Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 01:36:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1562: Created SecurityExpressionHandler interface and AbstractSecurityExpressionHandler.

Browse Source
This commit is contained in:
Luke Taylor
2010-09-07 19:45:37 +01:00
parent b0998c01bc
commit af56f4844d
12 changed files with 161 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/springframework/security/access/expression/AbstractSecurityExpressionHandler.java
+83
View File
@@ -0,0 +1,83 @@
package org.springframework.security.access.expression;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.expression.EvaluationContext;
import org.springframework.expression.ExpressionParser;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.expression.spel.support.StandardEvaluationContext;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.Authentication;
/**
* Base implementation of the facade which isolates Spring Security's requirements for evaluating security expressions
* from the implementation of the underlying expression objects.
*
* @author Luke Taylor
* @since 3.1
*/
public abstract class AbstractSecurityExpressionHandler<T> implements SecurityExpressionHandler<T>, ApplicationContextAware {
private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
private final ExpressionParser expressionParser = new SpelExpressionParser();
private final SecurityExpressionRootPropertyAccessor sxrpa = new SecurityExpressionRootPropertyAccessor();
private RoleHierarchy roleHierarchy;
private ApplicationContext applicationContext;
public final ExpressionParser getExpressionParser() {
return expressionParser;
}
/**
* Invokes the internal template methods to create {@code StandardEvaluationContext} and {@code SecurityExpressionRoot}
* objects. The root object will be injected with references to the application context, the {@code roleHierarchy}
* if set, and an {@code AuthenticationTrustResolver}.
*
* @param authentication the current authentication object
* @param invocation the invocation (filter, method, channel)
* @return the context object for use in evaluating the expression, populated with a suitable root object.
*/
public final EvaluationContext createEvaluationContext(Authentication authentication, T invocation) {
SecurityExpressionRoot root = createSecurityExpressionRoot(authentication, invocation);
root.setTrustResolver(trustResolver);
root.setRoleHierarchy(roleHierarchy);
root.setApplicationContext(applicationContext);
StandardEvaluationContext ctx = createEvaluationContextInternal(authentication, invocation);
ctx.addPropertyAccessor(sxrpa);
ctx.setRootObject(root);
return ctx;
}
/**
* Override to create a custom instance of {@code StandardEvaluationContext}.
* <p>
* The returned object will have a {@code SecurityExpressionRootPropertyAccessor} added, allowing beans in
* the {@code ApplicationContext} to be accessed via expression properties.
*
* @param authentication the current authentication object
* @param invocation the invocation (filter, method, channel)
* @return A {@code StandardEvaluationContext} or potentially a custom subclass if overridden.
*/
protected StandardEvaluationContext createEvaluationContextInternal(Authentication authentication, T invocation) {
return new StandardEvaluationContext();
}
/**
* Implement in order to create a root object of the correct type for the supported invocation type.
*
* @param authentication the current authentication object
* @param invocation the invocation (filter, method, channel)
* @return a
*/
protected abstract SecurityExpressionRoot createSecurityExpressionRoot(Authentication authentication, T invocation);
public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
this.roleHierarchy = roleHierarchy;
}
public void setApplicationContext(ApplicationContext applicationContext) {
this.applicationContext = applicationContext;
}
}
core/src/main/java/org/springframework/security/access/expression/SecurityExpressionHandler.java
+25
View File
@@ -0,0 +1,25 @@
package org.springframework.security.access.expression;
import org.springframework.aop.framework.AopInfrastructureBean;
import org.springframework.expression.EvaluationContext;
import org.springframework.expression.ExpressionParser;
import org.springframework.security.core.Authentication;
/**
* Facade which isolates Spring Security's requirements for evaluating security expressions
* from the implementation of the underlying expression objects
*
* @author Luke Taylor
* @since 3.1
*/
public interface SecurityExpressionHandler<T> extends AopInfrastructureBean {
/**
* @return an expression parser for the expressions used by the implementation.
*/
ExpressionParser getExpressionParser();
/**
* Provides an evaluation context in which to evaluate security expressions for the invocation type.
*/
EvaluationContext createEvaluationContext(Authentication authentication, T invocation);
}
core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java
+16 -47
View File
@@ -1,71 +1,56 @@
package org.springframework.security.access.expression.method;
import java.lang.reflect.Array;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import java.util.*;
import org.aopalliance.intercept.MethodInvocation;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.BeansException;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
import org.springframework.core.ParameterNameDiscoverer;
import org.springframework.expression.EvaluationContext;
import org.springframework.expression.Expression;
import org.springframework.expression.ExpressionParser;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.expression.spel.support.StandardEvaluationContext;
import org.springframework.security.access.PermissionCacheOptimizer;
import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.access.expression.AbstractSecurityExpressionHandler;
import org.springframework.security.access.expression.ExpressionUtils;
import org.springframework.security.access.expression.SecurityExpressionRoot;
import org.springframework.security.access.expression.SecurityExpressionRootPropertyAccessor;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.Authentication;
/**
* The standard implementation of <tt>SecurityExpressionHandler</tt>.
* The standard implementation of {@code MethodSecurityExpressionHandler}.
* <p>
* A single instance should usually be shared amongst the beans that require expression support.
