Release 5.5.6

Closes gh-11139

buildSrc/build.gradle

@@ -72,7 +72,7 @@ dependencies {
 	implementation localGroovy()
 
 	implementation 'io.github.gradle-nexus:publish-plugin:1.1.0'
-	implementation 'io.projectreactor:reactor-core:3.4.15'
+	implementation 'io.projectreactor:reactor-core:3.4.17'
 	implementation 'gradle.plugin.org.gretty:gretty:3.0.1'
 	implementation 'com.apollographql.apollo:apollo-runtime:2.4.5'
 	implementation 'com.github.ben-manes:gradle-versions-plugin:0.38.0'

config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java

@@ -223,7 +223,7 @@ public class Saml2LoginConfigurerTests {
 	public void authenticateWithInvalidDeflatedSAMLResponseThenFailureHandlerUses() throws Exception {
 		this.spring.register(CustomAuthenticationFailureHandler.class).autowire();
 		byte[] invalidDeflated = "invalid".getBytes();
-		String encoded = Saml2Utils.samlEncode(invalidDeflated);
+		String encoded = Saml2Utils.samlEncodeNotRfc2045(invalidDeflated);
 		MockHttpServletRequestBuilder request = get("/login/saml2/sso/registration-id").queryParam("SAMLResponse",
 				encoded);
 		this.mvc.perform(request);

dependencies/spring-security-dependencies.gradle

@@ -8,14 +8,14 @@ javaPlatform {
 
 dependencies {
 	api platform("org.springframework:spring-framework-bom:$springFrameworkVersion")
-	api platform("io.projectreactor:reactor-bom:2020.0.16")
-	api platform("io.rsocket:rsocket-bom:1.1.1")
-	api platform("org.springframework.data:spring-data-bom:2021.0.9")
+	api platform("io.projectreactor:reactor-bom:2020.0.18")
+	api platform("io.rsocket:rsocket-bom:1.1.2")
+	api platform("org.springframework.data:spring-data-bom:2021.0.10")
 	api platform("org.jetbrains.kotlin:kotlin-bom:$kotlinVersion")
 	api platform("org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.5.2")
-	api platform("com.fasterxml.jackson:jackson-bom:2.12.6")
+	api platform("com.fasterxml.jackson:jackson-bom:2.12.6.20220326")
 	constraints {
-		api "ch.qos.logback:logback-classic:1.2.10"
+		api "ch.qos.logback:logback-classic:1.2.11"
 		api "com.google.inject:guice:3.0"
 		api "com.nimbusds:nimbus-jose-jwt:9.10.1"
 		api "com.nimbusds:oauth2-oidc-sdk:9.9.1"
@@ -49,8 +49,8 @@ dependencies {
 		api "org.assertj:assertj-core:3.19.0"
 		api "org.bouncycastle:bcpkix-jdk15on:1.68"
 		api "org.bouncycastle:bcprov-jdk15on:1.68"
-		api "org.eclipse.jetty:jetty-server:9.4.45.v20220203"
-		api "org.eclipse.jetty:jetty-servlet:9.4.45.v20220203"
+		api "org.eclipse.jetty:jetty-server:9.4.46.v20220331"
+		api "org.eclipse.jetty:jetty-servlet:9.4.46.v20220331"
 		api "org.eclipse.persistence:javax.persistence:2.2.1"
 		api "org.hibernate:hibernate-entitymanager:5.4.33"
 		api "org.hsqldb:hsqldb:2.6.1"
@@ -74,7 +74,7 @@ dependencies {
 		api "org.slf4j:jcl-over-slf4j:1.7.36"
 		api "org.slf4j:log4j-over-slf4j:1.7.36"
 		api "org.slf4j:slf4j-api:1.7.36"
-		api "org.springframework.ldap:spring-ldap-core:2.3.6.RELEASE"
+		api "org.springframework.ldap:spring-ldap-core:2.3.7.RELEASE"
 		api "org.synchronoss.cloud:nio-multipart-parser:1.1.0"
 	}
 }

docs/manual/src/docs/asciidoc/_includes/servlet/crypto/index.adoc

@@ -198,10 +198,13 @@ The password package of the spring-security-crypto module provides support for e
 [source,java]
 ----
 public interface PasswordEncoder {
+	String encode(CharSequence rawPassword);
 
-String encode(String rawPassword);
+	boolean matches(CharSequence rawPassword, String encodedPassword);
 
