IDEA inspection refactorings.

2026-08-04 17:27:13 +00:00 · 2010-08-05 22:47:42 +01:00
parent a3d27a9863
commit 85c4c91e0e
175 changed files with 428 additions and 551 deletions
@@ -208,10 +208,8 @@ public class FilterChainProxy extends GenericFilterBean {
            Object filters = filterChainMap.get(key);
            Assert.isInstanceOf(List.class, filters, "Value must be a filter list");
            // Check the contents
-            Iterator filterIterator = ((List)filters).iterator();

-            while (filterIterator.hasNext()) {
-                Object filter = filterIterator.next();
+            for (Object filter : ((List) filters)) {
                Assert.isInstanceOf(Filter.class, filter, "Objects in filter chain must be of type Filter. ");
            }
        }
@@ -269,8 +267,8 @@ public class FilterChainProxy extends GenericFilterBean {
     * <code>Filter</code> should be called or not.</p>
     */
    private static class VirtualFilterChain implements FilterChain {
-        private FilterInvocation fi;
-        private List<Filter> additionalFilters;
+        private final FilterInvocation fi;
+        private final List<Filter> additionalFilters;
        private int currentPosition = 0;

        private VirtualFilterChain(FilterInvocation filterInvocation, List<Filter> additionalFilters) {
@@ -34,7 +34,7 @@ import java.util.Map;
 public class PortMapperImpl implements PortMapper {
    //~ Instance fields ================================================================================================

-    private Map<Integer, Integer> httpsPortMappings;
+    private final Map<Integer, Integer> httpsPortMappings;

    //~ Constructors ===================================================================================================

@@ -55,11 +55,7 @@ public class PortMapperImpl implements PortMapper {
    }

    public Integer lookupHttpPort(Integer httpsPort) {
-        Iterator<Integer> iter = httpsPortMappings.keySet().iterator();
-
-        while (iter.hasNext()) {
-            Integer httpPort = iter.next();
-
+        for (Integer httpPort : httpsPortMappings.keySet()) {
            if (httpsPortMappings.get(httpPort).equals(httpsPort)) {
                return httpPort;
            }
@@ -41,7 +41,7 @@ public class DefaultWebInvocationPrivilegeEvaluator implements WebInvocationPriv

    //~ Instance fields ================================================================================================

-    private AbstractSecurityInterceptor securityInterceptor;
+    private final AbstractSecurityInterceptor securityInterceptor;

    //~ Constructors ===================================================================================================

@@ -62,11 +62,7 @@ public class ChannelDecisionManagerImpl implements ChannelDecisionManager, Initi
    }

    public void decide(FilterInvocation invocation, Collection<ConfigAttribute> config) throws IOException, ServletException {
-
-        Iterator<ConfigAttribute> attrs = config.iterator();
-
-        while (attrs.hasNext()) {
-            ConfigAttribute attribute = attrs.next();
+        for (ConfigAttribute attribute : config) {
            if (ANY_CHANNEL.equals(attribute.getAttribute())) {
                return;
            }
@@ -82,11 +82,7 @@ public class InsecureChannelProcessor implements InitializingBean, ChannelProces
    }

    public boolean supports(ConfigAttribute attribute) {
-        if ((attribute != null) && (attribute.getAttribute() != null)
-            && attribute.getAttribute().equals(getInsecureKeyword())) {
-            return true;
-        } else {
-            return false;
-        }
+        return (attribute != null) && (attribute.getAttribute() != null)
+                && attribute.getAttribute().equals(getInsecureKeyword());
    }
 }
@@ -80,11 +80,7 @@ public class SecureChannelProcessor implements InitializingBean, ChannelProcesso
    }

    public boolean supports(ConfigAttribute attribute) {
-        if ((attribute != null) && (attribute.getAttribute() != null)
-            && attribute.getAttribute().equals(getSecureKeyword())) {
-            return true;
-        } else {
-            return false;
-        }
+        return (attribute != null) && (attribute.getAttribute() != null)
+                && attribute.getAttribute().equals(getSecureKeyword());
    }
 }
@@ -24,8 +24,8 @@ import org.springframework.security.web.FilterInvocation;
 */
 public class DefaultWebSecurityExpressionHandler implements WebSecurityExpressionHandler, ApplicationContextAware {

