MethodSecurityExpressionHandler doesn't allow null to be returned when filtering
Maintainers usually reply within 3 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 65/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- java, kotlin, spring, spring-boot
- Domain
- backend-api-design, security
Research direction
Look at the MethodSecurityExpressionHandler interface in spring-security-core, specifically the filter method. Check the PostFilterAuthorizationMethodInterceptor.invoke method to see how it handles null returns. The fix likely involves adding a @Nullable annotation to the filter method's return type. The linked issue #19280 may provide context. Test by updating the sample project to verify compilation passes after the change.
Written by the indexing model from the issue text.
Description
Describe the bug
I've implemented a custom MethodSecurityExpressionHandler in earlier Spring versions which does some filtering. In the past I've returned null when the incoming filterTarget was null as well. Unfortunately though with adding the new @Nullable annotations to Spring 7 (and me using Kotlin and upgrading to the latest Spring version), I can't do this any longer, as the return type misses a @Nullable annotation. So this is a regression in contrast to previous Spring versions.
I personally think it should be possible to return null from this and it was missed when introducing the annotations to the interface, because the actual calling code on PostFilterAuthorizationMethodInterceptor.invoke allows null to be returned from the filter.
Be aware that this whole problem is also somewhat connected to the issue at #19280
So one could either merge the solution mentioned over there or add the missing annotation mentioned here. Either one or the other would actually work for me.
Thanks for checking. 🙏
To Reproduce
Implement a custom MethodSecurityExpressionHandler and try to return null from the filter method.
Expected behavior
It should be allowed to return null from the filter method.
Sample
https://github.com/GFriedrich/spring-security-issue
- See that the code compiles with Spring Boot 3
- Update the Spring Boot plugin to 4.x (e.g. 4.1.1) inside the
build.gradle.kts - See that the compilation now fails
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.4k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 54
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from spring-projects/spring-security
-
status: waiting-for-triage type: enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
spring-projects/spring-security#19783 ·
Maintainers usually reply within 3 days
-
status: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
spring-projects/spring-security#19733 ·
Maintainers usually reply within 3 days
-
status: waiting-for-triage type: enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
spring-projects/spring-security#19730 ·
Maintainers usually reply within 3 days
-
status: waiting-for-triage type: bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
spring-projects/spring-security#19728 · 1 comment ·
Maintainers usually reply within 3 days
-
status: waiting-for-triage type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
spring-projects/spring-security#19725 ·
Maintainers usually reply within 3 days
All issues in spring-projects/spring-security
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenAPITools/openapi-generator#25014 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
openhab/openhab-core#5847 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
apache/parquet-java#3820 ·
Maintainers usually reply within 1 day