Opened #19209 against 7.0.x to address this.

The PR removes the seven call sites that were added as workarounds for
spring-projects/spring-framework#35371:

Removed @SuppressWarnings("NullAway")

DefaultHttpSecurityExpressionHandler#createEvaluationContext
reactive CurrentSecurityContextArgumentResolver#resolveSecurityContextFromAnnotation
reactive AuthenticationPrincipalArgumentResolver#resolvePrincipal

Removed if (beanResolver != null) guards

servlet AuthenticationPrincipalArgumentResolver#resolveArgument
servlet CurrentSecurityContextArgumentResolver#resolveSecurityContextFromAnnotation
messaging reactive CurrentSecurityContextArgumentResolver#resolveSecurityContextFromAnnotation
DefaultMessageSecurityExpressionHandler#createEvaluationContext

While verifying the change, I also found two equivalent workarounds in
spring-security-core that did not reference #35371, and included them
in the same cleanup:

AbstractSecurityExpressionHandler#createEvaluationContext
DefaultMethodSecurityExpressionHandler#createEvaluationContext

Please let me know if you'd prefer those additional cleanups to be split
into a separate change.

Remove null checks to work around setBeanResolver(BeanResolver) #17816

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions