SEC-1392: Mark PermissionEvaluator and MethodSecurityExpressionHandler as AopInfrastructure beans to prevent them being advised and causing premature use of MethodSecurityMetadataSource before it is initialized properly.

core/src/main/java/org/springframework/security/access/PermissionEvaluator.java

@@ -2,6 +2,7 @@ package org.springframework.security.access;
 
 import java.io.Serializable;
 
+import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.core.Authentication;
 
 /**
@@ -12,7 +13,7 @@ import org.springframework.security.core.Authentication;
  * @author Luke Taylor
  * @since 3.0
  */
-public interface PermissionEvaluator {
+public interface PermissionEvaluator extends AopInfrastructureBean {
     /**
      *
      * @param authentication represents the user in question. Should not be null.

core/src/main/java/org/springframework/security/access/expression/method/MethodSecurityExpressionHandler.java

@@ -1,6 +1,7 @@
 package org.springframework.security.access.expression.method;
 
 import org.aopalliance.intercept.MethodInvocation;
+import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.Expression;
 import org.springframework.expression.ExpressionParser;
@@ -13,7 +14,7 @@ import org.springframework.security.core.Authentication;
  * @author Luke Taylor
  * @since 3.0
  */
-public interface MethodSecurityExpressionHandler {
+public interface MethodSecurityExpressionHandler extends AopInfrastructureBean {
     /**
      * @return an expression parser for the expressions used by the implementation.
      */