From d6397c2362f34cc849039e558f0214d5f24d0063 Mon Sep 17 00:00:00 2001
From: Stefan Penndorf <stefan.penndorf@saxess.ag>
Date: Wed, 7 Sep 2016 12:50:15 +0200
Subject: [PATCH] Remove dead code in SessionFixationProtectionStrategy

The retainedAttributes property is no longer used as a result of removing deprecations in 6e204fff72b80196a83245cbc3bd0cd401feda00

Fixes gh-4057
Related gh-2757 gh-2918
---
 .../SessionFixationProtectionStrategy.java    | 39 ++++---------------
 1 file changed, 8 insertions(+), 31 deletions(-)

diff --git a/web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java b/web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java
index db030efa6a..532310a041 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java
@@ -64,12 +64,6 @@ public class SessionFixationProtectionStrategy extends
 	 */
 	boolean migrateSessionAttributes = true;
 
-	/**
-	 * In the case where the attributes will not be migrated, this field allows a list of
-	 * named attributes which should <em>not</em> be discarded.
-	 */
-	private List<String> retainedAttributes = null;
-
 	/**
 	 * Called to extract the existing attributes from the session, prior to invalidating
 	 * it. If {@code migrateAttributes} is set to {@code false}, only Spring Security
@@ -124,36 +118,19 @@ public class SessionFixationProtectionStrategy extends
 
 	@SuppressWarnings("unchecked")
 	private HashMap<String, Object> createMigratedAttributeMap(HttpSession session) {
-		HashMap<String, Object> attributesToMigrate = null;
+		HashMap<String, Object> attributesToMigrate = new HashMap<String, Object>();
 
-		if (migrateSessionAttributes || retainedAttributes == null) {
-			attributesToMigrate = new HashMap<String, Object>();
+		Enumeration enumer = session.getAttributeNames();
 
-			Enumeration enumer = session.getAttributeNames();
-
-			while (enumer.hasMoreElements()) {
-				String key = (String) enumer.nextElement();
-				if (!migrateSessionAttributes && !key.startsWith("SPRING_SECURITY_")) {
-					// Only retain Spring Security attributes
-					continue;
-				}
-				attributesToMigrate.put(key, session.getAttribute(key));
+		while (enumer.hasMoreElements()) {
+			String key = (String) enumer.nextElement();
+			if (!migrateSessionAttributes && !key.startsWith("SPRING_SECURITY_")) {
+				// Only retain Spring Security attributes
+				continue;
 			}
+			attributesToMigrate.put(key, session.getAttribute(key));
 		}
-		else {
-			// Only retain the attributes which have been specified in the
-			// retainAttributes list
-			if (!retainedAttributes.isEmpty()) {
-				attributesToMigrate = new HashMap<String, Object>();
-				for (String name : retainedAttributes) {
-					Object value = session.getAttribute(name);
 
-					if (value != null) {
-						attributesToMigrate.put(name, value);
-					}
-				}
-			}
-		}
 		return attributesToMigrate;
 	}