-boolean matches(String rawPassword, String encodedPassword);
+	default boolean upgradeEncoding(String encodedPassword) {
+		return false;
+	}
 }
 ----
 

gradle.properties

@@ -1,9 +1,9 @@
-aspectjVersion=1.9.8
+aspectjVersion=1.9.9.1
 springJavaformatVersion=0.0.31
 springBootVersion=2.4.2
-springFrameworkVersion=5.3.16
+springFrameworkVersion=5.3.19
 openSamlVersion=3.4.6
-version=5.5.5
+version=5.5.6
 kotlinVersion=1.5.32
 samplesBranch=5.5.x
 org.gradle.jvmargs=-Xmx3g -XX:MaxPermSize=2048m -XX:+HeapDumpOnOutOfMemoryError

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Utils.java

@@ -19,13 +19,12 @@ package org.springframework.security.saml2.provider.service.authentication;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.util.Base64;
 import java.util.zip.Deflater;
 import java.util.zip.DeflaterOutputStream;
 import java.util.zip.Inflater;
 import java.util.zip.InflaterOutputStream;
 
-import org.apache.commons.codec.binary.Base64;
-
 import org.springframework.security.saml2.Saml2Exception;
 
 /**
@@ -33,17 +32,15 @@ import org.springframework.security.saml2.Saml2Exception;
  */
 final class Saml2Utils {
 
-	private static Base64 BASE64 = new Base64(0, new byte[] { '\n' });
-
 	private Saml2Utils() {
 	}
 
 	static String samlEncode(byte[] b) {
-		return BASE64.encodeAsString(b);
+		return Base64.getMimeEncoder().encodeToString(b);
 	}
 
 	static byte[] samlDecode(String s) {
-		return BASE64.decode(s);
+		return Base64.getMimeDecoder().decode(s);
 	}
 
 	static byte[] samlDeflate(String s) {

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/RelyingPartyRegistration.java

@@ -21,7 +21,7 @@ import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
-import java.util.HashSet;
+import java.util.LinkedHashSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Set;
@@ -383,7 +383,7 @@ public final class RelyingPartyRegistration {
 			org.springframework.security.saml2.credentials.Saml2X509Credential credential) {
 		PrivateKey privateKey = credential.getPrivateKey();
 		X509Certificate certificate = credential.getCertificate();
-		Set<Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new HashSet<>();
+		Set<Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new LinkedHashSet<>();
 		if (credential.isSigningCredential()) {
 			credentialTypes.add(Saml2X509Credential.Saml2X509CredentialType.SIGNING);
 		}
@@ -403,7 +403,7 @@ public final class RelyingPartyRegistration {
 			Saml2X509Credential credential) {
 		PrivateKey privateKey = credential.getPrivateKey();
 		X509Certificate certificate = credential.getCertificate();
-		Set<org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new HashSet<>();
+		Set<org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new LinkedHashSet<>();
 		if (credential.isSigningCredential()) {
 			credentialTypes.add(
 					org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.SIGNING);
@@ -573,9 +573,9 @@ public final class RelyingPartyRegistration {
 
 			private List<String> signingAlgorithms = new ArrayList<>();
 
-			private Collection<Saml2X509Credential> verificationX509Credentials = new HashSet<>();
+			private Collection<Saml2X509Credential> verificationX509Credentials = new LinkedHashSet<>();
 
-			private Collection<Saml2X509Credential> encryptionX509Credentials = new HashSet<>();
+			private Collection<Saml2X509Credential> encryptionX509Credentials = new LinkedHashSet<>();
 
 			private String singleSignOnServiceLocation;
 
@@ -822,9 +822,9 @@ public final class RelyingPartyRegistration {
 
 		private String entityId = "{baseUrl}/saml2/service-provider-metadata/{registrationId}";
 
-		private Collection<Saml2X509Credential> signingX509Credentials = new HashSet<>();
+		private Collection<Saml2X509Credential> signingX509Credentials = new LinkedHashSet<>();
 
-		private Collection<Saml2X509Credential> decryptionX509Credentials = new HashSet<>();
+		private Collection<Saml2X509Credential> decryptionX509Credentials = new LinkedHashSet<>();
 
 		private String assertionConsumerServiceLocation = "{baseUrl}/login/saml2/sso/{registrationId}";
 
@@ -832,7 +832,7 @@ public final class RelyingPartyRegistration {
 
 		private ProviderDetails.Builder providerDetails = new ProviderDetails.Builder();
 
