SEC-2136: Lazy load MethodSecurityExpressionHandler & MethodSecurityExpressionHandler.expressionParser

Previously wiring dependencies created with a FactoryBean into
MethodSecurityExpressionHandler &
MethodSecurityExpressionHandler.expressionParser and  would cause
NoSuchBeanDefinitionException's to occur. These changes make it easier
(but not impossible) to avoid such errors.

The following changes were made:

    - ExpressionBasedAnnotationAttributeFactory delays the invocation of
      MethodSecurityExpressionHandler.getExpressionParser()
    - MethodSecurityExpressionHandler is automatically wrapped in a
      LazyInitTargetSource and marked as lazyInit=true

core/src/main/java/org/springframework/security/access/expression/method/ExpressionBasedAnnotationAttributeFactory.java

@@ -1,5 +1,17 @@
-/**
+/*
+ * Copyright 2002-2013 the original author or authors.
  *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
  */
 package org.springframework.security.access.expression.method;
 
@@ -15,18 +27,22 @@ import org.springframework.security.access.prepost.PrePostInvocationAttributeFac
  * an expression to be evaluated at runtime.
  *
  * @author Luke Taylor
+ * @author Rob Winch
  * @since 3.0
  */
 public class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocationAttributeFactory {
-    private final ExpressionParser parser;
+    private final Object parserLock = new Object();
+    private ExpressionParser parser;
+    private MethodSecurityExpressionHandler handler;
 
     public ExpressionBasedAnnotationAttributeFactory(MethodSecurityExpressionHandler handler) {
-        parser = handler.getExpressionParser();
+        this.handler = handler;
     }
 
     public PreInvocationAttribute createPreInvocationAttribute(String preFilterAttribute, String filterObject, String preAuthorizeAttribute) {
         try {
-         // TODO: Optimization of permitAll
+            // TODO: Optimization of permitAll
+            ExpressionParser parser = getParser();
             Expression preAuthorizeExpression = preAuthorizeAttribute == null ? parser.parseExpression("permitAll") : parser.parseExpression(preAuthorizeAttribute);
             Expression preFilterExpression = preFilterAttribute == null ? null : parser.parseExpression(preFilterAttribute);
             return new PreInvocationExpressionAttribute(preFilterExpression, filterObject, preAuthorizeExpression);
@@ -37,6 +53,7 @@ public class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocat
 
     public PostInvocationAttribute createPostInvocationAttribute(String postFilterAttribute, String postAuthorizeAttribute) {
         try {
+            ExpressionParser parser = getParser();
             Expression postAuthorizeExpression = postAuthorizeAttribute == null ? null : parser.parseExpression(postAuthorizeAttribute);
             Expression postFilterExpression = postFilterAttribute == null ? null : parser.parseExpression(postFilterAttribute);
 
@@ -49,4 +66,20 @@ public class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocat
 
         return null;
     }
+
+    /**
+     * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136
+     *
+     * @return
+     */
+    private ExpressionParser getParser() {
+        if(this.parser != null) {
+            return this.parser;
+        }
+        synchronized(parserLock) {
+            this.parser = handler.getExpressionParser();
+            this.handler = null;
+        }
+        return this.parser;
+    }
 }