws IllegalStateException if no WebApplicationContext can be found
 	 */
 	public static WebApplicationContext findRequiredWebApplicationContext(ServletContext servletContext) {
 		WebApplicationContext wac = _findWebApplicationContext(servletContext);
@@ -190,10 +190,9 @@ public final class CookieCsrfTokenRepository implements CsrfTokenRepository {
 	/**
 	 * Sets the domain of the cookie that the expected CSRF token is saved to and read
 	 * from.
-	 *
-	 * @since 5.2
 	 * @param cookieDomain the domain of the cookie that the expected CSRF token is saved
 	 * to and read from
+	 * @since 5.2
 	 */
 	public void setCookieDomain(String cookieDomain) {
 		this.cookieDomain = cookieDomain;
@@ -202,10 +201,9 @@ public final class CookieCsrfTokenRepository implements CsrfTokenRepository {
 	/**
 	 * Sets secure flag of the cookie that the expected CSRF token is saved to and read
 	 * from. By default secure flag depends on {@link ServletRequest#isSecure()}
-	 *
-	 * @since 5.4
 	 * @param secure the secure flag of the cookie that the expected CSRF token is saved
 	 * to and read from
+	 * @since 5.4
 	 */
 	public void setSecure(Boolean secure) {
 		this.secure = secure;
@@ -20,9 +20,9 @@ import java.io.Serializable;
 /**
 * Provides the information about an expected CSRF token.
 *
- * @see DefaultCsrfToken
 * @author Rob Winch
 * @since 3.2
+ * @see DefaultCsrfToken
 *
 */
 public interface CsrfToken extends Serializable {
@@ -24,10 +24,9 @@ import javax.servlet.http.HttpSession;
 * associated to the {@link HttpServletRequest}. For example, it may be stored in
 * {@link HttpSession}.
 *
- * @see HttpSessionCsrfTokenRepository
 * @author Rob Winch
 * @since 3.2
- *
+ * @see HttpSessionCsrfTokenRepository
 */
 public interface CsrfTokenRepository {

@@ -71,10 +71,10 @@ import org.springframework.http.HttpMethod;
 * {@link #setAllowedParameterValues(Predicate)}</li>
 * </ul>
 *
- * @see DefaultHttpFirewall
 * @author Rob Winch
 * @author Eddú Meléndez
 * @since 4.2.4
+ * @see DefaultHttpFirewall
 */
 public class StrictHttpFirewall implements HttpFirewall {

@@ -146,8 +146,8 @@ public class StrictHttpFirewall implements HttpFirewall {
 	 * Verb tampering and XST attacks</a>
 	 * @param unsafeAllowAnyHttpMethod if true, disables HTTP method validation, else
 	 * resets back to the defaults. Default is false.
-	 * @see #setAllowedHttpMethods(Collection)
 	 * @since 5.1
+	 * @see #setAllowedHttpMethods(Collection)
 	 */
 	public void setUnsafeAllowAnyHttpMethod(boolean unsafeAllowAnyHttpMethod) {
 		this.allowedHttpMethods = unsafeAllowAnyHttpMethod ? ALLOW_ANY_HTTP_METHOD : createDefaultAllowedHttpMethods();
@@ -160,8 +160,8 @@ public class StrictHttpFirewall implements HttpFirewall {
 	 * </p>
 	 * @param allowedHttpMethods the case-sensitive collection of HTTP methods that are
 	 * allowed.
-	 * @see #setUnsafeAllowAnyHttpMethod(boolean)
 	 * @since 5.1
+	 * @see #setUnsafeAllowAnyHttpMethod(boolean)
 	 */
 	public void setAllowedHttpMethods(Collection<String> allowedHttpMethods) {
 		if (allowedHttpMethods == null) {
@@ -355,9 +355,9 @@ public class StrictHttpFirewall implements HttpFirewall {
 	 * names that contain ISO control characters and characters that are not defined.
 	 * </p>
 	 * @param allowedHeaderNames the predicate for testing header names
+	 * @since 5.4
 	 * @see Character#isISOControl(int)
 	 * @see Character#isDefined(int)
-	 * @since 5.4
 	 */
 	public void setAllowedHeaderNames(Predicate<String> allowedHeaderNames) {
 		if (allowedHeaderNames == null) {
@@ -372,9 +372,9 @@ public class StrictHttpFirewall implements HttpFirewall {
 	 * values that contain ISO control characters and characters that are not defined.
 	 * </p>
 	 * @param allowedHeaderValues the predicate for testing hostnames
+	 * @since 5.4
 	 * @see Character#isISOControl(int)
 	 * @see Character#isDefined(int)
-	 * @since 5.4
 	 */
 	public void setAllowedHeaderValues(Predicate<String> allowedHeaderValues) {
 		if (allowedHeaderValues == null) {
@@ -21,10 +21,10 @@ import javax.servlet.http.HttpServletResponse;
 /**
 * Contract for writing headers to a {@link HttpServletResponse}
 *
- * @see HeaderWriterFilter
 * @author Marten Deinum
 * @author Rob Winch
 * @since 3.2
+ * @see HeaderWriterFilter
 */
 public interface HeaderWriter {

@@ -61,7 +61,7 @@ public final class ClearSiteDataHeaderWriter implements HeaderWriter {
 	 * request is secure as per the <b>Incomplete Clearing</b> section.
 	 * </p>
 	 * @param directives (i.e. "cache", "cookies", "storage", "executionContexts" or "*")
-	 * @throws {@link IllegalArgumentException} if sources is null or empty.
+	 * @throws IllegalArgumentException if sources is null or empty.
 	 */
 	public ClearSiteDataHeaderWriter(Directive... directives) {
 		Assert.notEmpty(directives, "directives cannot be empty or null");
@@ -35,8 +35,8 @@ import java.io.IOException;
 * registered with {@link CookieMixin} but you can also use it with your own mixin.
 *
 * @author Jitendra Singh
- * @see CookieMixin
 * @since 4.2
+ * @see CookieMixin
 */
 class CookieDeserializer extends JsonDeserializer<Cookie> {