-    private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
-    private ExpressionParser expressionParser = new SpelExpressionParser();
+    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
+    private final ExpressionParser expressionParser = new SpelExpressionParser();
    private final SecurityExpressionRootPropertyAccessor sxrpa = new SecurityExpressionRootPropertyAccessor();
    private RoleHierarchy roleHierarchy;
    private ApplicationContext applicationContext;
@@ -95,7 +95,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
        this.securityMetadataSource = newSource;
    }

-    public Class<? extends Object> getSecureObjectClass() {
+    public Class<?> getSecureObjectClass() {
        return FilterInvocation.class;
    }

@@ -5,8 +5,8 @@ package org.springframework.security.web.access.intercept;
 * @since 2.0
 */
 public class RequestKey {
-    private String url;
-    private String method;
+    private final String url;
+    private final String method;

    public RequestKey(String url) {
        this(url, null);
@@ -46,7 +46,7 @@ import org.springframework.util.StringUtils;
 */
 public abstract class AbstractAuthenticationTargetUrlRequestHandler {

-    public static String DEFAULT_TARGET_PARAMETER = "spring-security-redirect";
+    public static final String DEFAULT_TARGET_PARAMETER = "spring-security-redirect";
    protected final Log logger = LogFactory.getLog(this.getClass());
    private String targetUrlParameter = DEFAULT_TARGET_PARAMETER;
    private String defaultTargetUrl = "/";
@@ -56,7 +56,7 @@ import org.springframework.util.Assert;
 */
 public class DelegatingAuthenticationEntryPoint implements AuthenticationEntryPoint, InitializingBean {

-    private LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints;
+    private final LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints;
    private AuthenticationEntryPoint defaultEntryPoint;

    public DelegatingAuthenticationEntryPoint(LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints) {
@@ -25,7 +25,7 @@ import org.springframework.util.Assert;
 * @since 3.0
 */
 public class ExceptionMappingAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
-    private Map<String, String> failureUrlMap = new HashMap<String, String>();
+    private final Map<String, String> failureUrlMap = new HashMap<String, String>();

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
@@ -79,7 +79,7 @@ public class LoginUrlAuthenticationEntryPoint implements AuthenticationEntryPoin

    private boolean useForward = false;

-    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
+    private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    //~ Methods ========================================================================================================

@@ -31,8 +31,8 @@ import javax.servlet.http.HttpSession;
 public class WebAuthenticationDetails implements SessionIdentifierAware, Serializable {
    //~ Instance fields ================================================================================================

-    private String remoteAddress;
-    private String sessionId;
+    private final String remoteAddress;
+    private final String sessionId;

    //~ Constructors ===================================================================================================

@@ -50,8 +50,8 @@ public class LogoutFilter extends GenericFilterBean {
    //~ Instance fields ================================================================================================

    private String filterProcessesUrl = "/j_spring_security_logout";
-    private List<LogoutHandler> handlers;
-    private LogoutSuccessHandler logoutSuccessHandler;
+    private final List<LogoutHandler> handlers;
+    private final LogoutSuccessHandler logoutSuccessHandler;

    //~ Constructors ===================================================================================================

@@ -91,7 +91,7 @@ public abstract class AbstractPreAuthenticatedProcessingFilter extends GenericFi
     * Do the actual authentication for a pre-authenticated user.
     */
    private void doAuthenticate(HttpServletRequest request, HttpServletResponse response) {
-        Authentication authResult = null;
+        Authentication authResult;

        Object principal = getPreAuthenticatedPrincipal(request);
        Object credentials = getPreAuthenticatedCredentials(request);
@@ -91,7 +91,7 @@ public class PreAuthenticatedAuthenticationProvider implements AuthenticationPro
    /**
     * Indicate that this provider only supports PreAuthenticatedAuthenticationToken (sub)classes.
     */
-    public final boolean supports(Class<? extends Object> authentication) {
+    public final boolean supports(Class<?> authentication) {
        return PreAuthenticatedAuthenticationToken.class.isAssignableFrom(authentication);
    }

@@ -42,8 +42,7 @@ public class PreAuthenticatedGrantedAuthoritiesUserDetailsService
        Assert.notNull(token.getDetails());
        Assert.isInstanceOf(GrantedAuthoritiesContainer.class, token.getDetails());
        List<GrantedAuthority> authorities = ((GrantedAuthoritiesContainer) token.getDetails()).getGrantedAuthorities();
-        UserDetails ud = createuserDetails(token, authorities);
-        return ud;
+        return createuserDetails(token, authorities);
    }

