Release 7.1.1

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>

.github/dependabot.yml

@@ -4,6 +4,52 @@ registries:
     type: maven-repository
     url: https://build.shibboleth.net/maven/releases
 updates:
+  # 6.5.x
+  - package-ecosystem: gradle
+    target-branch: 6.5.x
+    directory: /
+    schedule:
+      interval: daily
+      time: '03:00'
+      timezone: Etc/UTC
+    labels:
+      - 'type: dependency-upgrade'
+      - 'in: build'
+    registries:
+      - shibboleth
+    ignore:
+      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: org.python:jython
+      - dependency-name: org.apache.directory.server:*
+      - dependency-name: org.apache.directory.shared:*
+      - dependency-name: org.junit:junit-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: org.mockito:mockito-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+  - package-ecosystem: npm
+    target-branch: 6.5.x
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
+  - package-ecosystem: github-actions
+    target-branch: 6.5.x
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
 
   # 7.0.x
   - package-ecosystem: gradle
@@ -57,57 +103,6 @@ updates:
       - 'type: dependency-upgrade'
       - 'in: build'
 
-  # 7.1.x
-  - package-ecosystem: gradle
-    target-branch: 7.1.x
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-      - 'in: build'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: com.gradle.enterprise
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-  - package-ecosystem: npm
-    target-branch: 7.1.x
-    directory: /docs
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: 7.1.x
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-
   # main
   - package-ecosystem: gradle
     target-branch: main

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -94,7 +94,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 	public BeanDefinition parse(Element element, ParserContext pc) {
 		if (!namespaceMatchesVersion(element)) {
 			pc.getReaderContext()
-				.fatal("You cannot use any XSD older than spring-security-7.2.xsd. Either change to spring-security.xsd or spring-security-7.2.xsd",
+				.fatal("You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd",
 						element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
@@ -219,7 +219,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 
 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-7\\.2.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-7\\.1.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutHandler.java

@@ -63,7 +63,6 @@ public final class OidcBackChannelLogoutHandler implements LogoutHandler {
 
 	private final OidcSessionRegistry sessionRegistry;
 
-	@SuppressWarnings("removal")
 	private RestOperations restOperations = new RestTemplate();
 
 	private String logoutUri = "{baseUrl}/logout/connect/back-channel/{registrationId}";

config/src/main/java/org/springframework/security/config/http/CorsBeanDefinitionParser.java

@@ -47,10 +47,6 @@ public class CorsBeanDefinitionParser {
 		if (StringUtils.hasText(filterRef)) {
 			return new RuntimeBeanReference(filterRef);
 		}
-		String configurationSourceRef = element.getAttribute(ATT_SOURCE);
-		if (!StringUtils.hasText(configurationSourceRef)) {
-			return new RootBeanDefinition(CorsFilterFactoryBean.class);
-		}
 		BeanMetadataElement configurationSource = getSource(element, parserContext);
 		if (configurationSource == null) {
 			throw new BeanCreationException("Could not create CorsFilter");

config/src/main/java/org/springframework/security/config/http/CorsFilterFactoryBean.java

@@ -1,68 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.http;
-
-import jakarta.servlet.Filter;
-
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.FactoryBean;
-import org.springframework.beans.factory.NoSuchBeanDefinitionException;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.lang.Nullable;
-import org.springframework.web.cors.CorsConfigurationSource;
-import org.springframework.web.cors.PreFlightRequestHandler;
-import org.springframework.web.filter.CorsFilter;
-import org.springframework.web.filter.PreFlightRequestFilter;
-
-class CorsFilterFactoryBean implements FactoryBean<Filter>, ApplicationContextAware {
-
-	private static final String HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector";
-
-	private ApplicationContext context;
-
-	@Override
-	public Filter getObject() {
-		if (this.context.containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {
-			CorsConfigurationSource source = this.context.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
-					CorsConfigurationSource.class);
-			return new CorsFilter(source);
-		}
-		String[] preFlightRequestHandlerNames = this.context.getBeanNamesForType(PreFlightRequestHandler.class);
-		if (preFlightRequestHandlerNames.length == 1) {
-			PreFlightRequestHandler handler = this.context.getBean(PreFlightRequestHandler.class);
-			return new PreFlightRequestFilter(handler);
-		}
-		throw new NoSuchBeanDefinitionException(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME,
-				"A Bean named " + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + " of type "
-						+ CorsConfigurationSource.class.getName()
-						+ " is required to use <cors>. Please ensure Spring Security & Spring "
-						+ "MVC are configured in a shared ApplicationContext.");
-	}
-
-	@Nullable
-	@Override
-	public Class<?> getObjectType() {
-		return Filter.class;
-	}
-
-	@Override
-	public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-		this.context = applicationContext;
-	}
-
-}

