diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyWebConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyWebConfiguration.java index 4af062ef96f..62faa1a6bc6 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyWebConfiguration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyWebConfiguration.java @@ -51,7 +51,7 @@ public Object visit(AuthorizationAdvisorProxyFactory proxyFactory, Object target if (target instanceof ModelAndView mav) { View view = mav.getView(); String viewName = mav.getViewName(); - Map model = (Map) proxyFactory.proxy(mav.getModel()); + Map model = proxyFactory.proxy(mav.getModel()); ModelAndView proxied = (view != null) ? new ModelAndView(view, model) : new ModelAndView(viewName, model); proxied.setStatus(mav.getStatus()); diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyConfigurationTests.java index 254c8b08713..8a668819294 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyConfigurationTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyConfigurationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -58,7 +58,7 @@ public class AuthorizationProxyConfigurationTests { @Test public void proxyWhenNotPreAuthorizedThenDenies() { this.spring.register(DefaultsConfig.class).autowire(); - Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); + Toaster toaster = this.proxyFactory.proxy(new Toaster()); assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(toaster::makeToast) .withMessage("Access Denied"); assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(toaster::extractBread) @@ -69,7 +69,7 @@ public void proxyWhenNotPreAuthorizedThenDenies() { @Test public void proxyWhenPreAuthorizedThenAllows() { this.spring.register(DefaultsConfig.class).autowire(); - Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); + Toaster toaster = this.proxyFactory.proxy(new Toaster()); toaster.makeToast(); assertThat(toaster.extractBread()).isEqualTo("yummy"); } @@ -77,7 +77,7 @@ public void proxyWhenPreAuthorizedThenAllows() { @Test public void proxyReactiveWhenNotPreAuthorizedThenDenies() { this.spring.register(ReactiveDefaultsConfig.class).autowire(); - Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); + Toaster toaster = this.proxyFactory.proxy(new Toaster()); Authentication user = TestAuthentication.authenticatedUser(); StepVerifier .create(toaster.reactiveMakeToast().contextWrite(ReactiveSecurityContextHolder.withAuthentication(user))) @@ -90,7 +90,7 @@ public void proxyReactiveWhenNotPreAuthorizedThenDenies() { @Test public void proxyReactiveWhenPreAuthorizedThenAllows() { this.spring.register(ReactiveDefaultsConfig.class).autowire(); - Toaster toaster = (Toaster) this.proxyFactory.proxy(new Toaster()); + Toaster toaster = this.proxyFactory.proxy(new Toaster()); Authentication admin = TestAuthentication.authenticatedAdmin(); StepVerifier .create(toaster.reactiveMakeToast().contextWrite(ReactiveSecurityContextHolder.withAuthentication(admin))) diff --git a/core/src/main/java/org/springframework/security/aot/hint/AuthorizeReturnObjectHintsRegistrar.java b/core/src/main/java/org/springframework/security/aot/hint/AuthorizeReturnObjectHintsRegistrar.java index 0c430160b72..d2194eff7fc 100644 --- a/core/src/main/java/org/springframework/security/aot/hint/AuthorizeReturnObjectHintsRegistrar.java +++ b/core/src/main/java/org/springframework/security/aot/hint/AuthorizeReturnObjectHintsRegistrar.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -109,7 +109,7 @@ public void registerHints(RuntimeHints hints, ConfigurableListableBeanFactory be } private void registerProxy(RuntimeHints hints, Class clazz) { - Class proxied = (Class) this.proxyFactory.proxy(clazz); + Class proxied = this.proxyFactory.proxy(clazz); if (proxied == null) { return; } diff --git a/core/src/main/java/org/springframework/security/authorization/AuthorizationProxyFactory.java b/core/src/main/java/org/springframework/security/authorization/AuthorizationProxyFactory.java index c425db9a01d..e6e1210e74b 100644 --- a/core/src/main/java/org/springframework/security/authorization/AuthorizationProxyFactory.java +++ b/core/src/main/java/org/springframework/security/authorization/AuthorizationProxyFactory.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2024 the original author or authors. + * Copyright 2002-2025 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -20,6 +20,7 @@ * A factory for wrapping arbitrary objects in authorization-related advice * * @author Josh Cummings + * @author daewon kim * @since 6.3 * @see org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory */ @@ -30,11 +31,12 @@ public interface AuthorizationProxyFactory { * *

* Please check the implementation for which kinds of objects it supports. + * @param the type of the object being proxied * @param object the object to proxy * @return the proxied object * @throws org.springframework.aop.framework.AopConfigException if a proxy cannot be * created */ - Object proxy(Object object); + T proxy(T object); } diff --git a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAdvisorProxyFactory.java b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAdvisorProxyFactory.java index dd4abb3754c..f0f3984cb7c 100644 --- a/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAdvisorProxyFactory.java +++ b/core/src/main/java/org/springframework/security/authorization/method/AuthorizationAdvisorProxyFactory.java @@ -172,16 +172,16 @@ public void afterSingletonsInstantiated() { * @return the proxied instance */ @Override - public Object proxy(Object target) { + public T proxy(T target) { if (target == null) { return null; } if (target instanceof AuthorizationProxy proxied) { - return proxied; + return (T) proxied; } Object proxied = this.visitor.visit(this, target); if (proxied != null) { - return proxied; + return (T) proxied; } ProxyFactory factory = new ProxyFactory(target); factory.addAdvisors(this.authorizationProxy); @@ -191,7 +191,7 @@ public Object proxy(Object target) { factory.addInterface(AuthorizationProxy.class); factory.setOpaque(true); factory.setProxyTargetClass(!Modifier.isFinal(target.getClass().getModifiers())); - return factory.getProxy(); + return (T) factory.getProxy(); } /** @@ -442,7 +442,7 @@ public Object visit(AuthorizationAdvisorProxyFactory proxyFactory, Object target @SuppressWarnings("unchecked") private T proxyCast(AuthorizationProxyFactory proxyFactory, T target) { - return (T) proxyFactory.proxy(target); + return proxyFactory.proxy(target); } private Iterable proxyIterable(AuthorizationProxyFactory proxyFactory, Iterable iterable) { diff --git a/core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java b/core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java index 93d7ee1520c..3babccf147d 100644 --- a/core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java +++ b/core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java @@ -335,7 +335,7 @@ public void setTargetVisitorThenUses() { @Test public void setTargetVisitorIgnoreValueTypesThenIgnores() { AuthorizationAdvisorProxyFactory factory = AuthorizationAdvisorProxyFactory.withDefaults(); - assertThatExceptionOfType(ClassCastException.class).isThrownBy(() -> ((Integer) factory.proxy(35)).intValue()); + assertThatExceptionOfType(ClassCastException.class).isThrownBy(() -> factory.proxy(35).intValue()); factory.setTargetVisitor(TargetVisitor.defaultsSkipValueTypes()); assertThat(factory.proxy(35)).isEqualTo(35); }