    /**
@@ -21,7 +21,7 @@ public class PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails extends
        MutableGrantedAuthoritiesContainer {
    public static final long serialVersionUID = 1L;

-    private MutableGrantedAuthoritiesContainer authoritiesContainer = new GrantedAuthoritiesContainerImpl();
+    private final MutableGrantedAuthoritiesContainer authoritiesContainer = new GrantedAuthoritiesContainerImpl();

    public PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails(HttpServletRequest request) {
        super(request);
@@ -53,9 +53,7 @@ public class RequestHeaderAuthenticationFilter extends AbstractPreAuthenticatedP
     */
    protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
        if (credentialsRequestHeader != null) {
-            String credentials = request.getHeader(credentialsRequestHeader);
-
-            return credentials;
+            return request.getHeader(credentialsRequestHeader);
        }

        return "N/A";
@@ -54,7 +54,7 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
     *            The subject for which to retrieve the security name
     * @return String the security name for the given subject
     */
-    private static final String getSecurityName(final Subject subject) {
+    private static String getSecurityName(final Subject subject) {
        if (logger.isDebugEnabled()) {
            logger.debug("Determining Websphere security name for subject " + subject);
        }
@@ -77,7 +77,7 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
     *
     * @return Subject the current RunAs subject
     */
-    private static final Subject getRunAsSubject() {
+    private static Subject getRunAsSubject() {
        logger.debug("Retrieving WebSphere RunAs subject");
        // get Subject: WSSubject.getCallerSubject ();
        return (Subject) invokeMethod(getRunAsSubjectMethod(), null, new Object[] {});
@@ -90,7 +90,7 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
     *            The subject for which to retrieve the WebSphere group names
     * @return the WebSphere group names for the given subject
     */
-    private static final List<String> getWebSphereGroups(final Subject subject) {
+    private static List<String> getWebSphereGroups(final Subject subject) {
        return getWebSphereGroups(getSecurityName(subject));
    }

@@ -102,7 +102,7 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
     * @return the WebSphere group names for the given security name
     */
    @SuppressWarnings("unchecked")
-    private static final List<String> getWebSphereGroups(final String securityName) {
+    private static List<String> getWebSphereGroups(final String securityName) {
        Context ic = null;
        try {
            // TODO: Cache UserRegistry object
@@ -123,14 +123,16 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
            throw new RuntimeException("Exception occured while looking up groups for user", e);
        } finally {
            try {
-                ic.close();
+                if (ic != null) {
+                    ic.close();
+                }
            } catch (NamingException e) {
                logger.debug("Exception occured while closing context", e);
            }
        }
    }

-    private static final Object invokeMethod(Method method, Object instance, Object[] args)
+    private static Object invokeMethod(Method method, Object instance, Object[] args)
    {
        try {
            return method.invoke(instance,args);
@@ -146,7 +148,7 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
        }
    }

-    private static final Method getMethod(String className, String methodName, String[] parameterTypeNames) {
+    private static Method getMethod(String className, String methodName, String[] parameterTypeNames) {
        try {
            Class<?> c = Class.forName(className);
            final int len = parameterTypeNames.length;
@@ -164,21 +166,21 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
        }
    }

-    private static final Method getRunAsSubjectMethod() {
+    private static Method getRunAsSubjectMethod() {
        if (getRunAsSubject == null) {
            getRunAsSubject = getMethod("com.ibm.websphere.security.auth.WSSubject", "getRunAsSubject", new String[] {});
        }
        return getRunAsSubject;
    }

-    private static final Method getGroupsForUserMethod() {
+    private static Method getGroupsForUserMethod() {
        if (getGroupsForUser == null) {
            getGroupsForUser = getMethod("com.ibm.websphere.security.UserRegistry", "getGroupsForUser", new String[] { "java.lang.String" });
        }
        return getGroupsForUser;
    }

-    private static final Method getSecurityNameMethod() {
+    private static Method getSecurityNameMethod() {
        if (getSecurityName == null) {
            getSecurityName = getMethod("com.ibm.websphere.security.cred.WSCredential", "getSecurityName", new String[] {});
        }
@@ -186,14 +188,14 @@ final class DefaultWASUsernameAndGroupsExtractor implements WASUsernameAndGroups
    }

    // SEC-803
-    private static final Class<?> getWSCredentialClass() {
+    private static Class<?> getWSCredentialClass() {
        if (wsCredentialClass == null) {
            wsCredentialClass = getClass("com.ibm.websphere.security.cred.WSCredential");
        }
        return wsCredentialClass;
    }