-		private Collection<org.springframework.security.saml2.credentials.Saml2X509Credential> credentials = new HashSet<>();
+		private Collection<org.springframework.security.saml2.credentials.Saml2X509Credential> credentials = new LinkedHashSet<>();
 
 		private Builder(String registrationId) {
 			this.registrationId = registrationId;

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/core/Saml2Utils.java

@@ -19,28 +19,30 @@ package org.springframework.security.saml2.core;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.util.Base64;
 import java.util.zip.Deflater;
 import java.util.zip.DeflaterOutputStream;
 import java.util.zip.Inflater;
 import java.util.zip.InflaterOutputStream;
 
-import org.apache.commons.codec.binary.Base64;
-
 import org.springframework.security.saml2.Saml2Exception;
 
 public final class Saml2Utils {
 
-	private static Base64 BASE64 = new Base64(0, new byte[] { '\n' });
-
 	private Saml2Utils() {
 	}
 
+	@Deprecated
+	public static String samlEncodeNotRfc2045(byte[] b) {
+		return Base64.getEncoder().encodeToString(b);
+	}
+
 	public static String samlEncode(byte[] b) {
-		return BASE64.encodeAsString(b);
+		return Base64.getMimeEncoder().encodeToString(b);
 	}
 
 	public static byte[] samlDecode(String s) {
-		return BASE64.decode(s);
+		return Base64.getMimeDecoder().decode(s);
 	}
 
 	public static byte[] samlDeflate(String s) {

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/core/TestSaml2X509Credentials.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -51,6 +51,10 @@ public final class TestSaml2X509Credentials {
 		return new Saml2X509Credential(idpCertificate(), Saml2X509CredentialType.VERIFICATION);
 	}
 
+	public static Saml2X509Credential relyingPartyEncryptingCredential() {
+		return new Saml2X509Credential(idpCertificate(), Saml2X509CredentialType.ENCRYPTION);
+	}
+
 	public static Saml2X509Credential relyingPartySigningCredential() {
 		return new Saml2X509Credential(spPrivateKey(), spCertificate(), Saml2X509CredentialType.SIGNING);
 	}
@@ -59,6 +63,16 @@ public final class TestSaml2X509Credentials {
 		return new Saml2X509Credential(spPrivateKey(), spCertificate(), Saml2X509CredentialType.DECRYPTION);
 	}
 
+	public static Saml2X509Credential altPublicCredential() {
+		return new Saml2X509Credential(altCertificate(), Saml2X509CredentialType.VERIFICATION,
+				Saml2X509CredentialType.ENCRYPTION);
+	}
+
+	public static Saml2X509Credential altPrivateCredential() {
+		return new Saml2X509Credential(altPrivateKey(), altCertificate(), Saml2X509CredentialType.SIGNING,
+				Saml2X509CredentialType.DECRYPTION);
+	}
+
 	private static X509Certificate certificate(String cert) {
 		ByteArrayInputStream certBytes = new ByteArrayInputStream(cert.getBytes());
 		try {
@@ -170,4 +184,40 @@ public final class TestSaml2X509Credentials {
 						+ "-----END PRIVATE KEY-----");
 	}
 
