From 5b923c78eabb1210fa53bb24384cab6a434d5d48 Mon Sep 17 00:00:00 2001 From: dae won Date: Sun, 7 Jun 2026 04:28:59 +0900 Subject: [PATCH] Validate Parameter in setPostAuthenticationChecks The null check in setPostAuthenticationChecks of AbstractUserDetailsReactiveAuthenticationManager asserted the current field value, which is initialized to a default and can never be null, instead of the method parameter. As a result, null was silently accepted and the next authenticate call failed with a raw NullPointerException instead of failing fast with a clear message. Closes gh-19276 Signed-off-by: dae won --- .../AbstractUserDetailsReactiveAuthenticationManager.java | 2 +- ...DetailsRepositoryReactiveAuthenticationManagerTests.java | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/springframework/security/authentication/AbstractUserDetailsReactiveAuthenticationManager.java b/core/src/main/java/org/springframework/security/authentication/AbstractUserDetailsReactiveAuthenticationManager.java index 13712c7a68..f7a392c4e5 100644 --- a/core/src/main/java/org/springframework/security/authentication/AbstractUserDetailsReactiveAuthenticationManager.java +++ b/core/src/main/java/org/springframework/security/authentication/AbstractUserDetailsReactiveAuthenticationManager.java @@ -184,7 +184,7 @@ public abstract class AbstractUserDetailsReactiveAuthenticationManager * @since 5.2 */ public void setPostAuthenticationChecks(UserDetailsChecker postAuthenticationChecks) { - Assert.notNull(this.postAuthenticationChecks, "postAuthenticationChecks cannot be null"); + Assert.notNull(postAuthenticationChecks, "postAuthenticationChecks cannot be null"); this.postAuthenticationChecks = postAuthenticationChecks; } diff --git a/core/src/test/java/org/springframework/security/authentication/UserDetailsRepositoryReactiveAuthenticationManagerTests.java b/core/src/test/java/org/springframework/security/authentication/UserDetailsRepositoryReactiveAuthenticationManagerTests.java index e77f145479..0f9b62e71a 100644 --- a/core/src/test/java/org/springframework/security/authentication/UserDetailsRepositoryReactiveAuthenticationManagerTests.java +++ b/core/src/test/java/org/springframework/security/authentication/UserDetailsRepositoryReactiveAuthenticationManagerTests.java @@ -90,6 +90,12 @@ public class UserDetailsRepositoryReactiveAuthenticationManagerTests { assertThatExceptionOfType(IllegalArgumentException.class).isThrownBy(() -> this.manager.setScheduler(null)); } + @Test + public void setPostAuthenticationChecksWhenNullThenIllegalArgumentException() { + assertThatExceptionOfType(IllegalArgumentException.class) + .isThrownBy(() -> this.manager.setPostAuthenticationChecks(null)); + } + @Test public void authenticateWhenCustomSchedulerThenUsed() { given(this.scheduler.schedule(any())).willAnswer((a) -> {