Skip to content

Allow nullable results from method security filtering #19782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zemiles wants to merge 1 commit into
base: main
Choose a base branch
from
+27 −11
Open

Allow nullable results from method security filtering #19782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...ngframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ private MethodSecurityExpressionOperations createSecurityExpressionRoot(
* {@link Stream}
*/
@Override
public Object filter(@Nullable Object filterTarget, Expression filterExpression, EvaluationContext ctx) {
public @Nullable Object filter(@Nullable Object filterTarget, Expression filterExpression, EvaluationContext ctx) {
MethodSecurityExpressionOperations rootObject = (MethodSecurityExpressionOperations) ctx.getRootObject()
.getValue();
Assert.notNull(rootObject, "rootObject cannot be null");
Expand Down
4 changes: 2 additions & 2 deletions ...rg/springframework/security/access/expression/method/MethodSecurityExpressionHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,9 @@ public interface MethodSecurityExpressionHandler extends SecurityExpressionHandl
* returned collection
* @param ctx the current evaluation context (as created through a call to
* {@link #createEvaluationContext(org.springframework.security.core.Authentication, Object)}
* @return the filtered collection or array
* @return the filtered collection or array, or {@code null}
*/
Object filter(@Nullable Object filterTarget, Expression filterExpression, EvaluationContext ctx);
@Nullable Object filter(@Nullable Object filterTarget, Expression filterExpression, EvaluationContext ctx);

/**
* Used to inform the expression system of the return object for the given evaluation
Expand Down
32 changes: 24 additions & 8 deletions ...rk/security/access/expression/method/DefaultMethodSecurityExpressionHandlerKotlinTests.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
"key3" to "value3",
)

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ nonEmptyMap,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -89,7 +89,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
)
val emptyMap: Map<String, String> = emptyMap()

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ emptyMap,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -114,7 +114,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
"string1",
)

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ nonEmptyCollection,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -136,7 +136,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
)
val emptyCollection: Collection<String> = emptyList()

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ emptyCollection,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -161,7 +161,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
"string1",
)

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ nonEmptyArray,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -183,7 +183,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
)
val emptyArray: Array<String> = emptyArray()

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ emptyArray,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -208,7 +208,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
"string1",
).stream()

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ nonEmptyStream,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -230,7 +230,7 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
)
val emptyStream: Stream<String> = emptyList<String>().stream()

val filtered: Any = handler.filter(
val filtered: Any? = handler.filter(
/* filterTarget = */ emptyStream,
/* filterExpression = */ expression,
/* ctx = */ context,
Expand All @@ -241,4 +241,20 @@ class DefaultMethodSecurityExpressionHandlerKotlinTests {
val result = (filtered as Stream<String>).toList()
assertThat(result).hasSize(0)
}

@Test
fun `allows null filter results`() {
val handler = NullReturningMethodSecurityExpressionHandler()
val expression: Expression = handler.expressionParser.parseExpression("filterObject eq 'string2'")
val context: EvaluationContext = handler.createEvaluationContext(
/* authentication = */ authentication,
/* invocation = */ methodInvocation,
)

assertThat(handler.filter(null, expression, context)).isNull()
}

private class NullReturningMethodSecurityExpressionHandler : DefaultMethodSecurityExpressionHandler() {
override fun filter(filterTarget: Any?, filterExpression: Expression, ctx: EvaluationContext): Any? = null
}
}