+	private static X509Certificate altCertificate() {
+		return certificate(
+				"-----BEGIN CERTIFICATE-----\n" + "MIICkDCCAfkCFEstVfmWSFQp/j88GaMUwqVK72adMA0GCSqGSIb3DQEBCwUAMIGG\n"
+						+ "MQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjESMBAGA1UEBwwJVmFu\n"
+						+ "Y291dmVyMR0wGwYDVQQKDBRTcHJpbmcgU2VjdXJpdHkgU0FNTDEMMAoGA1UECwwD\n"
+						+ "YWx0MSEwHwYDVQQDDBhhbHQuc3ByaW5nLnNlY3VyaXR5LnNhbWwwHhcNMjIwMjEw\n"
+						+ "MTY1ODA4WhcNMzIwMjEwMTY1ODA4WjCBhjELMAkGA1UEBhMCVVMxEzARBgNVBAgM\n"
+						+ "Cldhc2hpbmd0b24xEjAQBgNVBAcMCVZhbmNvdXZlcjEdMBsGA1UECgwUU3ByaW5n\n"
+						+ "IFNlY3VyaXR5IFNBTUwxDDAKBgNVBAsMA2FsdDEhMB8GA1UEAwwYYWx0LnNwcmlu\n"
+						+ "Zy5zZWN1cml0eS5zYW1sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9ZGWj\n"
+						+ "TPDsymQCJL044py4xLsBI/S9RvzNeR9oD/tHyoxCE+YZzjf0PyBtwqKzkKWqCPf4\n"
+						+ "XGUYHfEpkM5kJYwCW8TsOx5fnwLIQweiPqjYrBr/O0IjHMqYG9HlR/ros7iBt4ab\n"
+						+ "EGUu/B9yYg1YRYPxKQ6TNP3AD+9tBT8TsFFyjwIDAQABMA0GCSqGSIb3DQEBCwUA\n"
+						+ "A4GBAKJf2VHLjkCHRxlbWn63jGiquq3ENYgd1JS0DZ3ggFmuc6zQiqxzRGtArIDZ\n"
+						+ "0jH5nrG0jcvO0fqDqBQh0iT8thfUnkViAQvACZ9a+0x0NzUicJ+Ra51c8Z2enqbg\n"
+						+ "pXy+ga67HcAXrDekm1MCGCgiEb/Cgl41lsideqhC8Efl7PRN\n" + "-----END CERTIFICATE-----");
+	}
+
+	private static PrivateKey altPrivateKey() {
+		return privateKey(
+				"-----BEGIN PRIVATE KEY-----\n" + "MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAL1kZaNM8OzKZAIk\n"
+						+ "vTjinLjEuwEj9L1G/M15H2gP+0fKjEIT5hnON/Q/IG3CorOQpaoI9/hcZRgd8SmQ\n"
+						+ "zmQljAJbxOw7Hl+fAshDB6I+qNisGv87QiMcypgb0eVH+uizuIG3hpsQZS78H3Ji\n"
+						+ "DVhFg/EpDpM0/cAP720FPxOwUXKPAgMBAAECgYEApYKslAZ0cer5dSoYNzNLFOnQ\n"
+						+ "J1H92r/Dw+k6+h0lUvr+keyD5T9jhM76DxHOUDBzpmIKGoDcVDQugk2rILfzXsQA\n"
+						+ "JtwvDRJk32Z02Vt0jb7t/WUOOQhjKCjQuv9/tOx90GCl0VxYG69UOjaMRWrlg/i9\n"
+						+ "6/zcTRIahIn5XxF0psECQQD7ivJCpDbOLJGsc8gNJR4cvjZ1q0mHIOrbKqJC0y1n\n"
+						+ "5DrzGEflPeyCUwnOKNp9HJQP8gmZzXfj0JM9KsjpiUChAkEAwL+FmhDoTiqStIrH\n"
+						+ "h9Kdnsev//imMmRHxjwDhntYvqavUsISRmY3imd8inoYq5dzWQMzBtoTyMRmqeLT\n"
+						+ "DHV1LwJAW4xaV37Eo4z9B7Kr4Hzd1MA1ueW5QQDt+Q4vN/r7z4/1FHyFzh0Xcucd\n"
+						+ "7nZX7qj0CkmgzOVG+Rb0P5LOxJA7gQJBAK1KQ2qNct375qPM9bEGSVGchH6k5X7+\n"
+						+ "q4ztHdpFgTb/EzdbZiTG935GpjC1rwJuinTnrHOnkwv4j7iDRm24GF8CQQDqPvrQ\n"
+						+ "GcItR6UUy0q/B8UxLzlE6t+HiznfiJKfyGgCHU56Y4/ZhzSQz2MZHz9SK4DsUL9s\n" + "bOYrWq8VY2fyjV1t\n"
+						+ "-----END PRIVATE KEY-----");
+	}
+
 }

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/registration/RelyingPartyRegistrationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,8 @@ package org.springframework.security.saml2.provider.service.registration;
 
 import org.junit.Test;
 
-import org.springframework.security.saml2.credentials.TestSaml2X509Credentials;
+import org.springframework.security.saml2.core.Saml2X509Credential;
+import org.springframework.security.saml2.core.TestSaml2X509Credentials;
 import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -81,9 +82,68 @@ public class RelyingPartyRegistrationTests {
 		RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistration.withRegistrationId("id")
 				.entityId("entity-id").assertionConsumerServiceLocation("location")
 				.assertingPartyDetails((assertingParty) -> assertingParty.entityId("entity-id")
-						.singleSignOnServiceLocation("location"))
-				.credentials((c) -> c.add(TestSaml2X509Credentials.relyingPartyVerifyingCredential())).build();
+						.singleSignOnServiceLocation("location").verificationX509Credentials(
+								(c) -> c.add(TestSaml2X509Credentials.relyingPartyVerifyingCredential())))
+				.build();
 		assertThat(relyingPartyRegistration.getAssertionConsumerServiceBinding()).isEqualTo(Saml2MessageBinding.POST);
 	}
 