*
* @author Luke Taylor
* @since 3.0
*/
public class DefaultMethodSecurityExpressionHandler implements MethodSecurityExpressionHandler, ApplicationContextAware {
public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpressionHandler<MethodInvocation> implements MethodSecurityExpressionHandler {
protected final Log logger = LogFactory.getLog(getClass());
private ParameterNameDiscoverer parameterNameDiscoverer = new LocalVariableTableParameterNameDiscoverer();
private PermissionEvaluator permissionEvaluator = new DenyAllPermissionEvaluator();
private PermissionCacheOptimizer permissionCacheOptimizer = null;
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
private final SecurityExpressionRootPropertyAccessor sxrpa = new SecurityExpressionRootPropertyAccessor();
private final ExpressionParser expressionParser = new SpelExpressionParser();
private RoleHierarchy roleHierarchy;
private ApplicationContext applicationContext;
public DefaultMethodSecurityExpressionHandler() {
}
/**
* Uses a {@link MethodSecurityEvaluationContext} as the <tt>EvaluationContext</tt> implementation and
* configures it with a {@link MethodSecurityExpressionRoot} instance as the expression root object.
* Uses a {@link MethodSecurityEvaluationContext} as the <tt>EvaluationContext</tt> implementation.
*/
public EvaluationContext createEvaluationContext(Authentication auth, MethodInvocation mi) {
MethodSecurityEvaluationContext ctx = new MethodSecurityEvaluationContext(auth, mi, parameterNameDiscoverer);
MethodSecurityExpressionRoot root = new MethodSecurityExpressionRoot(auth);
root.setTrustResolver(trustResolver);
root.setPermissionEvaluator(permissionEvaluator);
root.setRoleHierarchy(roleHierarchy);
root.setApplicationContext(applicationContext);
ctx.setRootObject(root);
ctx.addPropertyAccessor(sxrpa);
public StandardEvaluationContext createEvaluationContextInternal(Authentication auth, MethodInvocation mi) {
return new MethodSecurityEvaluationContext(auth, mi, parameterNameDiscoverer);
}
return ctx;
@Override
protected SecurityExpressionRoot createSecurityExpressionRoot(Authentication authentication, MethodInvocation invocation) {
MethodSecurityExpressionRoot root = new MethodSecurityExpressionRoot(authentication);
root.setPermissionEvaluator(permissionEvaluator);
return root;
}
/**
@@ -151,10 +136,6 @@ public class DefaultMethodSecurityExpressionHandler implements MethodSecurityExp
throw new IllegalArgumentException("Filter target must be a collection or array type, but was " + filterTarget);
}
public ExpressionParser getExpressionParser() {
return expressionParser;
}
public void setParameterNameDiscoverer(ParameterNameDiscoverer parameterNameDiscoverer) {
this.parameterNameDiscoverer = parameterNameDiscoverer;
}
@@ -167,19 +148,7 @@ public class DefaultMethodSecurityExpressionHandler implements MethodSecurityExp
this.permissionCacheOptimizer = permissionCacheOptimizer;
}
public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
this.trustResolver = trustResolver;
}
public void setReturnObject(Object returnObject, EvaluationContext ctx) {
((MethodSecurityExpressionRoot)ctx.getRootObject().getValue()).setReturnObject(returnObject);
}
public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
this.roleHierarchy = roleHierarchy;
}
public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
this.applicationContext = applicationContext;
}
}
core/src/main/java/org/springframework/security/access/expression/method/ExpressionBasedPreInvocationAdvice.java
+1 -1
View File
@@ -17,7 +17,7 @@ import org.springframework.security.core.Authentication;
* Method pre-invocation handling based on expressions.
*
* @author Luke Taylor
* @since
* @since 3.0
*/
public class ExpressionBasedPreInvocationAdvice implements PreInvocationAuthorizationAdvice {
private MethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
core/src/main/java/org/springframework/security/access/expression/method/MethodSecurityExpressionHandler.java
+5 -18
View File
@@ -1,30 +1,17 @@
package org.springframework.security.access.expression.method;
import org.aopalliance.intercept.MethodInvocation;
import org.springframework.aop.framework.AopInfrastructureBean;
import org.springframework.expression.EvaluationContext;
import org.springframework.expression.Expression;
import org.springframework.expression.ExpressionParser;
import org.springframework.security.core.Authentication;
import org.springframework.security.access.expression.SecurityExpressionHandler;
/**
* Facade which isolates Spring Security's requirements for evaluation method-security expressions
* from the implementation of the underlying expression objects.
* Extended expression-handler facade which adds methods which are specific to securing method invocations.
*
* @author Luke Taylor
* @since 3.0
*/
public interface MethodSecurityExpressionHandler extends AopInfrastructureBean {
/**
* @return an expression parser for the expressions used by the implementation.
*/
ExpressionParser getExpressionParser();
/**
* Provides an evaluation context in which to evaluate security expressions for a method invocation.
*/
EvaluationContext createEvaluationContext(Authentication authentication, MethodInvocation mi);
public interface MethodSecurityExpressionHandler extends SecurityExpressionHandler<MethodInvocation> {
/**
* Filters a target collection or array.
* Only applies to method invocations.
@@ -33,7 +20,7 @@ public interface MethodSecurityExpressionHandler extends AopInfrastructureBean {
* @param filterExpression the expression which should be used as the filter condition. If it returns false on
* evaluation, the object will be removed from the returned collection
* @param ctx the current evaluation context (as created through a call to
* {@link #createEvaluationContext(Authentication, MethodInvocation)}
* {@link #createEvaluationContext(org.springframework.security.core.Authentication, Object)}
* @return the filtered collection or array
*/
Object filter(Object filterTarget, Expression filterExpression, EvaluationContext ctx);
@@ -44,7 +31,7 @@ public interface MethodSecurityExpressionHandler extends AopInfrastructureBean {
*
* @param returnObject the return object value
* @param ctx the context within which the object should be set (as created through a call to
* {@link #createEvaluationContext(Authentication, MethodInvocation)}
* {@link #createEvaluationContext(org.springframework.security.core.Authentication, Object)}
*/
void setReturnObject(Object returnObject, EvaluationContext ctx);