Skip to content

Commit 61ee4e5

Browse files
snicollrwinch
authored andcommitted
Avoid using SpEL to change the meaning of the injection point
This commit removes the use of SpEL expression and replaces it with an explicit call to the underlying method.
1 parent aa0f788 commit 61ee4e5

File tree

1 file changed

+5
-11
lines changed

1 file changed

+5
-11
lines changed

config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -24,7 +24,6 @@
2424

2525
import org.springframework.beans.factory.BeanClassLoaderAware;
2626
import org.springframework.beans.factory.annotation.Autowired;
27-
import org.springframework.beans.factory.annotation.Value;
2827
import org.springframework.beans.factory.config.BeanFactoryPostProcessor;
2928
import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
3029
import org.springframework.context.annotation.Bean;
@@ -143,19 +142,20 @@ public WebInvocationPrivilegeEvaluator privilegeEvaluator() {
143142
* instances used to create the web configuration.
144143
* @param objectPostProcessor the {@link ObjectPostProcessor} used to create a
145144
* {@link WebSecurity} instance
146-
* @param webSecurityConfigurers the
145+
* @param beanFactory the bean factory to use to retrieve the relevant
147146
* {@code <SecurityConfigurer<FilterChainProxy, WebSecurityBuilder>} instances used to
148147
* create the web configuration
149148
* @throws Exception
150149
*/
151150
@Autowired(required = false)
152151
public void setFilterChainProxySecurityConfigurer(ObjectPostProcessor<Object> objectPostProcessor,
153-
@Value("#{@autowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers()}") List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers)
154-
throws Exception {
152+
ConfigurableListableBeanFactory beanFactory) throws Exception {
155153
this.webSecurity = objectPostProcessor.postProcess(new WebSecurity(objectPostProcessor));
156154
if (this.debugEnabled != null) {
157155
this.webSecurity.debug(this.debugEnabled);
158156
}
157+
List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers = new AutowiredWebSecurityConfigurersIgnoreParents(
158+
beanFactory).getWebSecurityConfigurers();
159159
webSecurityConfigurers.sort(AnnotationAwareOrderComparator.INSTANCE);
160160
Integer previousOrder = null;
161161
Object previousConfig = null;
@@ -189,12 +189,6 @@ public static BeanFactoryPostProcessor conversionServicePostProcessor() {
189189
return new RsaKeyConversionServicePostProcessor();
190190
}
191191

192-
@Bean
193-
public static AutowiredWebSecurityConfigurersIgnoreParents autowiredWebSecurityConfigurersIgnoreParents(
194-
ConfigurableListableBeanFactory beanFactory) {
195-
return new AutowiredWebSecurityConfigurersIgnoreParents(beanFactory);
196-
}
197-
198192
@Override
199193
public void setImportMetadata(AnnotationMetadata importMetadata) {
200194
Map<String, Object> enableWebSecurityAttrMap = importMetadata

0 commit comments

Comments
 (0)