SEC-1532: Add cache of previously matched beans to ProtectPointcutPostProcessor to ensure that it doesn't perform pointcut matching every time a new prototype bean is created.

2026-08-05 17:57:15 +00:00 · 2010-08-09 16:54:32 +01:00
parent f6abc24ed6
commit a1b124def5
4 changed files with 98 additions and 13 deletions
@@ -0,0 +1,52 @@
+package org.springframework.security.performance;
+
+import static junit.framework.Assert.fail;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.BeansException;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.session.SessionRegistry;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+import org.springframework.util.StopWatch;
+
+/**
+ * @author Luke Taylor
+ */
+@ContextConfiguration(locations={"/protect-pointcut-performance-app-context.xml"})
+@RunWith(SpringJUnit4ClassRunner.class)
+public class ProtectPointcutPerformanceTests implements ApplicationContextAware {
+    ApplicationContext ctx;
+
+    @Before
+    public void clearContext() {
+        SecurityContextHolder.clearContext();
+    }
+
+    // Method for use with profiler
+    @Test
+    public void usingPrototypeDoesNotParsePointcutOnEachCall() {
+        StopWatch sw = new StopWatch();
+        sw.start();
+        for (int i = 0; i < 1000; i++) {
+            try {
+                SessionRegistry reg = (SessionRegistry) ctx.getBean("sessionRegistryPrototype");
+                reg.getAllPrincipals();
+                fail("Expected AuthenticationCredentialsNotFoundException");
+            } catch (AuthenticationCredentialsNotFoundException expected) {
+            }
+        }
+        sw.stop();
+//        assertTrue(sw.getTotalTimeMillis() < 1000);
+
+    }
+
+    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
+        ctx = applicationContext;
+    }
+}
@@ -0,0 +1,26 @@
+<beans xmlns="http://www.springframework.org/schema/beans"
+    xmlns:sec="http://www.springframework.org/schema/security"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
+
+    <sec:global-method-security>
+        <sec:protect-pointcut expression="execution(* org.springframework.security.core.session.SessionRegistry.refreshLastRequest(..))" access="ROLE_ADMIN" />
+        <sec:protect-pointcut expression="execution(* org.springframework.security.core.session.SessionRegistry.registerNewSession(..))" access="ROLE_ADMIN" />
+        <sec:protect-pointcut expression="execution(* org.springframework.security.core.session.SessionRegistry.removeSessionInformation(..))" access="ROLE_ADMIN" />
+        <sec:protect-pointcut expression="execution(* org.springframework.security.core.session.SessionRegistry.get*(..))" access="ROLE_ADMIN" />
+    </sec:global-method-security>
+
+    <bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
+
+    <bean id="sessionRegistryPrototype" class="org.springframework.security.core.session.SessionRegistryImpl" scope="prototype"/>
+
+    <sec:authentication-manager alias="authenticationManager">
+        <sec:authentication-provider>
+            <sec:user-service id="userService">
+                <sec:user name="notused" password="notused" authorities="ROLE_0,ROLE_1"/>
+            </sec:user-service>
+        </sec:authentication-provider>
+    </sec:authentication-manager>
+
+</beans>