SEC-3056 - Fix JavaDoc errors.

Fixed JavaDoc errors accross multiple modules in order to make javadoc happy with Java 8.

core/src/main/java/org/springframework/security/access/expression/SecurityExpressionOperations.java

@@ -45,7 +45,7 @@ public interface SecurityExpressionOperations {
 	 * is converted may depend on the implementation settings.
 	 * </p>
 	 *
-	 * @param authority the authority to test (i.e. "USER")
+	 * @param role the authority to test (i.e. "USER")
 	 * @return true if the authority is found, else false
 	 */
 	boolean hasRole(String role);
@@ -62,7 +62,7 @@ public interface SecurityExpressionOperations {
 	 * is converted may depend on the implementation settings.
 	 * </p>
 	 *
-	 * @param authorities the authorities to test (i.e. "USER", "ADMIN")
+	 * @param roles the authorities to test (i.e. "USER", "ADMIN")
 	 * @return true if any of the authorities is found, else false
 	 */
 	boolean hasAnyRole(String... roles);

core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java

@@ -195,8 +195,8 @@ public class DefaultMethodSecurityExpressionHandler extends
 
 	/**
 	 * <p>
-	 * Sets the default prefix to be added to {@link #hasAnyRole(String...)} or
-	 * {@link #hasRole(String)}. For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN")
+	 * Sets the default prefix to be added to {@link org.springframework.security.access.expression.SecurityExpressionRoot#hasAnyRole(String...)} or
+	 * {@link org.springframework.security.access.expression.SecurityExpressionRoot#hasRole(String)}. For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN")
 	 * is passed in, then the role ROLE_ADMIN will be used when the defaultRolePrefix is
 	 * "ROLE_" (default).
 	 * </p>

core/src/main/java/org/springframework/security/access/hierarchicalroles/RoleHierarchy.java

@@ -32,7 +32,7 @@ public interface RoleHierarchy {
 	 * that are (transitively) reachable from them in the role hierarchy.
 	 * <p>
 	 * Example:<br>
-	 * Role hierarchy: ROLE_A > ROLE_B and ROLE_B > ROLE_C.<br>
+	 * Role hierarchy: ROLE_A &gt; ROLE_B and ROLE_B &gt; ROLE_C.<br>
 	 * Directly assigned authority: ROLE_A.<br>
 	 * Reachable authorities: ROLE_A, ROLE_B, ROLE_C.
 	 *

core/src/main/java/org/springframework/security/access/hierarchicalroles/RoleHierarchyImpl.java

@@ -27,7 +27,7 @@ import java.util.regex.Pattern;
 /**
  * <p>
  * This class defines a role hierarchy for use with the UserDetailsServiceWrapper.
- * </p>
+ *
  * <p>
  * Here is an example configuration of a role hierarchy (hint: read the "&gt;" sign as
  * "includes"):
@@ -41,19 +41,18 @@ import java.util.regex.Pattern;
  *             &lt;/value&gt;
  *         &lt;/property&gt;
  * </pre>
- * 
- * </p>
+ *
  * <p>
  * Explanation of the above:<br>
  * In effect every user with ROLE_A also has ROLE_B, ROLE_AUTHENTICATED and
  * ROLE_UNAUTHENTICATED;<br>
  * every user with ROLE_B also has ROLE_AUTHENTICATED and ROLE_UNAUTHENTICATED;<br>
  * every user with ROLE_AUTHENTICATED also has ROLE_UNAUTHENTICATED.
- * </p>
+ *
  * <p>
  * Hierarchical Roles will dramatically shorten your access rules (and also make the
  * access rules much more elegant).
- * </p>
+ *
  * <p>
  * Consider this access rule for Spring Security's RoleVoter (background: every user that
  * is authenticated should be able to log out):<br>
@@ -62,10 +61,8 @@ import java.util.regex.Pattern;
  * /logout.html=ROLE_AUTHENTICATED<br>
  * In addition to shorter rules this will also make your access rules more readable and
  * your intentions clearer.
- * </p>
  *
  * @author Michael Mayr
- *
  */
 public class RoleHierarchyImpl implements RoleHierarchy {
 

core/src/main/java/org/springframework/security/access/intercept/package-info.java