config/src/main/resources/META-INF/spring.schemas

@@ -14,9 +14,9 @@
 # limitations under the License.
 #
 
-http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.2.xsd
-http\://www.springframework.org/schema/security/spring-security-7.2.xsd=org/springframework/security/config/spring-security-7.2.xsd
-http\://www.springframework.org/schema/security/spring-security-7.1.xsd=org/springframework/security/config/spring-security-7.1.xsd
+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.1.xsd
+http\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.1.xsd
+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.0.xsd
 http\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.0.xsd
 http\://www.springframework.org/schema/security/spring-security-6.5.xsd=org/springframework/security/config/spring-security-6.5.xsd
 http\://www.springframework.org/schema/security/spring-security-6.4.xsd=org/springframework/security/config/spring-security-6.4.xsd
@@ -44,8 +44,7 @@ http\://www.springframework.org/schema/security/spring-security-2.0.xsd=org/spri
 http\://www.springframework.org/schema/security/spring-security-2.0.1.xsd=org/springframework/security/config/spring-security-2.0.1.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.2.xsd=org/springframework/security/config/spring-security-2.0.2.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.4.xsd=org/springframework/security/config/spring-security-2.0.4.xsd
-https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.2.xsd
-https\://www.springframework.org/schema/security/spring-security-7.2.xsd=org/springframework/security/config/spring-security-7.2.xsd
+https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.1.xsd
 https\://www.springframework.org/schema/security/spring-security-7.1.xsd=org/springframework/security/config/spring-security-7.1.xsd
 https\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.0.xsd
 https\://www.springframework.org/schema/security/spring-security-6.5.xsd=org/springframework/security/config/spring-security-6.5.xsd

config/src/test/java/org/springframework/security/config/SecurityNamespaceHandlerTests.java

@@ -114,7 +114,7 @@ public class SecurityNamespaceHandlerTests {
 					"<user-service id='us'><user name='bob' password='bobspassword' authorities='ROLE_A' /></user-service>",
 					"3.0.3", null))
 			.withMessageContaining(
-					"You cannot use any XSD older than spring-security-7.2.xsd. Either change to spring-security.xsd or spring-security-7.2.xsd");
+					"You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd");
 	}
 
 	// SEC-1868

config/src/test/java/org/springframework/security/config/annotation/web/configurers/CorsConfigurerTests.java

@@ -20,7 +20,6 @@ import java.util.Arrays;
 import java.util.Collections;
 
 import com.google.common.net.HttpHeaders;
-import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 
@@ -76,15 +75,6 @@ public class CorsConfigurerTests {
 							+ "or are publishing a `CorsConfigurationSource` bean.");
 	}
 
-	// FIXME: Spring Framework 7.1 removed HandlerMappingIntrospector, so there is no
-	// longer a CorsConfigurationSource derivable from implicit @CrossOrigin/MVC config,
-	// and PreFlightRequestFilter (the replacement) is a no-op for non-preflight
-	// requests. Per https://github.com/spring-projects/spring-framework/issues/36481,
-	// relying on implicit config for a plain request's CORS headers was "never an
-	// intended way of using HandlerMappingIntrospector" and is not coming back; decide
-	// whether to update this test to require an explicit CorsConfigurationSource bean
-	// (matching the reactive stack's always-explicit model), then re-enable.
-	@Disabled
 	@Test
 	public void getWhenCrossOriginAnnotationThenRespondsWithCorsHeaders() throws Exception {
 		this.spring.register(MvcCorsConfig.class).autowire();
@@ -105,9 +95,6 @@ public class CorsConfigurerTests {
 			.andExpect(header().exists("X-Content-Type-Options"));
 	}
 
-	// FIXME: see FIXME on getWhenCrossOriginAnnotationThenRespondsWithCorsHeaders above;
-	// same root cause (Framework 7.1 removed HandlerMappingIntrospector).
-	@Disabled
 	@Test
 	public void getWhenDefaultsInLambdaAndCrossOriginAnnotationThenRespondsWithCorsHeaders() throws Exception {
 		this.spring.register(MvcCorsInLambdaConfig.class).autowire();

config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java

@@ -182,7 +182,6 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
  * @author Josh Cummings
  * @author Evgeniy Cheban
  */
-@SuppressWarnings("removal")
 @ExtendWith(SpringTestContextExtension.class)
 public class OAuth2ResourceServerConfigurerTests {
 

config/src/test/java/org/springframework/security/config/doc/XsdDocumentedTests.java

@@ -65,7 +65,7 @@ public class XsdDocumentedTests {
 
 	String schema31xDocumentLocation = "org/springframework/security/config/spring-security-3.1.xsd";
 
