Fix consistency with Nullability Usage

Issue gh-18564
2026-08-05 17:57:15 +00:00 · 2026-01-22 14:48:05 -06:00
parent ab3298e917
commit d7fbf3673a
20 changed files with 32 additions and 46 deletions
@@ -24,6 +24,7 @@ import jakarta.servlet.Filter;
 import jakarta.servlet.http.HttpServletRequest;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.jspecify.annotations.NonNull;
 import org.jspecify.annotations.Nullable;

 import org.springframework.beans.BeansException;
@@ -33,7 +34,6 @@ import org.springframework.beans.factory.BeanNameAware;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.core.log.LogMessage;
-import org.springframework.lang.NonNull;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.StringUtils;

@@ -508,7 +508,7 @@ public final class ObservationFilterChainDecorator implements FilterChainProxy.F

 		private final String filterSection;

-		@Nullable private String filterName;
+		private @Nullable String filterName;

 		private int chainPosition;

@@ -126,7 +126,7 @@ public abstract class AbstractAuthenticationProcessingFilter extends GenericFilt
 	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
 		.getContextHolderStrategy();

-	@Nullable protected ApplicationEventPublisher eventPublisher;
+	protected @Nullable ApplicationEventPublisher eventPublisher;

 	protected AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();

@@ -18,9 +18,9 @@ package org.springframework.security.web.authentication;

 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.jspecify.annotations.Nullable;

 import org.springframework.http.HttpMethod;
-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -100,8 +100,7 @@ public class UsernamePasswordAuthenticationFilter extends AbstractAuthentication
 	 * @return the password that will be presented in the <code>Authentication</code>
 	 * request token to the <code>AuthenticationManager</code>
 	 */
-	@Nullable
-	protected String obtainPassword(HttpServletRequest request) {
+	protected @Nullable String obtainPassword(HttpServletRequest request) {
 		return request.getParameter(this.passwordParameter);
 	}

@@ -112,8 +111,7 @@ public class UsernamePasswordAuthenticationFilter extends AbstractAuthentication
 	 * @return the username that will be presented in the <code>Authentication</code>
 	 * request token to the <code>AuthenticationManager</code>
 	 */
-	@Nullable
-	protected String obtainUsername(HttpServletRequest request) {
+	protected @Nullable String obtainUsername(HttpServletRequest request) {
 		return request.getParameter(this.usernameParameter);
 	}

@@ -17,8 +17,8 @@
 package org.springframework.security.web.authentication.ott;

 import jakarta.servlet.http.HttpServletRequest;
+import org.jspecify.annotations.Nullable;

-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;

 /**
@@ -35,7 +35,6 @@ public interface GenerateOneTimeTokenRequestResolver {
 	 * @param request {@link HttpServletRequest} to resolve
 	 * @return {@link GenerateOneTimeTokenRequest}
 	 */
-	@Nullable
-	GenerateOneTimeTokenRequest resolve(HttpServletRequest request);
+	@Nullable GenerateOneTimeTokenRequest resolve(HttpServletRequest request);

 }
@@ -20,7 +20,8 @@ import java.util.Collections;
 import java.util.Map;
 import java.util.regex.Pattern;

-import org.springframework.lang.NonNull;
+import org.jspecify.annotations.NonNull;
+
 import org.springframework.security.web.server.csrf.CsrfToken;
 import org.springframework.web.reactive.result.view.RequestDataValueProcessor;
 import org.springframework.web.server.ServerWebExchange;
@@ -109,9 +109,9 @@ public final class ObservationWebFilterChainDecorator implements WebFilterChainP

 		private final WebHandler handler;

-		@Nullable private final ObservationWebFilter currentFilter;
+		private final @Nullable ObservationWebFilter currentFilter;

-		@Nullable private final ObservationWebFilterChain chain;
+		private final @Nullable ObservationWebFilterChain chain;