-    private static final Class<?> getClass(String className) {
+    private static Class<?> getClass(String className) {
        try {
            return Class.forName(className);
        } catch (ClassNotFoundException e) {
@@ -54,7 +54,7 @@ public class WebSphere2SpringSecurityPropagationInterceptor implements MethodInt
     * using the pre-authenticated authentication provider.
     * @param aContext The context to use for building the authentication details.
     */
-    private final void authenticateSpringSecurityWithWASCredentials(Object aContext) {
+    private void authenticateSpringSecurityWithWASCredentials(Object aContext) {
        Assert.notNull(authenticationManager);
        Assert.notNull(authenticationDetailsSource);

@@ -43,10 +43,10 @@ public abstract class AbstractRememberMeServices implements RememberMeServices,
    //~ Instance fields ================================================================================================
    protected final Log logger = LogFactory.getLog(getClass());

-    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
+    protected final MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

    private UserDetailsService userDetailsService;
-    private UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();
+    private final UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();
    private AuthenticationDetailsSource authenticationDetailsSource = new WebAuthenticationDetailsSource();

    private String cookieName = SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY;
@@ -125,9 +125,9 @@ public abstract class AbstractRememberMeServices implements RememberMeServices,
            return null;
        }

-        for (int i = 0; i < cookies.length; i++) {
-            if (cookieName.equals(cookies[i].getName())) {
-                return cookies[i].getValue();
+        for (Cookie cookie : cookies) {
+            if (cookieName.equals(cookie.getName())) {
+                return cookie.getValue();
            }
        }

@@ -13,7 +13,7 @@ import java.util.Map;
 * @author Luke Taylor
 */
 public class InMemoryTokenRepositoryImpl implements PersistentTokenRepository {
-    private Map<String, PersistentRememberMeToken> seriesTokens = new HashMap<String, PersistentRememberMeToken>();
+    private final Map<String, PersistentRememberMeToken> seriesTokens = new HashMap<String, PersistentRememberMeToken>();

    public synchronized void createNewToken(PersistentRememberMeToken token) {
        PersistentRememberMeToken current = seriesTokens.get(token.getSeries());
@@ -36,16 +36,16 @@ public class InMemoryTokenRepositoryImpl implements PersistentTokenRepository {
    }

    public synchronized PersistentRememberMeToken getTokenForSeries(String seriesId) {
-        return (PersistentRememberMeToken) seriesTokens.get(seriesId);
+        return seriesTokens.get(seriesId);
    }

    public synchronized void removeUserTokens(String username) {
        Iterator<String> series = seriesTokens.keySet().iterator();

        while (series.hasNext()) {
-            Object seriesId = series.next();
+            String seriesId = series.next();

-            PersistentRememberMeToken token = (PersistentRememberMeToken) seriesTokens.get(seriesId);
+            PersistentRememberMeToken token = seriesTokens.get(seriesId);

            if (username.equals(token.getUsername())) {
                series.remove();
@@ -64,12 +64,11 @@ public class JdbcTokenRepositoryImpl extends JdbcDaoSupport implements Persisten
    }

    public void createNewToken(PersistentRememberMeToken token) {
-        insertToken.update(
-                new Object[] {token.getUsername(), token.getSeries(), token.getTokenValue(), token.getDate()});
+        insertToken.update(token.getUsername(), token.getSeries(), token.getTokenValue(), token.getDate());
    }

    public void updateToken(String series, String tokenValue, Date lastUsed) {
-        updateToken.update(new Object[] {tokenValue, new Date(), series});
+        updateToken.update(tokenValue, new Date(), series);
    }

    /**
@@ -83,7 +82,7 @@ public class JdbcTokenRepositoryImpl extends JdbcDaoSupport implements Persisten
     */
    public PersistentRememberMeToken getTokenForSeries(String seriesId) {
        try {
-            return (PersistentRememberMeToken) tokensBySeriesMapping.findObject(seriesId);
+            return tokensBySeriesMapping.findObject(seriesId);
        } catch(IncorrectResultSizeDataAccessException moreThanOne) {
            logger.error("Querying token for series '" + seriesId + "' returned more than one value. Series" +
                    " should be unique");
@@ -118,10 +117,7 @@ public class JdbcTokenRepositoryImpl extends JdbcDaoSupport implements Persisten
        }

        protected PersistentRememberMeToken mapRow(ResultSet rs, int rowNum) throws SQLException {
-            PersistentRememberMeToken token =
-                    new PersistentRememberMeToken(rs.getString(1), rs.getString(2), rs.getString(3), rs.getTimestamp(4));
-
-            return token;
+            return new PersistentRememberMeToken(rs.getString(1), rs.getString(2), rs.getString(3), rs.getTimestamp(4));
        }
    }

