SEC-1635: Stop security interceptors from calling AfterInvocationManager if exception occurs during invocation

core/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java

@@ -51,21 +51,16 @@ public class MethodSecurityInterceptor extends AbstractSecurityInterceptor imple
      *
      * @param mi The method being invoked which requires a security decision
      *
-     * @return The returned value from the method invocation
+     * @return The returned value from the method invocation (possibly modified by the {@code AfterInvocationManager}).
      *
      * @throws Throwable if any error occurs
      */
     public Object invoke(MethodInvocation mi) throws Throwable {
-        Object result = null;
         InterceptorStatusToken token = super.beforeInvocation(mi);
 
-        try {
-            result = mi.proceed();
-        } finally {
-            result = super.afterInvocation(token, result);
-        }
+        Object result = mi.proceed();
 
-        return result;
+        return super.afterInvocation(token, result);
     }
 
     public MethodSecurityMetadataSource getSecurityMetadataSource() {

core/src/main/java/org/springframework/security/access/intercept/aspectj/AspectJMethodSecurityInterceptor.java

@@ -37,15 +37,10 @@ public final class AspectJMethodSecurityInterceptor extends MethodSecurityInterc
      * @return The returned value from the method invocation
      */
     public Object invoke(JoinPoint jp, AspectJCallback advisorProceed) {
-        Object result = null;
         InterceptorStatusToken token = super.beforeInvocation(new MethodInvocationAdapter(jp));
 
-        try {
-            result = advisorProceed.proceedWithObject();
-        } finally {
-            result = super.afterInvocation(token, result);
-        }
+        Object result = advisorProceed.proceedWithObject();
 
-        return result;
+        return super.afterInvocation(token, result);
     }
 }

core/src/test/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptorTests.java

@@ -259,6 +259,27 @@ public class MethodSecurityInterceptorTests {
         advisedTarget.makeUpperCase("hello");
     }
 
+    @Test
+    public void afterInvocationManagerIsNotInvokedIfExceptionIsRaised() throws Throwable {
+        MethodInvocation mi = mock(MethodInvocation.class);
+        token.setAuthenticated(true);
+        SecurityContextHolder.getContext().setAuthentication(token);
+        mdsReturnsUserRole();
+
+        AfterInvocationManager aim = mock(AfterInvocationManager.class);
+        interceptor.setAfterInvocationManager(aim);
+
+        when(mi.proceed()).thenThrow(new Throwable());
+
+        try {
+            interceptor.invoke(mi);
+            fail("Expected exception");
+        } catch (Throwable expected) {
+        }
+
+        verifyZeroInteractions(aim);
+    }
+
     void mdsReturnsNull() {
         when(mds.getAttributes(any(MethodInvocation.class))).thenReturn(null);
     }

core/src/test/java/org/springframework/security/access/intercept/aspectj/AspectJMethodSecurityInterceptorTests.java

@@ -19,6 +19,7 @@ import static org.junit.Assert.*;
 import static org.mockito.Matchers.any;
 import static org.mockito.Mockito.*;
 
+import org.aopalliance.intercept.MethodInvocation;
 import org.aspectj.lang.JoinPoint;
 import org.aspectj.lang.ProceedingJoinPoint;
 import org.aspectj.lang.Signature;
@@ -32,6 +33,7 @@ import org.springframework.security.TargetObject;
 import org.springframework.security.access.AccessDecisionManager;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.SecurityConfig;
+import org.springframework.security.access.intercept.AfterInvocationManager;
 import org.springframework.security.access.method.MethodSecurityMetadataSource;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.TestingAuthenticationToken;
@@ -129,4 +131,24 @@ public class AspectJMethodSecurityInterceptorTests {
         assertEquals(m, mia.getMethod());
         assertSame(to, mia.getThis());
     }
+
+    @Test
+    public void afterInvocationManagerIsNotInvokedIfExceptionIsRaised() throws Throwable {
+        token.setAuthenticated(true);
+        SecurityContextHolder.getContext().setAuthentication(token);
+
+        AfterInvocationManager aim = mock(AfterInvocationManager.class);
+        interceptor.setAfterInvocationManager(aim);
+
+        when(aspectJCallback.proceedWithObject()).thenThrow(new RuntimeException());
+
+        try {
+            interceptor.invoke(joinPoint, aspectJCallback);
+            fail("Expected exception");
+        } catch (RuntimeException expected) {
+        }
+
+        verifyZeroInteractions(aim);
+    }
+
 }