@@ -8,7 +8,7 @@
  * security facilities provided for it by Spring Security.
  * For example, one secure object would be <code>MethodInvocation</code>,
  * whilst another would be HTTP
- * {@link org.springframework.security.web.FilterInvocation}. Note these are
+ * {@code org.springframework.security.web.FilterInvocation}. Note these are
  * infrastructure objects and their design allows them to represent a large
  * variety of actual resources that might need to be secured, such as business
  * objects or HTTP request URLs.

core/src/main/java/org/springframework/security/access/method/MapBasedMethodSecurityMetadataSource.java

@@ -107,7 +107,7 @@ public class MapBasedMethodSecurityMetadataSource extends
 
 	/**
 	 * Add configuration attributes for a secure method. Method names can end or start
-	 * with <code>&#42</code> for matching multiple methods.
+	 * with <code>*</code> for matching multiple methods.
 	 *
 	 * @param name type and method name, separated by a dot
 	 * @param attr the security attributes associated with the method
@@ -131,7 +131,7 @@ public class MapBasedMethodSecurityMetadataSource extends
 
 	/**
 	 * Add configuration attributes for a secure method. Mapped method names can end or
-	 * start with <code>&#42</code> for matching multiple methods.
+	 * start with <code>*</code> for matching multiple methods.
 	 *
 	 * @param javaType target interface or class the security configuration attribute
 	 * applies to

core/src/main/java/org/springframework/security/access/vote/AbstractAccessDecisionManager.java

@@ -33,11 +33,11 @@ import org.springframework.util.Assert;
 
 /**
  * Abstract implementation of {@link AccessDecisionManager}.
- * <p/>
+ *
+ * <p>
  * Handles configuration of a bean context defined list of {@link AccessDecisionVoter}s
  * and the access control behaviour if all voters abstain from voting (defaults to deny
  * access).
- * </p>
  */
 public abstract class AbstractAccessDecisionManager implements AccessDecisionManager,
 		InitializingBean, MessageSourceAware {
@@ -101,10 +101,9 @@ public abstract class AbstractAccessDecisionManager implements AccessDecisionMan
 	/**
 	 * Iterates through all <code>AccessDecisionVoter</code>s and ensures each can support
 	 * the presented class.
-	 * <p/>
+	 * <p>
 	 * If one or more voters cannot support the presented class, <code>false</code> is
 	 * returned.
-	 * </p>
 	 *
 	 * @param clazz the type of secured object being presented
 	 * @return true if this type is supported

core/src/main/java/org/springframework/security/authentication/encoding/ShaPasswordEncoder.java

@@ -24,7 +24,7 @@ package org.springframework.security.authentication.encoding;
  * </p>
  * <p>
  * As SHA is a one-way hash, the salt can contain any characters. The default strength for
- * the SHA encoding is SHA-1. If you wish to use higher strengths use the argumented
+ * the SHA encoding is SHA-1. If you wish to use higher strengths use the parametrised
  * constructor. {@link #ShaPasswordEncoder(int strength)}
  * </p>
  * <p>
@@ -32,7 +32,7 @@ package org.springframework.security.authentication.encoding;
  * 
  * <pre>
  * &lt;bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder"&gt;
- *     &lt;constructor-arg value="256"/>
+ *     &lt;constructor-arg value="256"/&gt;
  * &lt;/bean&gt;
  * </pre>
  *

core/src/main/java/org/springframework/security/authentication/jaas/AbstractJaasAuthenticationProvider.java