@@ -6,10 +6,10 @@ import java.util.Date;
 * @author Luke Taylor
 */
 public class PersistentRememberMeToken {
-    private String username;
-    private String series;
-    private String tokenValue;
-    private Date date;
+    private final String username;
+    private final String series;
+    private final String tokenValue;
+    private final Date date;

    public PersistentRememberMeToken(String username, String series, String tokenValue, Date date) {
        this.username = username;
@@ -112,9 +112,7 @@ public class PersistentTokenBasedRememberMeServices extends AbstractRememberMeSe
            throw new RememberMeAuthenticationException("Autologin failed due to data access problem");
        }

-        UserDetails user = getUserDetailsService().loadUserByUsername(token.getUsername());
-
-        return user;
+        return getUserDetailsService().loadUserByUsername(token.getUsername());
    }

    /**
@@ -131,10 +131,10 @@ public class ConcurrentSessionControlStrategy extends SessionFixationProtectionS
        // Determine least recently used session, and mark it for invalidation
        SessionInformation leastRecentlyUsed = null;

-        for (int i = 0; i < sessions.size(); i++) {
+        for (SessionInformation session : sessions) {
            if ((leastRecentlyUsed == null)
-                    || sessions.get(i).getLastRequest().before(leastRecentlyUsed.getLastRequest())) {
-                leastRecentlyUsed = sessions.get(i);
+                    || session.getLastRequest().before(leastRecentlyUsed.getLastRequest())) {
+                leastRecentlyUsed = session;
            }
        }

@@ -29,7 +29,7 @@ import org.springframework.security.core.userdetails.UserDetails;
 public class AuthenticationSwitchUserEvent extends AbstractAuthenticationEvent {
    //~ Instance fields ================================================================================================

-    private UserDetails targetUser;
+    private final UserDetails targetUser;

    //~ Constructors ===================================================================================================

@@ -191,7 +191,7 @@ public class SwitchUserFilter extends GenericFilterBean implements ApplicationEv
     * @throws CredentialsExpiredException If the target user credentials are expired.
     */
    protected Authentication attemptSwitchUser(HttpServletRequest request) throws AuthenticationException {
-        UsernamePasswordAuthenticationToken targetUserRequest = null;
+        UsernamePasswordAuthenticationToken targetUserRequest;

        String username = request.getParameter(SPRING_SECURITY_SWITCH_USERNAME_KEY);

@@ -31,7 +31,7 @@ public class SwitchUserGrantedAuthority extends GrantedAuthorityImpl {
    //~ Instance fields ================================================================================================

    private static final long serialVersionUID = 1L;
-    private Authentication source;
+    private final Authentication source;

    //~ Constructors ===================================================================================================

@@ -17,9 +17,8 @@ final class DigestAuthUtils {

    static String encodePasswordInA1Format(String username, String realm, String password) {
        String a1 = username + ":" + realm + ":" + password;
-        String a1Md5 = md5Hex(a1);

-        return a1Md5;
+        return md5Hex(a1);
    }

    static String[] splitIgnoringQuotes(String str, char separatorChar) {
@@ -91,7 +90,7 @@ final class DigestAuthUtils {
    static String generateDigest(boolean passwordAlreadyEncoded, String username, String realm, String password,
                                        String httpMethod, String uri, String qop, String nonce, String nc, String cnonce)
            throws IllegalArgumentException {
-        String a1Md5 = null;
+        String a1Md5;
        String a2 = httpMethod + ":" + uri;
        String a2Md5 = md5Hex(a2);

@@ -113,9 +112,7 @@ final class DigestAuthUtils {
            throw new IllegalArgumentException("This method does not support a qop: '" + qop + "'");
        }

-        String digestMd5 = new String(md5Hex(digest));
-
-        return digestMd5;
+        return md5Hex(digest);
    }

    /**
@@ -138,13 +135,13 @@ final class DigestAuthUtils {

        Map<String, String> map = new HashMap<String, String>();