-	String schemaDocumentLocation = "org/springframework/security/config/spring-security-7.2.xsd";
+	String schemaDocumentLocation = "org/springframework/security/config/spring-security-7.1.xsd";
 
 	XmlSupport xml = new XmlSupport();
 
@@ -151,8 +151,8 @@ public class XsdDocumentedTests {
 				.list((dir, name) -> name.endsWith(".xsd"));
 		// @formatter:on
 		assertThat(schemas.length)
-			.withFailMessage("the count is equal to 30, if not then schemaDocument needs updating")
-			.isEqualTo(30);
+			.withFailMessage("the count is equal to 29, if not then schemaDocument needs updating")
+			.isEqualTo(29);
 	}
 
 	/**

config/src/test/java/org/springframework/security/config/http/HttpCorsConfigTests.java

@@ -18,9 +18,6 @@ package org.springframework.security.config.http;
 
 import java.util.Arrays;
 
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 
@@ -38,7 +35,6 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.cors.PreFlightRequestHandler;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -71,14 +67,6 @@ public class HttpCorsConfigTests {
 					"Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext");
 	}
 
-	// FIXME: Spring Framework 7.1 removed HandlerMappingIntrospector, which this test's
-	// implicit (no configuration-source-ref) <cors/> scenario relied on to add CORS
-	// headers to a plain, non-preflight request before authorization runs. Per
-	// https://github.com/spring-projects/spring-framework/issues/36481, this was "never
-	// an intended way of using HandlerMappingIntrospector" and is not coming back;
-	// decide whether to update this test's expectations (e.g. require an explicit
-	// CorsConfigurationSource bean) or remove the assertion, then re-enable.
-	@Disabled
 	@Test
 	public void getWhenUsingCorsThenDoesSpringSecurityCorsHandshake() throws Exception {
 		this.spring.configLocations(this.xml("WithCors")).autowire();
@@ -118,19 +106,6 @@ public class HttpCorsConfigTests {
 		// @formatter:on
 	}
 
-	@Test
-	public void optionsWhenUsingPreFlightRequestHandlerThenHandlesPreFlightRequest() throws Exception {
-		this.spring.configLocations(this.xml("WithPreFlightRequestHandler")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/").with(this.approved()))
-				.andExpect(header().doesNotExist("X-Pre-Flight"))
-				.andExpect(status().isIAmATeapot());
-		this.mvc.perform(options("/").with(this.preflight()))
-				.andExpect(status().isOk())
-				.andExpect(header().exists("X-Pre-Flight"));
-		// @formatter:on
-	}
-
 	private String xml(String configName) {
 		return CONFIG_LOCATION_PREFIX + "-" + configName + ".xml";
 	}
@@ -183,13 +158,4 @@ public class HttpCorsConfigTests {
 
 	}
 
-	static class MyPreFlightRequestHandler implements PreFlightRequestHandler {
-
-		@Override
-		public void handlePreFlight(HttpServletRequest request, HttpServletResponse response) {
-			response.addHeader("X-Pre-Flight", "Handled");
-		}
-
-	}
-
 }

config/src/test/java/org/springframework/security/config/http/OAuth2ResourceServerBeanDefinitionParserTests.java

@@ -124,7 +124,6 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 /**
  * @author Josh Cummings
  */
-@SuppressWarnings("removal")
 @ExtendWith({ SpringExtension.class, SpringTestContextExtension.class })
 @SecurityTestExecutionListeners
 public class OAuth2ResourceServerBeanDefinitionParserTests {

config/src/test/resources/org/springframework/security/config/http/HttpCorsConfigTests-WithPreFlightRequestHandler.xml

@@ -1,40 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  ~ Copyright 2004-present the original author or authors.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~       https://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<b:beans xmlns:b="http://www.springframework.org/schema/beans"
-		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xmlns="http://www.springframework.org/schema/security"
-		xsi:schemaLocation="
-			http://www.springframework.org/schema/security
-			https://www.springframework.org/schema/security/spring-security.xsd
-			http://www.springframework.org/schema/beans
-			https://www.springframework.org/schema/beans/spring-beans.xsd">
-
-	<http entry-point-ref="ep">
-		<intercept-url pattern="/**" access="authenticated"/>
-		<cors/>
-	</http>
-
-	<b:bean name="ep" class="org.springframework.security.web.authentication.HttpStatusEntryPoint">
-		<b:constructor-arg value="I_AM_A_TEAPOT"/>
-	</b:bean>
-
-	<b:bean name="preFlightRequestHandler"
-			class="org.springframework.security.config.http.HttpCorsConfigTests.MyPreFlightRequestHandler"/>
-
-	<b:import resource="userservice.xml"/>
-</b:beans>