@@ -51,7 +51,7 @@ import org.springframework.util.ObjectUtils;
  * This <code>AuthenticationProvider</code> is capable of validating
  * {@link org.springframework.security.authentication.UsernamePasswordAuthenticationToken}
  * requests contain the correct username and password.
- * </p>
+ *
  * <p>
  * This implementation is backed by a <a
  * href="http://java.sun.com/j2se/1.5.0/docs/guide/security/jaas/JAASRefGuide.html"
@@ -68,7 +68,7 @@ import org.springframework.util.ObjectUtils;
  * in the ApplicationContext. When the LoginContext calls the internal CallbackHandler,
  * control is passed to each {@link JaasAuthenticationCallbackHandler} for each Callback
  * passed.
- * </p>
+ *
  * <p>
  * {@link JaasAuthenticationCallbackHandler}s are passed to the
  * AbstractJaasAuthenticationProvider through the
@@ -84,8 +84,7 @@ import org.springframework.util.ObjectUtils;
  *  &lt;/list&gt;
  * &lt;/property&gt;
  * </pre>
- * 
- * </p>
+ *
  * <p>
  * After calling LoginContext.login(), the AbstractJaasAuthenticationProvider will
  * retrieve the returned Principals from the Subject
@@ -95,7 +94,7 @@ import org.springframework.util.ObjectUtils;
  * Authorization a role, it returns that role name from it's
  * {@link AuthorityGranter#grant(java.security.Principal)} method. The returned role will
  * be applied to the Authorization object as a {@link GrantedAuthority}.
- * </p>
+ *
  * <p>
  * AuthorityGranters are configured in spring xml as follows...
  * 

core/src/main/java/org/springframework/security/authentication/jaas/JaasAuthenticationProvider.java

@@ -61,8 +61,7 @@ import java.security.Security;
  *   <value>/WEB-INF/login.conf</value>
  * </property>
  * </pre>
- * 
- * </p>
+ *
  * <p>
  * The loginContextName should coincide with a given index in the loginConfig specifed.
  * The loginConfig file used in the JUnit tests appears as the following...
@@ -80,7 +79,6 @@ import java.security.Security;
  *  &lt;property name="loginContextName"&gt; &lt;value&gt;JAASTest&lt;/value&gt; &lt;/property&gt;
  * </pre>
  * 
- * </p>
  * <p>
  * When using JAAS login modules as the authentication source, sometimes the <a href=
  * "http://java.sun.com/j2se/1.5.0/docs/api/javax/security/auth/login/LoginContext.html"
@@ -91,7 +89,7 @@ import java.security.Security;
  * in the ApplicationContext. When the LoginContext calls the internal CallbackHandler,
  * control is passed to each {@link JaasAuthenticationCallbackHandler} for each Callback
  * passed.
- * </p>
+ *
  * <p>
  * {@link JaasAuthenticationCallbackHandler}s are passed to the JaasAuthenticationProvider
  * through the
@@ -108,7 +106,6 @@ import java.security.Security;
  * &lt;/property&gt;
  * </pre>
  * 
- * </p>
  * <p>
  * After calling LoginContext.login(), the JaasAuthenticationProvider will retrieve the
  * returned Principals from the Subject (LoginContext.getSubject().getPrincipals). Each
@@ -130,10 +127,9 @@ import java.security.Security;
  * </pre>
  * 
  * A configuration note: The JaasAuthenticationProvider uses the security properites
- * &quote;login.config.url.X&quote; to configure jaas. If you would like to customize the
+ * "login.config.url.X" to configure jaas. If you would like to customize the
  * way Jaas gets configured, create a subclass of this and override the
  * {@link #configureJaas(Resource)} method.
- * </p>
  *
  * @author Ray Krueger
  * @author Rob Winch

core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java

@@ -55,7 +55,7 @@ public class DelegatingSecurityContextExecutorService extends
 	 * Creates a new {@link DelegatingSecurityContextExecutorService} that uses the
 	 * current {@link SecurityContext} from the {@link SecurityContextHolder}.
 	 *
-	 * @param delegateTaskExecutor the {@link TaskExecutor} to delegate to. Cannot be
+	 * @param delegate the {@link ExecutorService} to delegate to. Cannot be
 	 * null.
 	 */
 	public DelegatingSecurityContextExecutorService(ExecutorService delegate) {

core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextRunnable.java

@@ -70,13 +70,13 @@ public final class DelegatingSecurityContextRunnable implements Runnable {
 	}
 