-        for (int i = 0; i < array.length; i++) {
+        for (String s : array) {
            String postRemove;

            if (removeCharacters == null) {
-                postRemove = array[i];
+                postRemove = s;
            } else {
-                postRemove = StringUtils.replace(array[i], removeCharacters, "");
+                postRemove = StringUtils.replace(s, removeCharacters, "");
            }

            String[] splitThisArrayElement = split(postRemove, delimiter);
@@ -82,7 +82,7 @@ public class DigestAuthenticationEntryPoint implements AuthenticationEntryPoint,
        // format of nonce is:
        //   base64(expirationTime + ":" + md5Hex(expirationTime + ":" + key))
        long expiryTime = System.currentTimeMillis() + (nonceValiditySeconds * 1000);
-        String signatureValue = new String(DigestAuthUtils.md5Hex(expiryTime + ":" + key));
+        String signatureValue = DigestAuthUtils.md5Hex(expiryTime + ":" + key);
        String nonceValue = expiryTime + ":" + signatureValue;
        String nonceValueBase64 = new String(Base64.encode(nonceValue.getBytes()));

@@ -291,15 +291,15 @@ public class DigestAuthenticationFilter extends GenericFilterBean implements Mes
    }

    private class DigestData {
-        private String username;
-        private String realm;
-        private String nonce;
-        private String uri;
-        private String response;
-        private String qop;
-        private String nc;
-        private String cnonce;
-        private String section212response;
+        private final String username;
+        private final String realm;
+        private final String nonce;
+        private final String uri;
+        private final String response;
+        private final String qop;
+        private final String nc;
+        private final String cnonce;
+        private final String section212response;
        private long nonceExpiryTime;

        DigestData(String header) {
@@ -57,13 +57,13 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo

    protected final Log logger = LogFactory.getLog(this.getClass());

-    private Class<? extends SecurityContext> securityContextClass = null;
+    private final Class<? extends SecurityContext> securityContextClass = null;
    /** SecurityContext instance used to check for equality with default (unauthenticated) content */
-    private Object contextObject = SecurityContextHolder.createEmptyContext();
+    private final Object contextObject = SecurityContextHolder.createEmptyContext();
    private boolean allowSessionCreation = true;
    private boolean disableUrlRewriting = false;

-    private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
+    private final AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();

    /**
     * Gets the security context for the current request (if available) and returns it.
@@ -227,10 +227,10 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
     */
    final class SaveToSessionResponseWrapper extends SaveContextOnUpdateOrErrorResponseWrapper {

-        private HttpServletRequest request;
-        private boolean httpSessionExistedAtStartOfRequest;
-        private SecurityContext contextBeforeExecution;
-        private Authentication authBeforeExecution;
+        private final HttpServletRequest request;
+        private final boolean httpSessionExistedAtStartOfRequest;
+        private final SecurityContext contextBeforeExecution;
+        private final Authentication authBeforeExecution;

        /**
         * Takes the parameters required to call <code>saveContext()</code> successfully in
@@ -25,7 +25,7 @@ public abstract class SaveContextOnUpdateOrErrorResponseWrapper extends HttpServ

    private boolean contextSaved = false;
    /* See SEC-1052 */
-    private boolean disableUrlRewriting;
+    private final boolean disableUrlRewriting;

    /**
     * @param response              the response to be wrapped
@@ -62,20 +62,20 @@ public class DefaultSavedRequest implements SavedRequest {

    //~ Instance fields ================================================================================================

-    private ArrayList<SavedCookie> cookies = new ArrayList<SavedCookie>();
-    private ArrayList<Locale> locales = new ArrayList<Locale>();
-    private Map<String, List<String>> headers = new TreeMap<String, List<String>>(String.CASE_INSENSITIVE_ORDER);
-    private Map<String, String[]> parameters = new TreeMap<String, String[]>(String.CASE_INSENSITIVE_ORDER);
-    private String contextPath;
-    private String method;
-    private String pathInfo;
-    private String queryString;
-    private String requestURI;
-    private String requestURL;
-    private String scheme;
-    private String serverName;
-    private String servletPath;
-    private int serverPort;
+    private final ArrayList<SavedCookie> cookies = new ArrayList<SavedCookie>();
+    private final ArrayList<Locale> locales = new ArrayList<Locale>();
+    private final Map<String, List<String>> headers = new TreeMap<String, List<String>>(String.CASE_INSENSITIVE_ORDER);
+    private final Map<String, String[]> parameters = new TreeMap<String, String[]>(String.CASE_INSENSITIVE_ORDER);
+    private final String contextPath;
+    private final String method;
+    private final String pathInfo;
+    private final String queryString;
+    private final String requestURI;
+    private final String requestURL;
+    private final String scheme;
+    private final String serverName;
+    private final String servletPath;
+    private final int serverPort;

