org.springframework.lang.Nullable is banned by the
bannedNullabilityImports checkstyle rule on this line; the embargoed
commit that introduced this file predates that rule's adoption here.
Switch to org.jspecify.annotations.Nullable to match the rest of the
codebase (already used correctly elsewhere in this same file).
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Previously, ExternalInetAddressMatcher treated a null InetAddress
as external by negating InternalInetAddressMatcher's result.
This commit makes ExternalInetAddressMatcher return false for a
null address, so that neither the internal nor the external
matcher classifies an unknown address as a match.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit adds a constant-time equals method,
useful for comparing password hashes or other
sensitive material
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
The null check in setPostAuthenticationChecks of
AbstractUserDetailsReactiveAuthenticationManager asserted the current
field value, which is initialized to a default and can never be null,
instead of the method parameter. As a result, null was silently
accepted and the next authenticate call failed with a raw
NullPointerException instead of failing fast with a clear message.
Closes gh-19276
Signed-off-by: dae won <eodnjs01477@gmail.com>
Verify that <cors> detects a PreFlightRequestHandler bean and uses a
PreFlightRequestFilter when no explicit ref or
configuration-source-ref is given and no mvcHandlerMappingIntrospector
bean is present.
See gh-19542
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Spring Framework 7.1 deprecates RestTemplate and related types for
removal. Suppress the resulting warnings at existing internal usage
sites until they are migrated to RestClient per gh-19027.
Closes gh-19544
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Spring Framework 7.1 removes HandlerMappingIntrospector-derived
implicit CORS handling for plain requests; these tests assert the
old behavior.
Closes gh-19543
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Add CorsFilterFactoryBean so the <cors> XML element can detect a
CorsConfigurationSource or PreFlightRequestHandler bean implicitly,
matching CorsConfigurer's existing Java config behavior.
Closes gh-19542
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Spring Framework's HttpMethod#valueOf now normalizes casing, so
StrictServerWebExchangeFirewall no longer detects a non-canonical-case
HTTP method as distinct from its canonical form.
Closes gh-19541
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
InMemoryUserDetailsManager keys its user map on the lower-cased
username everywhere except changePassword, which looked the current
user up with the raw name. A user whose username contains uppercase
letters could therefore not change its password. Lower-case the
lookup key to match the rest of the class.
Closes gh-19336
Signed-off-by: junhyeong9812 <pickjog@gmail.com>
StandardEvaluationContext.setBeanResolver now accepts a nullable
BeanResolver, so the workarounds added for the original limitation
are no longer needed. This removes the explicit null guards (and
equivalent Optional.ofNullable idiom) as well as the
@SuppressWarnings("NullAway") annotations introduced to silence
the false positives.
In addition to the seven sites that explicitly referenced
spring-projects/spring-framework#35371, two sites in
spring-security-core followed the same workaround pattern without
the comment marker (AbstractSecurityExpressionHandler and
DefaultMethodSecurityExpressionHandler) and have also been
simplified.
Closes gh-17816
Signed-off-by: Kim Tae Eun <snowykte0426@naver.com>
Add the same opt-in UserDetailsChecker support to
OneTimeTokenReactiveAuthenticationManager, mirroring
OneTimeTokenAuthenticationProvider for the reactive stack.
Issue gh-17655
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
OneTimeTokenAuthenticationProvider no longer validates account status
by default. Applications can opt in via setUserDetailsChecker, for
example by providing AccountStatusUserDetailsChecker to reject locked,
disabled, or expired accounts.
Issue gh-17655
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
The main problem is that OneTimeTokenAuthenticationProvider does not
extend from AbstractUserDetailsAuthenticationProvider, which has a
preauthentication check for user details. However, we do not need to
extend from it because it does not fit the context of the class. In this
regard, I decided to add my own checker to this commit, which performs a
preauthentication check before authorizing the account, similar to how
it is done in AbstractUserDetailsAuthenticationProvider. I also added a
test to OneTimeTokenAuthenticationProviderTests that identifies this
problem.
Closes gh-17655
Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
Replace deprecated `UriComponentsBuilder` usage and renamed
`oneTimeTokenLogin` DSL method references in the docs with their
current equivalents.
Closes gh-18367
Signed-off-by: Arz Meow <arthur37231@gmail.com>
Josh Cummings