SEC-2329: Allow injecting of AuthenticationTrustResolver

core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java

@@ -20,6 +20,7 @@ import org.springframework.security.access.expression.ExpressionUtils;
 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
 import org.springframework.security.core.Authentication;
+import org.springframework.util.Assert;
 
 /**
  * The standard implementation of {@code MethodSecurityExpressionHandler}.
@@ -33,7 +34,7 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr
 
     protected final Log logger = LogFactory.getLog(getClass());
 
-    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
+    private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
     private ParameterNameDiscoverer parameterNameDiscoverer = new LocalVariableTableParameterNameDiscoverer();
     private PermissionCacheOptimizer permissionCacheOptimizer = null;
 
@@ -143,6 +144,19 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr
         throw new IllegalArgumentException("Filter target must be a collection or array type, but was " + filterTarget);
     }
 
+    /**
+     * Sets the {@link AuthenticationTrustResolver} to be used. The default is
+     * {@link AuthenticationTrustResolverImpl}.
+     *
+     * @param trustResolver
+     *            the {@link AuthenticationTrustResolver} to use. Cannot be
+     *            null.
+     */
+    public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
+        Assert.notNull(trustResolver, "trustResolver cannot be null");
+        this.trustResolver = trustResolver;
+    }
+
     public void setParameterNameDiscoverer(ParameterNameDiscoverer parameterNameDiscoverer) {
         this.parameterNameDiscoverer = parameterNameDiscoverer;
     }

core/src/test/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandlerTests.java

@@ -0,0 +1,54 @@
+package org.springframework.security.access.expression.method;
+
+import static org.mockito.Mockito.verify;
+
+import org.aopalliance.intercept.MethodInvocation;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+@RunWith(MockitoJUnitRunner.class)
+public class DefaultMethodSecurityExpressionHandlerTests {
+    private DefaultMethodSecurityExpressionHandler handler;
+
+    @Mock
+    private Authentication authentication;
+    @Mock
+    private MethodInvocation methodInvocation;
+    @Mock
+    private AuthenticationTrustResolver trustResolver;
+
+    @Before
+    public void setup() {
+        handler = new DefaultMethodSecurityExpressionHandler();
+    }
+
+    @After
+    public void cleanup() {
+        SecurityContextHolder.clearContext();
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void setTrustResolverNull() {
+        handler.setTrustResolver(null);
+    }
+
+    @Test
+    public void createEvaluationContextCustomTrustResolver() {
+        handler.setTrustResolver(trustResolver);
+
+        Expression expression = handler.getExpressionParser().parseExpression("anonymous");
+        EvaluationContext context = handler.createEvaluationContext(authentication, methodInvocation);
+        expression.getValue(context, Boolean.class);
+
+        verify(trustResolver).isAnonymous(authentication);
+    }
+}