+	@Test
+	public void buildPreservesCredentialsOrder() {
+		Saml2X509Credential altRpCredential = TestSaml2X509Credentials.altPrivateCredential();
+		Saml2X509Credential altApCredential = TestSaml2X509Credentials.altPublicCredential();
+		Saml2X509Credential verifyingCredential = TestSaml2X509Credentials.relyingPartyVerifyingCredential();
+		Saml2X509Credential encryptingCredential = TestSaml2X509Credentials.relyingPartyEncryptingCredential();
+		Saml2X509Credential signingCredential = TestSaml2X509Credentials.relyingPartySigningCredential();
+		Saml2X509Credential decryptionCredential = TestSaml2X509Credentials.relyingPartyDecryptingCredential();
+
+		// Test with the alt credentials first
+		RelyingPartyRegistration relyingPartyRegistration = TestRelyingPartyRegistrations.noCredentials()
+				.assertingPartyDetails((assertingParty) -> assertingParty.verificationX509Credentials((c) -> {
+					c.add(altApCredential);
+					c.add(verifyingCredential);
+				}).encryptionX509Credentials((c) -> {
+					c.add(altApCredential);
+					c.add(encryptingCredential);
+				})).signingX509Credentials((c) -> {
+					c.add(altRpCredential);
+					c.add(signingCredential);
+				}).decryptionX509Credentials((c) -> {
+					c.add(altRpCredential);
+					c.add(decryptionCredential);
+				}).build();
+		assertThat(relyingPartyRegistration.getSigningX509Credentials()).containsExactly(altRpCredential,
+				signingCredential);
+		assertThat(relyingPartyRegistration.getDecryptionX509Credentials()).containsExactly(altRpCredential,
+				decryptionCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getVerificationX509Credentials())
+				.containsExactly(altApCredential, verifyingCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getEncryptionX509Credentials())
+				.containsExactly(altApCredential, encryptingCredential);
+
+		// Test with the alt credentials last
+		relyingPartyRegistration = TestRelyingPartyRegistrations.noCredentials()
+				.assertingPartyDetails((assertingParty) -> assertingParty.verificationX509Credentials((c) -> {
+					c.add(verifyingCredential);
+					c.add(altApCredential);
+				}).encryptionX509Credentials((c) -> {
+					c.add(encryptingCredential);
+					c.add(altApCredential);
+				})).signingX509Credentials((c) -> {
+					c.add(signingCredential);
+					c.add(altRpCredential);
+				}).decryptionX509Credentials((c) -> {
+					c.add(decryptionCredential);
+					c.add(altRpCredential);
+				}).build();
+		assertThat(relyingPartyRegistration.getSigningX509Credentials()).containsExactly(signingCredential,
+				altRpCredential);
+		assertThat(relyingPartyRegistration.getDecryptionX509Credentials()).containsExactly(decryptionCredential,
+				altRpCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getVerificationX509Credentials())
+				.containsExactly(verifyingCredential, altApCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getEncryptionX509Credentials())
+				.containsExactly(encryptingCredential, altApCredential);
+	}
+
 }

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/Saml2AuthenticationTokenConverterTests.java

@@ -60,7 +60,8 @@ public class Saml2AuthenticationTokenConverterTests {
 		given(this.relyingPartyRegistrationResolver.convert(any(HttpServletRequest.class)))
 				.willReturn(this.relyingPartyRegistration);
 		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.setParameter("SAMLResponse", Saml2Utils.samlEncode("response".getBytes(StandardCharsets.UTF_8)));
+		request.setParameter("SAMLResponse",
+				Saml2Utils.samlEncodeNotRfc2045("response".getBytes(StandardCharsets.UTF_8)));
 		Saml2AuthenticationToken token = converter.convert(request);
 		assertThat(token.getSaml2Response()).isEqualTo("response");
 		assertThat(token.getRelyingPartyRegistration().getRegistrationId())
@@ -111,7 +112,7 @@ public class Saml2AuthenticationTokenConverterTests {
 		MockHttpServletRequest request = new MockHttpServletRequest();
 		request.setMethod("GET");
 		byte[] deflated = Saml2Utils.samlDeflate("response");
-		String encoded = Saml2Utils.samlEncode(deflated);
+		String encoded = Saml2Utils.samlEncodeNotRfc2045(deflated);
 		request.setParameter("SAMLResponse", encoded);
 		Saml2AuthenticationToken token = converter.convert(request);
 		assertThat(token.getSaml2Response()).isEqualTo("response");