 	/**
-	 * Determines if the SecurityContext should be transfered if {@link #call()}
+	 * Determines if the SecurityContext should be transfered if {@link #run()}
 	 * is invoked on the same {@link Thread} the
 	 * {@link DelegatingSecurityContextCallable} was created on.
 	 *
 	 * @param enableOnOriginalThread
 	 *            if false (default), will only transfer the
-	 *            {@link SecurityContext} if {@link #call()} is invoked on a
+	 *            {@link SecurityContext} if {@link #run()} is invoked on a
 	 *            different {@link Thread} than the
 	 *            {@link DelegatingSecurityContextCallable} was created on.
 	 * @since 4.0.2

core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextScheduledExecutorService.java

@@ -51,7 +51,7 @@ public final class DelegatingSecurityContextScheduledExecutorService extends
 	 * Creates a new {@link DelegatingSecurityContextScheduledExecutorService} that uses
 	 * the current {@link SecurityContext} from the {@link SecurityContextHolder}.
 	 *
-	 * @param delegateTaskExecutor the {@link TaskExecutor} to delegate to. Cannot be
+	 * @param delegate the {@link ScheduledExecutorService} to delegate to. Cannot be
 	 * null.
 	 */
 	public DelegatingSecurityContextScheduledExecutorService(

core/src/main/java/org/springframework/security/core/annotation/AuthenticationPrincipal.java

@@ -30,7 +30,9 @@ import org.springframework.security.core.Authentication;
  * @author Rob Winch
  * @since 4.0
  *
- * @see org.springframework.security.messaging.context.AuthenticationPrincipalArgumentResolver
+ *  See: <a href="{@docRoot}/org/springframework/security/messaging/context/AuthenticationPrincipalArgumentResolver.html">
+ *  AuthenticationPrincipalArgumentResolver
+ *  </a>
  */
 @Target({ ElementType.PARAMETER, ElementType.ANNOTATION_TYPE })
 @Retention(RetentionPolicy.RUNTIME)

core/src/main/java/org/springframework/security/core/parameters/AnnotationParameterNameDiscoverer.java

@@ -40,7 +40,7 @@ import org.springframework.util.ReflectionUtils;
  * <pre>
  * import org.springframework.security.access.method.P;
  * 
- * @PostAuthorize("#to == returnObject.to")
+ * {@code @PostAuthorize("#to == returnObject.to")}
  * public Message findMessageByTo(@P("to") String to);
  * </pre>
  *
@@ -70,7 +70,7 @@ import org.springframework.util.ReflectionUtils;
  * <pre>
  * import org.springframework.security.access.method.P;
  * 
- * @PostAuthorize("#to == returnObject.to")
+ * {@code @PostAuthorize("#to == returnObject.to")}
  * public Message findMessageByToAndFrom(@P("to") User to, User from);
  * </pre>
  *

core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java

@@ -32,9 +32,8 @@ import java.util.concurrent.CopyOnWriteArraySet;
  * SessionDestroyedEvent}s published in the Spring application context.
  * <p>
  * For this class to function correctly in a web application, it is important that you
- * register an {@link org.springframework.security.web.session.HttpSessionEventPublisher
- * HttpSessionEventPublisher} in the <tt>web.xml</tt> file so that this class is notified
- * of sessions that expire.
+ * register an <a href="{@docRoot}/org/springframework/security/web/session/HttpSessionEventPublisher.html">HttpSessionEventPublisher</a>
+ * in the <tt>web.xml</tt> file so that this class is notified of sessions that expire.
  *
  * @author Ben Alex
  * @author Luke Taylor

core/src/main/java/org/springframework/security/core/token/KeyBasedPersistenceTokenService.java

