diff --git a/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java b/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java index 51b47bbddf..f5094efb5b 100644 --- a/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java +++ b/core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java @@ -9,7 +9,6 @@ import java.util.List; import org.aopalliance.intercept.MethodInvocation; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; -import org.springframework.core.LocalVariableTableParameterNameDiscoverer; import org.springframework.core.ParameterNameDiscoverer; import org.springframework.expression.EvaluationContext; import org.springframework.expression.Expression; @@ -20,6 +19,7 @@ import org.springframework.security.access.expression.ExpressionUtils; import org.springframework.security.authentication.AuthenticationTrustResolver; import org.springframework.security.authentication.AuthenticationTrustResolverImpl; import org.springframework.security.core.Authentication; +import org.springframework.security.core.parameters.DefaultSecurityParameterNameDiscoverer; import org.springframework.util.Assert; /** @@ -35,7 +35,7 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr protected final Log logger = LogFactory.getLog(getClass()); private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl(); - private ParameterNameDiscoverer parameterNameDiscoverer = new LocalVariableTableParameterNameDiscoverer(); + private ParameterNameDiscoverer parameterNameDiscoverer = new DefaultSecurityParameterNameDiscoverer(); private PermissionCacheOptimizer permissionCacheOptimizer = null; public DefaultMethodSecurityExpressionHandler() { @@ -157,6 +157,10 @@ public class DefaultMethodSecurityExpressionHandler extends AbstractSecurityExpr this.trustResolver = trustResolver; } + /** + * Sets the {@link ParameterNameDiscoverer} to use. The default is {@link DefaultSecurityParameterNameDiscoverer}. + * @param parameterNameDiscoverer + */ public void setParameterNameDiscoverer(ParameterNameDiscoverer parameterNameDiscoverer) { this.parameterNameDiscoverer = parameterNameDiscoverer; } diff --git a/core/src/main/java/org/springframework/security/access/expression/method/MethodSecurityEvaluationContext.java b/core/src/main/java/org/springframework/security/access/expression/method/MethodSecurityEvaluationContext.java index 1be1457bc6..c218f24f90 100644 --- a/core/src/main/java/org/springframework/security/access/expression/method/MethodSecurityEvaluationContext.java +++ b/core/src/main/java/org/springframework/security/access/expression/method/MethodSecurityEvaluationContext.java @@ -7,10 +7,10 @@ import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.springframework.aop.framework.AopProxyUtils; import org.springframework.aop.support.AopUtils; -import org.springframework.core.LocalVariableTableParameterNameDiscoverer; import org.springframework.core.ParameterNameDiscoverer; import org.springframework.expression.spel.support.StandardEvaluationContext; import org.springframework.security.core.Authentication; +import org.springframework.security.core.parameters.DefaultSecurityParameterNameDiscoverer; /** * Internal security-specific EvaluationContext implementation which lazily adds the @@ -33,7 +33,7 @@ class MethodSecurityEvaluationContext extends StandardEvaluationContext { * allowing for caching. */ public MethodSecurityEvaluationContext(Authentication user, MethodInvocation mi) { - this(user, mi, new LocalVariableTableParameterNameDiscoverer()); + this(user, mi, new DefaultSecurityParameterNameDiscoverer()); } public MethodSecurityEvaluationContext(Authentication user, MethodInvocation mi, diff --git a/core/src/main/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscoverer.java b/core/src/main/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscoverer.java new file mode 100644 index 0000000000..db730b9ddf --- /dev/null +++ b/core/src/main/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscoverer.java @@ -0,0 +1,91 @@ +/* + * Copyright 2002-2013 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. You may obtain a copy of + * the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations under + * the License. + */ +package org.springframework.security.core.parameters; + +import java.util.Collections; +import java.util.List; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; +import org.springframework.core.LocalVariableTableParameterNameDiscoverer; +import org.springframework.core.ParameterNameDiscoverer; +import org.springframework.core.PrioritizedParameterNameDiscoverer; +import org.springframework.util.Assert; +import org.springframework.util.ClassUtils; + + +/** + * Spring Security's default {@link ParameterNameDiscoverer} which tries a + * number of {@link ParameterNameDiscoverer} depending on what is found on the + * classpath. + * + * + * + * @author