    //~ Constructors ===================================================================================================

@@ -88,8 +88,8 @@ public class DefaultSavedRequest implements SavedRequest {
        Cookie[] cookies = request.getCookies();

        if (cookies != null) {
-            for (int i = 0; i < cookies.length; i++) {
-                this.addCookie(cookies[i]);
+            for (Cookie cookie : cookies) {
+                this.addCookie(cookie);
            }
        }

@@ -216,11 +216,8 @@ public class DefaultSavedRequest implements SavedRequest {
            return false;
        }

-        if (!propertyEquals("servletPath", this.servletPath, request.getServletPath())) {
-            return false;
-        }
+        return propertyEquals("servletPath", this.servletPath, request.getServletPath());

-        return true;
    }

    public String getContextPath() {
@@ -321,7 +318,7 @@ public class DefaultSavedRequest implements SavedRequest {
            return true;
        }

-        if (((arg1 == null) && (arg2 != null)) || ((arg1 != null) && (arg2 == null))) {
+        if (arg1 == null || arg2 == null) {
            if (logger.isDebugEnabled()) {
                logger.debug(log + ": arg1=" + arg1 + "; arg2=" + arg2 + " (property not equals)");
            }
@@ -79,19 +79,19 @@ public class FastHttpDateFormat {
     *
     * @return Formatted date
     */
-    public static final String formatDate(long value, DateFormat threadLocalformat) {
+    public static String formatDate(long value, DateFormat threadLocalformat) {
        String cachedDate = null;
-        Long longValue = new Long(value);
+        Long longValue = Long.valueOf(value);

        try {
            cachedDate = formatCache.get(longValue);
-        } catch (Exception e) {}
+        } catch (Exception ignored) {}

        if (cachedDate != null) {
            return cachedDate;
        }

-        String newDate = null;
+        String newDate;
        Date dateValue = new Date(value);

        if (threadLocalformat != null) {
@@ -115,7 +115,7 @@ public class FastHttpDateFormat {
     *
     * @return Current date in HTTP format
     */
-    public static final String getCurrentDate() {
+    public static String getCurrentDate() {
        long now = System.currentTimeMillis();

        if ((now - currentDateGenerated) > 1000) {
@@ -144,8 +144,7 @@ public class FastHttpDateFormat {
        for (int i = 0; (date == null) && (i < formats.length); i++) {
            try {
                date = formats[i].parse(value);
-            } catch (ParseException e) {
-                ;
+            } catch (ParseException ignored) {
            }
        }

@@ -165,18 +164,18 @@ public class FastHttpDateFormat {
     *
     * @return Parsed date (or -1 if error occurred)
     */
-    public static final long parseDate(String value, DateFormat[] threadLocalformats) {
+    public static long parseDate(String value, DateFormat[] threadLocalformats) {
        Long cachedDate = null;

        try {
            cachedDate = (Long) parseCache.get(value);
-        } catch (Exception e) {}
+        } catch (Exception ignored) {}

        if (cachedDate != null) {
            return cachedDate.longValue();
        }

-        Long date = null;
+        Long date;

        if (threadLocalformats != null) {
            date = internalParseDate(value, threadLocalformats);
@@ -9,14 +9,14 @@ import java.io.Serializable;
 * @author Ray Krueger
 */
 public class SavedCookie implements Serializable {
-    private java.lang.String name;
-    private java.lang.String value;
-    private java.lang.String comment;
-    private java.lang.String domain;
-    private int maxAge;
-    private java.lang.String path;
-    private boolean secure;
-    private int version;
+    private final java.lang.String name;
+    private final java.lang.String value;
+    private final java.lang.String comment;
+    private final java.lang.String domain;
+    private final int maxAge;
+    private final java.lang.String path;
+    private final boolean secure;
+    private final int version;

    public SavedCookie(String name, String value, String comment, String domain, int maxAge, String path, boolean secure, int version) {
        this.name = name;
@@ -66,7 +66,7 @@ class SavedRequestAwareWrapper extends HttpServletRequestWrapper {
     * The set of SimpleDateFormat formats to use in getDateHeader(). Notice that because SimpleDateFormat is
     * not thread-safe, we can't declare formats[] as a static variable.
     */
-    protected SimpleDateFormat[] formats = new SimpleDateFormat[3];
+    protected final SimpleDateFormat[] formats = new SimpleDateFormat[3];