web/src/main/java/org/springframework/security/web/access/AuthorizationManagerWebInvocationPrivilegeEvaluator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 
 package org.springframework.security.web.access;
 
+import javax.servlet.ServletContext;
 import javax.servlet.http.HttpServletRequest;
 
 import org.springframework.security.authorization.AuthorizationDecision;
@@ -23,6 +24,7 @@ import org.springframework.security.authorization.AuthorizationManager;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;
 import org.springframework.util.Assert;
+import org.springframework.web.context.ServletContextAware;
 
 /**
  * An implementation of {@link WebInvocationPrivilegeEvaluator} which delegates the checks
@@ -31,10 +33,13 @@ import org.springframework.util.Assert;
  * @author Marcus Da Coregio
  * @since 5.5.5
  */
-public final class AuthorizationManagerWebInvocationPrivilegeEvaluator implements WebInvocationPrivilegeEvaluator {
+public final class AuthorizationManagerWebInvocationPrivilegeEvaluator
+		implements WebInvocationPrivilegeEvaluator, ServletContextAware {
 
 	private final AuthorizationManager<HttpServletRequest> authorizationManager;
 
+	private ServletContext servletContext;
+
 	public AuthorizationManagerWebInvocationPrivilegeEvaluator(
 			AuthorizationManager<HttpServletRequest> authorizationManager) {
 		Assert.notNull(authorizationManager, "authorizationManager cannot be null");
@@ -48,10 +53,15 @@ public final class AuthorizationManagerWebInvocationPrivilegeEvaluator implement
 
 	@Override
 	public boolean isAllowed(String contextPath, String uri, String method, Authentication authentication) {
-		FilterInvocation filterInvocation = new FilterInvocation(contextPath, uri, method);
+		FilterInvocation filterInvocation = new FilterInvocation(contextPath, uri, method, this.servletContext);
 		AuthorizationDecision decision = this.authorizationManager.check(() -> authentication,
 				filterInvocation.getHttpRequest());
-		return decision != null && decision.isGranted();
+		return decision == null || decision.isGranted();
+	}
+
+	@Override
+	public void setServletContext(ServletContext servletContext) {
+		this.servletContext = servletContext;
 	}
 
 }

web/src/test/java/org/springframework/security/web/access/AuthorizationManagerWebInvocationPrivilegeEvaluatorTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,14 +16,17 @@
 
 package org.springframework.security.web.access;
 
+import javax.servlet.ServletContext;
 import javax.servlet.http.HttpServletRequest;
 
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.MockitoJUnitRunner;
 
+import org.springframework.mock.web.MockServletContext;
 import org.springframework.security.authentication.TestAuthentication;
 import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.authorization.AuthorizationManager;
@@ -65,4 +68,21 @@ public class AuthorizationManagerWebInvocationPrivilegeEvaluatorTests {
 		assertThat(allowed).isFalse();
 	}
 
+	@Test
+	public void isAllowedWhenAuthorizationManagerAbstainsThenAllowedTrue() {
+		given(this.authorizationManager.check(any(), any())).willReturn(null);
+		boolean allowed = this.privilegeEvaluator.isAllowed("/test", TestAuthentication.authenticatedUser());
+		assertThat(allowed).isTrue();
+	}
+
+	@Test
+	public void isAllowedWhenServletContextExistsThenFilterInvocationHasServletContext() {
+		ServletContext servletContext = new MockServletContext();
+		this.privilegeEvaluator.setServletContext(servletContext);
+		this.privilegeEvaluator.isAllowed("/test", TestAuthentication.authenticatedUser());
+		ArgumentCaptor<HttpServletRequest> captor = ArgumentCaptor.forClass(HttpServletRequest.class);
+		verify(this.authorizationManager).check(any(), captor.capture());
+		assertThat(captor.getValue().getServletContext()).isSameAs(servletContext);
+	}
+
 }