@@ -41,8 +41,8 @@ import com.fasterxml.jackson.databind.node.MissingNode;
 * your own mixin class.
 *
 * @author Jitendra Singh
- * @see PreAuthenticatedAuthenticationTokenMixin
 * @since 4.2
+ * @see PreAuthenticatedAuthenticationTokenMixin
 */
 class PreAuthenticatedAuthenticationTokenDeserializer extends JsonDeserializer<PreAuthenticatedAuthenticationToken> {

@@ -37,8 +37,8 @@ import com.fasterxml.jackson.databind.module.SimpleModule;
 * of all security modules.</b>
 *
 * @author Jitendra Singh
- * @see SecurityJackson2Modules
 * @since 4.2
+ * @see SecurityJackson2Modules
 */
 public class WebJackson2Module extends SimpleModule {

@@ -41,8 +41,8 @@ import com.fasterxml.jackson.databind.module.SimpleModule;
 * of all security modules.</b>
 *
 * @author Boris Finkelshteyn
- * @see SecurityJackson2Modules
 * @since 5.1
+ * @see SecurityJackson2Modules
 */
 public class WebServletJackson2Module extends SimpleModule {

@@ -86,8 +86,8 @@ import java.util.Optional;
 * </pre>
 *
 * @author Artur Otrzonsek
- * @see SwitchUserGrantedAuthority
 * @since 5.4
+ * @see SwitchUserGrantedAuthority
 */
 public class SwitchUserWebFilter implements WebFilter {

@@ -23,9 +23,9 @@ import reactor.core.publisher.Mono;
 * associated to the {@link ServerWebExchange}. For example, it may be stored in
 * {@link org.springframework.web.server.WebSession}.
 *
- * @see WebSessionServerCsrfTokenRepository
 * @author Rob Winch
 * @since 5.0
+ * @see WebSessionServerCsrfTokenRepository
 *
 */
 public interface ServerCsrfTokenRepository {
@@ -34,8 +34,8 @@ import org.springframework.security.web.server.csrf.DefaultCsrfToken;
 * of all security modules.</b>
 *
 * @author Boris Finkelshteyn
- * @see SecurityJackson2Modules
 * @since 5.1
+ * @see SecurityJackson2Modules
 */
 public class WebServerJackson2Module extends SimpleModule {

@@ -140,7 +140,7 @@ final class HttpServlet3RequestFactory implements HttpServletRequestFactory {
 	 * If the value is null (default), the default container behavior will be retained
 	 * when invoking {@link HttpServletRequest#logout()}.
 	 * </p>
-	 * @param logoutHandlers the {@link List<LogoutHandler>}s when invoking
+	 * @param logoutHandlers the {@code List<LogoutHandler>}s when invoking
 	 * {@link HttpServletRequest#logout()}.
 	 */
 	public void setLogoutHandlers(List<LogoutHandler> logoutHandlers) {
@@ -41,11 +41,11 @@ import org.springframework.util.Assert;
 * <li>{@link HttpServletRequestWrapper#getRemoteUser()}.</li>
 * </ul>
 *
- * @see SecurityContextHolderAwareRequestFilter
 * @author Orlando Garcia Carmona
 * @author Ben Alex
 * @author Luke Taylor
 * @author Rob Winch
+ * @see SecurityContextHolderAwareRequestFilter
 */
 public class SecurityContextHolderAwareRequestWrapper extends HttpServletRequestWrapper {

@@ -28,8 +28,8 @@ import javax.servlet.http.HttpServletResponseWrapper;
 * Base class for response wrappers which encapsulate the logic for handling an event when
 * the {@link javax.servlet.http.HttpServletResponse} is committed.
 *
- * @since 4.0.2
 * @author Rob Winch
+ * @since 4.0.2
 */
 public abstract class OnCommittedResponseWrapper extends HttpServletResponseWrapper {

@@ -71,7 +71,7 @@ public class ThrowableAnalyzer {
 	};

 	/**
-	 * Map of registered cause extractors. key: Class<Throwable>; value:
+	 * Map of registered cause extractors. key: Class&lt;Throwable&gt;; value:
 	 * ThrowableCauseExctractor
 	 */
 	private final Map<Class<? extends Throwable>, ThrowableCauseExtractor> extractorMap;
@@ -32,7 +32,7 @@ import static org.mockito.Mockito.verify;
 /**
 * @author Rafiullah Hamedy
 * @author Josh Cummings
- * @see {@link HeaderWriterLogoutHandler}
+ * @see HeaderWriterLogoutHandler
 */
 public class HeaderWriterLogoutHandlerTests {

@@ -386,7 +386,7 @@ public class CsrfFilterTests {
 	private static class CsrfTokenAssert extends AbstractObjectAssert<CsrfTokenAssert, CsrfToken> {

 		/**
-		 * Creates a new </code>{@link ObjectAssert}</code>.
+		 * Creates a new {@link ObjectAssert}.
 		 * @param actual the target to verify.
 		 */
 		protected CsrfTokenAssert(CsrfToken actual) {
@@ -33,7 +33,7 @@ import static org.springframework.security.web.header.writers.ClearSiteDataHeade
 /**
 * @author Rafiullah Hamedy
 * @author Josh Cummings
- * @see {@link ClearSiteDataHeaderWriter}
+ * @see ClearSiteDataHeaderWriter
 */
 public class ClearSiteDataHeaderWriterTests {