 		/**
 		 * Public constructor with the list of filters and the target handler to use.
@@ -20,10 +20,10 @@ import java.security.cert.X509Certificate;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.jspecify.annotations.NonNull;
 import reactor.core.publisher.Mono;

 import org.springframework.http.server.reactive.SslInfo;
-import org.springframework.lang.NonNull;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
 import org.springframework.security.web.authentication.preauth.x509.X509PrincipalExtractor;
@@ -23,12 +23,12 @@ import java.util.Optional;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
 import reactor.core.publisher.Mono;

 import org.springframework.core.log.LogMessage;
 import org.springframework.http.HttpMethod;
-import org.springframework.lang.NonNull;
-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
 import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -217,8 +217,8 @@ public class SwitchUserWebFilter implements WebFilter {
 		return exchange.getRequest().getQueryParams().getFirst(SPRING_SECURITY_SWITCH_USERNAME_KEY);
 	}

-	@NonNull
-	private Mono<Authentication> attemptSwitchUser(Authentication currentAuthentication, @Nullable String userName) {
+	private @NonNull Mono<Authentication> attemptSwitchUser(Authentication currentAuthentication,
+			@Nullable String userName) {
 		Assert.notNull(userName, "The userName can not be null.");
 		this.logger.debug(LogMessage.format("Attempting to switch to user [%s]", userName));
 		return this.userDetailsService.findByUsername(userName)
@@ -227,8 +227,7 @@ public class SwitchUserWebFilter implements WebFilter {
 			.map((userDetails) -> createSwitchUserToken(userDetails, currentAuthentication));
 	}

-	@NonNull
-	private Authentication attemptExitUser(Authentication currentAuthentication) {
+	private @NonNull Authentication attemptExitUser(Authentication currentAuthentication) {
 		Optional<Authentication> sourceAuthentication = extractSourceAuthentication(currentAuthentication);
 		if (sourceAuthentication.isEmpty()) {
 			this.logger.debug("Failed to find original user");
@@ -19,11 +19,11 @@ package org.springframework.security.web.servlet.util.matcher;
 import java.util.Objects;

 import jakarta.servlet.http.HttpServletRequest;
+import org.jspecify.annotations.Nullable;

 import org.springframework.http.HttpMethod;
 import org.springframework.http.server.PathContainer;
 import org.springframework.http.server.RequestPath;
-import org.springframework.lang.Nullable;
 import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
 import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -18,9 +18,9 @@ package org.springframework.security.web.util.matcher;

 import jakarta.servlet.DispatcherType;
 import jakarta.servlet.http.HttpServletRequest;
+import org.jspecify.annotations.Nullable;

 import org.springframework.http.HttpMethod;
-import org.springframework.lang.Nullable;
 import org.springframework.util.StringUtils;

 /**
@@ -36,8 +36,7 @@ public class DispatcherTypeRequestMatcher implements RequestMatcher {

 	private final DispatcherType dispatcherType;

-	@Nullable
-	private final HttpMethod httpMethod;
+	private final @Nullable HttpMethod httpMethod;

 	/**
 	 * Creates an instance which matches requests with the provided {@link DispatcherType}
@@ -28,7 +28,6 @@ import jakarta.servlet.Servlet;
 import jakarta.servlet.ServletRegistration;
 import jakarta.servlet.ServletSecurityElement;

-import org.springframework.lang.NonNull;
 import org.springframework.web.servlet.DispatcherServlet;

 public class MockServletContext extends org.springframework.mock.web.MockServletContext {
@@ -41,15 +40,13 @@ public class MockServletContext extends org.springframework.mock.web.MockServlet
 		return servletContext;
 	}

-	@NonNull
 	@Override
-	public ServletRegistration.Dynamic addServlet(@NonNull String servletName, Class<? extends Servlet> clazz) {
+	public ServletRegistration.Dynamic addServlet(String servletName, Class<? extends Servlet> clazz) {
 		ServletRegistration.Dynamic dynamic = new MockServletRegistration(servletName, clazz);
 		this.registrations.put(servletName, dynamic);
 		return dynamic;
 	}

-	@NonNull
 	@Override
 	public Map<String, ? extends ServletRegistration> getServletRegistrations() {
 		return this.registrations;