@@ -145,7 +145,7 @@ public class KeyBasedPersistenceTokenService implements TokenService, Initializi
 	}
 
 	/**
-	 * @param pseudoRandomNumberBytes changes the number of bytes issued (must be >= 0;
+	 * @param pseudoRandomNumberBytes changes the number of bytes issued (must be >= 0;
 	 * defaults to 256)
 	 */
 	public void setPseudoRandomNumberBytes(int pseudoRandomNumberBytes) {

core/src/main/java/org/springframework/security/core/token/TokenService.java

@@ -38,7 +38,7 @@ public interface TokenService {
 	Token allocateToken(String extendedInformation);
 
 	/**
-	 * Permits verification the <{@link Token#getKey()} was issued by this
+	 * Permits verification the {@link Token#getKey()} was issued by this
 	 * <code>TokenService</code> and reconstructs the corresponding <code>Token</code>.
 	 *
 	 * @param key as obtained from {@link Token#getKey()} and created by this

core/src/main/java/org/springframework/security/core/userdetails/jdbc/JdbcDaoImpl.java

@@ -47,7 +47,7 @@ import org.springframework.util.Assert;
  *
  * This table contains the login name, password and enabled status of the user.
  *
- * <table>
+ * <table summary="The Users Table">
  * <tr>
  * <th>Column</th>
  * </tr>
@@ -64,7 +64,7 @@ import org.springframework.util.Assert;
  *
  * <h4>The Authorities Table</h4>
  *
- * <table>
+ * <table summary="The Authorities Table">
  * <tr>
  * <th>Column</th>
  * </tr>

core/src/main/java/org/springframework/security/core/userdetails/memory/UserAttribute.java

@@ -23,7 +23,7 @@ import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 /**
- * Used by {@link InMemoryDaoImpl} to temporarily store the attributes associated with a
+ * Used by {@link org.springframework.security.provisioning.InMemoryUserDetailsManager} to temporarily store the attributes associated with a
  * user.
  *
  * @author Ben Alex
@@ -50,7 +50,7 @@ public class UserAttribute {
 	/**
 	 * Set all authorities for this user.
 	 *
-	 * @param authorities {@link List} <{@link GrantedAuthority}>
+	 * @param authorities {@link List} <{@link GrantedAuthority}>
 	 * @since 1.1
 	 */
 	public void setAuthorities(List<GrantedAuthority> authorities) {
@@ -61,7 +61,7 @@ public class UserAttribute {
 	 * Set all authorities for this user from String values. It will create the necessary
 	 * {@link GrantedAuthority} objects.
 	 *
-	 * @param authoritiesAsStrings {@link List} &lt;{@link String}>
+	 * @param authoritiesAsStrings {@link List} &lt;{@link String}&gt;
 	 * @since 1.1
 	 */
 	public void setAuthoritiesAsString(List<String> authoritiesAsStrings) {

core/src/main/java/org/springframework/security/task/DelegatingSecurityContextTaskExecutor.java

@@ -45,7 +45,7 @@ public class DelegatingSecurityContextTaskExecutor extends
 	 * Creates a new {@link DelegatingSecurityContextTaskExecutor} that uses the current
 	 * {@link SecurityContext} from the {@link SecurityContextHolder}.
 	 *
-	 * @param delegateTaskExecutor the {@link TaskExecutor} to delegate to. Cannot be
+	 * @param delegate the {@link TaskExecutor} to delegate to. Cannot be
 	 * null.
 	 */
 	public DelegatingSecurityContextTaskExecutor(TaskExecutor delegate) {