    //~ Constructors ===================================================================================================

@@ -238,9 +238,9 @@ class SavedRequestAwareWrapper extends HttpServletRequestWrapper {
        List<String> combinedParams = new ArrayList<String>(wrappedParamsList);

        // We want to add all parameters of the saved request *apart from* duplicates of those already added
-        for (int i = 0; i < savedRequestParams.length; i++) {
-            if (!wrappedParamsList.contains(savedRequestParams[i])) {
-                combinedParams.add(savedRequestParams[i]);
+        for (String savedRequestParam : savedRequestParams) {
+            if (!wrappedParamsList.contains(savedRequestParam)) {
+                combinedParams.add(savedRequestParam);
            }
        }

@@ -45,13 +45,13 @@ import org.springframework.security.core.userdetails.UserDetails;
 public class SecurityContextHolderAwareRequestWrapper extends HttpServletRequestWrapper {
    //~ Instance fields ================================================================================================

-    private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
+    private final AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();

    /**
     * The prefix passed by the filter. It will be prepended to any supplied role values before
     * comparing it with the roles obtained from the security context.
     */
-    private String rolePrefix;
+    private final String rolePrefix;

    //~ Constructors ===================================================================================================

@@ -116,8 +116,8 @@ public class ConcurrentSessionFilter extends GenericFilterBean {
    private void doLogout(HttpServletRequest request, HttpServletResponse response) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();

-        for (int i = 0; i < handlers.length; i++) {
-            handlers[i].logout(request, response, auth);
+        for (LogoutHandler handler : handlers) {
+            handler.logout(request, response, auth);
        }
    }

@@ -42,7 +42,7 @@ public class SessionManagementFilter extends GenericFilterBean {

    private final SecurityContextRepository securityContextRepository;
    private SessionAuthenticationStrategy sessionStrategy = new SessionFixationProtectionStrategy();
-    private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
+    private final AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
    private String invalidSessionUrl;
    private AuthenticationFailureHandler failureHandler = new SimpleUrlAuthenticationFailureHandler();
    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
@@ -39,7 +39,7 @@ import org.springframework.security.web.authentication.DelegatingAuthenticationE
 */
 public class ELRequestMatcher implements RequestMatcher {

-    private Expression expression;
+    private final Expression expression;

    public ELRequestMatcher(String el) {
        SpelExpressionParser parser = new SpelExpressionParser();
@@ -22,7 +22,7 @@ import org.springframework.util.StringUtils;

 class ELRequestMatcherContext {

-    private HttpServletRequest request;
+    private final HttpServletRequest request;

    public ELRequestMatcherContext(HttpServletRequest request) {
        this.request = request;
@@ -34,7 +34,7 @@ class ELRequestMatcherContext {

    public boolean hasHeader(String headerName, String value) {
        String header = request.getHeader(headerName);
-        if (StringUtils.hasText(header) == false) {
+        if (!StringUtils.hasText(header)) {
            return false;
        }

@@ -9,7 +9,7 @@ package org.springframework.security.web.util;
 */
 public abstract class TextEscapeUtils {

-    public final static String escapeEntities(String s) {
+    public static String escapeEntities(String s) {
        if (s == null || s.length() == 0) {
            return s;
        }
@@ -198,9 +198,7 @@ public class ThrowableAnalyzer {
     */
    public final Throwable getFirstThrowableOfType(Class<? extends Throwable> throwableType, Throwable[] chain) {
        if (chain != null) {
-            for (int i = 0; i < chain.length; ++i) {
-                Throwable t = chain[i];
-
+            for (Throwable t : chain) {
                if ((t != null) && throwableType.isInstance(t)) {
                    return t;
                }
@@ -223,7 +221,7 @@ public class ThrowableAnalyzer {
     * @throws IllegalArgumentException if <code>throwable</code> is either <code>null</code>
     * or its type is not assignable to <code>expectedBaseType</code>
     */
-    public static final void verifyThrowableHierarchy(Throwable throwable, Class<? extends Throwable> expectedBaseType) {
+    public static void verifyThrowableHierarchy(Throwable throwable, Class<? extends Throwable> expectedBaseType) {
        if (expectedBaseType == null) {
            return;
        }