From 823f93fe3baa1d7028099740d7f473788ea80623 Mon Sep 17 00:00:00 2001
From: Ben Alex <ben.alex@springsource.com>
Date: Sat, 28 Jan 2006 21:33:35 +0000
Subject: [PATCH] SEC-163: Fix ClassCastException bug in MethodInvocationUtils,
 and add test to prove correct functionality.

---
 .../util/MethodInvocationUtils.java           |  2 +-
 ...thodInvocationPrivilegeEvaluatorTests.java | 63 +++++++++++++++----
 2 files changed, 53 insertions(+), 12 deletions(-)

diff --git a/core/src/main/java/org/acegisecurity/util/MethodInvocationUtils.java b/core/src/main/java/org/acegisecurity/util/MethodInvocationUtils.java
index d8848227c5..96fcf67474 100644
--- a/core/src/main/java/org/acegisecurity/util/MethodInvocationUtils.java
+++ b/core/src/main/java/org/acegisecurity/util/MethodInvocationUtils.java
@@ -81,7 +81,7 @@ public class MethodInvocationUtils {
                 list.add(args[i].getClass());
             }
 
-            classArgs = (Class[]) list.toArray();
+            classArgs = (Class[]) list.toArray(new Class[] {});
         }
 
         return createFromClass(object.getClass(), methodName, classArgs);
diff --git a/core/src/test/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluatorTests.java b/core/src/test/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluatorTests.java
index bc06e7bfa7..3eb8f22c09 100644
--- a/core/src/test/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluatorTests.java
+++ b/core/src/test/java/org/acegisecurity/intercept/method/MethodInvocationPrivilegeEvaluatorTests.java
@@ -1,4 +1,4 @@
-/* Copyright 2004, 2005 Acegi Technology Pty Limited
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -53,11 +53,43 @@ public class MethodInvocationPrivilegeEvaluatorTests extends TestCase {
 
     //~ Methods ================================================================
 
+    private Object lookupTargetObject() {
+        ApplicationContext context = new ClassPathXmlApplicationContext(
+                "org/acegisecurity/intercept/method/aopalliance/applicationContext.xml");
+
+        return context.getBean("target");
+    }
+
     public static void main(String[] args) {
         junit.textui.TestRunner.run(MethodInvocationPrivilegeEvaluatorTests.class);
     }
 
-    public void testAllowsAccess() throws Exception {
+    private MethodSecurityInterceptor makeSecurityInterceptor() {
+        ApplicationContext context = new ClassPathXmlApplicationContext(
+                "org/acegisecurity/intercept/method/aopalliance/applicationContext.xml");
+
+        return (MethodSecurityInterceptor) context.getBean(
+            "securityInterceptor");
+    }
+
+    public void testAllowsAccessUsingCreate() throws Exception {
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
+                "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_LOWER")});
+        Object object = lookupTargetObject();
+        MethodInvocation mi = MethodInvocationUtils.create(object,
+                "makeLowerCase", new Object[] {"foobar"});
+        MethodSecurityInterceptor interceptor = makeSecurityInterceptor();
+
+        MethodInvocationPrivilegeEvaluator mipe = new MethodInvocationPrivilegeEvaluator();
+        mipe.setSecurityInterceptor(interceptor);
+        mipe.afterPropertiesSet();
+
+        assertTrue(mipe.isAllowed(mi, token));
+    }
+
+    public void testAllowsAccessUsingCreateFromClass()
+        throws Exception {
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
                 "Password",
                 new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_LOWER")});
@@ -72,7 +104,24 @@ public class MethodInvocationPrivilegeEvaluatorTests extends TestCase {
         assertTrue(mipe.isAllowed(mi, token));
     }
 
-    public void testDeclinesAccess() throws Exception {
+    public void testDeclinesAccessUsingCreate() throws Exception {
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
+                "Password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_NOT_HELD")});
+        Object object = lookupTargetObject();
+        MethodInvocation mi = MethodInvocationUtils.create(object,
+                "makeLowerCase", new Object[] {"foobar"});
+        MethodSecurityInterceptor interceptor = makeSecurityInterceptor();
+
+        MethodInvocationPrivilegeEvaluator mipe = new MethodInvocationPrivilegeEvaluator();
+        mipe.setSecurityInterceptor(interceptor);
+        mipe.afterPropertiesSet();
+
+        assertFalse(mipe.isAllowed(mi, token));
+    }
+
+    public void testDeclinesAccessUsingCreateFromClass()
+        throws Exception {
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
                 "Password",
                 new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_NOT_HELD")});
@@ -86,12 +135,4 @@ public class MethodInvocationPrivilegeEvaluatorTests extends TestCase {
 
         assertFalse(mipe.isAllowed(mi, token));
     }
-
-    private MethodSecurityInterceptor makeSecurityInterceptor() {
-        ApplicationContext context = new ClassPathXmlApplicationContext(
-                "org/acegisecurity/intercept/method/aopalliance/applicationContext.xml");
-
-        return (MethodSecurityInterceptor) context.getBean(
-            "securityInterceptor");
-    }
 }