SEC-134 fix. Authorities array is now copied on access. Also refactored token classes to move authorities to the base class.

core/src/test/java/org/acegisecurity/MockRunAsAuthenticationToken.java

@@ -30,6 +30,12 @@ public class MockRunAsAuthenticationToken extends AbstractAuthenticationToken {
 
     private boolean authenticated = false;
 
+    //~ Constructors ===========================================================
+
+    public MockRunAsAuthenticationToken() {
+        super(null);
+    }
+
     //~ Methods ================================================================
 
     public void setAuthenticated(boolean isAuthenticated) {
@@ -40,10 +46,6 @@ public class MockRunAsAuthenticationToken extends AbstractAuthenticationToken {
         return authenticated;
     }
 
-    public GrantedAuthority[] getAuthorities() {
-        return null;
-    }
-
     public Object getCredentials() {
         return null;
     }

core/src/test/java/org/acegisecurity/adapters/AuthByAdapterTests.java

@@ -24,6 +24,8 @@ import org.acegisecurity.GrantedAuthorityImpl;
 
 import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
 
+import java.util.Arrays;
+
 /**
  * Tests {@link AuthByAdapterProvider}
  *
@@ -67,7 +69,7 @@ public class AuthByAdapterTests extends TestCase {
 
         assertEquals(token.getCredentials(), response.getCredentials());
         assertEquals(token.getPrincipal(), response.getPrincipal());
-        assertEquals(token.getAuthorities(), response.getAuthorities());
+        assertTrue(Arrays.equals(token.getAuthorities(), response.getAuthorities()));
 
         if (!response.getClass().equals(token.getClass())) {
             fail("Should have returned same type of object it was given");

core/src/test/java/org/acegisecurity/providers/AbstractAuthenticationTokenTests.java

@@ -148,22 +148,17 @@ public class AbstractAuthenticationTokenTests extends TestCase {
     private class MockAuthenticationImpl extends AbstractAuthenticationToken {
         private Object credentials;
         private Object principal;
-        private GrantedAuthority[] authorities;
         private boolean authenticated = false;
 
         public MockAuthenticationImpl(Object principal, Object credentials,
             GrantedAuthority[] authorities) {
+            super(authorities);
             this.principal = principal;
             this.credentials = credentials;
-            this.authorities = authorities;
         }
 
         private MockAuthenticationImpl() {
-            super();
-        }
-
-        public GrantedAuthority[] getAuthorities() {
-            return this.authorities;
+            super(null);
         }
 
         public Object getCredentials() {

core/src/test/java/org/acegisecurity/providers/TestingAuthenticationTokenTests.java

@@ -19,6 +19,7 @@ import junit.framework.TestCase;
 
 import org.acegisecurity.GrantedAuthority;
 import org.acegisecurity.GrantedAuthorityImpl;
+import org.acegisecurity.providers.rememberme.RememberMeAuthenticationToken;
 
 
 /**
@@ -67,11 +68,13 @@ public class TestingAuthenticationTokenTests extends TestCase {
         assertEquals("ROLE_TWO", token.getAuthorities()[1].getAuthority());
     }
 
-    public void testNoArgConstructor() {
+    public void testNoArgConstructorDoesntExist() {
+        Class clazz = TestingAuthenticationToken.class;
+
         try {
-            new TestingAuthenticationToken();
-            fail("Should have thrown IllegalArgumentException");
-        } catch (IllegalArgumentException expected) {
+            clazz.getDeclaredConstructor((Class[])null);
+            fail("Should have thrown NoSuchMethodException");
+        } catch (NoSuchMethodException expected) {
             assertTrue(true);
         }
     }

core/src/test/java/org/acegisecurity/providers/anonymous/AnonymousAuthenticationTokenTests.java

@@ -20,6 +20,7 @@ import junit.framework.TestCase;
 import org.acegisecurity.GrantedAuthority;
 import org.acegisecurity.GrantedAuthorityImpl;
 import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
+import org.acegisecurity.providers.rememberme.RememberMeAuthenticationToken;
 
 import java.util.List;
 import java.util.Vector;
@@ -126,11 +127,13 @@ public class AnonymousAuthenticationTokenTests extends TestCase {
         assertTrue(token.isAuthenticated());
     }
 
-    public void testNoArgConstructor() {
+    public void testNoArgConstructorDoesntExist() {
+        Class clazz = AnonymousAuthenticationToken.class;
+
         try {
-            new AnonymousAuthenticationToken();
-            fail("Should have thrown IllegalArgumentException");
-        } catch (IllegalArgumentException expected) {
+            clazz.getDeclaredConstructor((Class[])null);
+            fail("Should have thrown NoSuchMethodException");
+        } catch (NoSuchMethodException expected) {
             assertTrue(true);
         }
     }

core/src/test/java/org/acegisecurity/providers/cas/CasAuthenticationTokenTests.java

@@ -178,11 +178,13 @@ public class CasAuthenticationTokenTests extends TestCase {
             token.getUserDetails().getUsername());
     }
 
-    public void testNoArgConstructor() {
+    public void testNoArgConstructorDoesntExist() {
+        Class clazz = CasAuthenticationToken.class;
+
         try {
-            new CasAuthenticationToken();
-            fail("Should have thrown IllegalArgumentException");
-        } catch (IllegalArgumentException expected) {
+            clazz.getDeclaredConstructor((Class[])null);
+            fail("Should have thrown NoSuchMethodException");
+        } catch (NoSuchMethodException expected) {
             assertTrue(true);
         }
     }

core/src/test/java/org/acegisecurity/providers/rememberme/RememberMeAuthenticationTokenTests.java

@@ -126,11 +126,13 @@ public class RememberMeAuthenticationTokenTests extends TestCase {
         assertTrue(token.isAuthenticated());
     }
 
-    public void testNoArgConstructor() {
+    public void testNoArgConstructorDoesntExist() {
+        Class clazz = RememberMeAuthenticationToken.class;
+
         try {
-            new RememberMeAuthenticationToken();
-            fail("Should have thrown IllegalArgumentException");
-        } catch (IllegalArgumentException expected) {
+            clazz.getDeclaredConstructor((Class[])null);
+            fail("Should have thrown NoSuchMethodException");
+        } catch (NoSuchMethodException expected) {
             assertTrue(true);
         }
     }

core/src/test/java/org/acegisecurity/runas/RunAsUserTokenTests.java

@@ -71,11 +71,14 @@ public class RunAsUserTokenTests extends TestCase {
             token.getOriginalAuthentication());
     }
 
-    public void testNoArgsConstructor() {
+
+    public void testNoArgConstructorDoesntExist() {
+        Class clazz = RunAsUserToken.class;
+
         try {
-            new RunAsUserToken();
-            fail("Should have thrown IllegalArgumentException");
-        } catch (IllegalArgumentException expected) {
+            clazz.getDeclaredConstructor((Class[])null);
+            fail("Should have thrown NoSuchMethodException");
+        } catch (NoSuchMethodException expected) {
             assertTrue(true);
         }
     }