Rob Winch + * @since 3.2 + */ +public class DefaultSecurityParameterNameDiscoverer extends + PrioritizedParameterNameDiscoverer { + + private final Log logger = LogFactory.getLog(getClass()); + + private static final String DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME = + "org.springframework.core.DefaultParameterNameDiscoverer"; + private static final boolean DEFAULT_PARAM_DISCOVERER_PRESENT = + ClassUtils.isPresent(DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME, DefaultSecurityParameterNameDiscoverer.class.getClassLoader()); + + /** + * Creates a new instance with only the default + * {@link ParameterNameDiscoverer} instances. + */ + public DefaultSecurityParameterNameDiscoverer() { + this(Collections.emptyList()); + } + + /** + * Creates a new instance that first tries the passed in {@link ParameterNameDiscoverer} instances. + * @param parameterNameDiscovers the {@link ParameterNameDiscoverer} before trying the defaults. Cannot be null. + */ + @SuppressWarnings("unchecked") + public DefaultSecurityParameterNameDiscoverer(List parameterNameDiscovers) { + Assert.notNull(parameterNameDiscovers, "parameterNameDiscovers cannot be null"); + for(ParameterNameDiscoverer discover : parameterNameDiscovers) { + addDiscoverer(discover); + } + if (DEFAULT_PARAM_DISCOVERER_PRESENT) { + try { + Class paramNameDiscoverClass = (Class) ClassUtils + .forName(DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME, + getClass().getClassLoader()); + addDiscoverer(paramNameDiscoverClass.newInstance()); + } catch (Exception e) { + logger.warn( + "Could not use " + + DEFAULT_PARAMETER_NAME_DISCOVERER_CLASSNAME + + ". Falling back to LocalVariableTableParameterNameDiscoverer.", e); + addDiscoverer(new LocalVariableTableParameterNameDiscoverer()); + } + } else { + addDiscoverer(new LocalVariableTableParameterNameDiscoverer()); + } + } +} \ No newline at end of file diff --git a/core/src/test/java/org/springframework/core/DefaultParameterNameDiscoverer.java b/core/src/test/java/org/springframework/core/DefaultParameterNameDiscoverer.java new file mode 100644 index 0000000000..f6aa132ba8 --- /dev/null +++ b/core/src/test/java/org/springframework/core/DefaultParameterNameDiscoverer.java @@ -0,0 +1,25 @@ +/* + * Copyright 2002-2013 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. You may obtain a copy of + * the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations under + * the License. + */ +package org.springframework.core; + +/** + * + * @author Rob Winch + * + */ +public class DefaultParameterNameDiscoverer extends PrioritizedParameterNameDiscoverer { + +} diff --git a/core/src/test/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscovererTests.java b/core/src/test/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscovererTests.java new file mode 100644 index 0000000000..d0528dc87f --- /dev/null +++ b/core/src/test/java/org/springframework/security/core/parameters/DefaultSecurityParameterNameDiscovererTests.java @@ -0,0 +1,66 @@ +/* + * Copyright 2002-2013 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. You may obtain a copy of + * the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations under + * the License. + */ +package org.springframework.security.core.parameters; + +import static org.fest.assertions.Assertions.assertThat; + +import java.util.Arrays; +import java.util.List; + +import org.junit.Before; +import org.junit.Test; +import org.springframework.core.DefaultParameterNameDiscoverer; +import org.springframework.core.LocalVariableTableParameterNameDiscoverer; +import org.springframework.core.ParameterNameDiscoverer; +import org.springframework.test.util.ReflectionTestUtils; + +/** + * + * @author Rob Winch + * @since 3.2 + */ +@SuppressWarnings("unchecked") +public class DefaultSecurityParameterNameDiscovererTests { + private DefaultSecurityParameterNameDiscoverer discoverer; + + @Before + public void setup() { + discoverer = new DefaultSecurityParameterNameDiscoverer(); + } + + @Test + public void constructorDefault() { + List discoverers = (List) ReflectionTestUtils + .getField(discoverer, "parameterNameDiscoverers"); + assertThat(discoverers.size()).isEqualTo(1); + assertThat(discoverers.get(0)).isInstanceOf( + DefaultParameterNameDiscoverer.class); + } + + @Test + public void constructorDiscoverers() { + discoverer = new DefaultSecurityParameterNameDiscoverer(Arrays.asList(new LocalVariableTableParameterNameDiscoverer())); + + List discoverers = (List) ReflectionTestUtils + .getField(discoverer, "parameterNameDiscoverers"); + + assertThat(discoverers.size()).isEqualTo(2); + assertThat(discoverers.get(0)).isInstanceOf( + LocalVariableTableParameterNameDiscoverer.class); + assertThat(discoverers.get(1)).isInstanceOf( + DefaultParameterNameDiscoverer.class); + } +} \ No newline at end of file