[DELTASPIKE-1014] SecuredAnnotationAuthorizer overwrites method-level annotation metadata with class-level annotation metadata

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.5.1
• Fix Version/s: 1.5.2
• Component/s: Security-Module
• Environment: Weld 2.2.15.Final
• Assignee: Gerhard Petracek
• Reporter: The Alchemist
• Created: 29/Oct/15 00:26
• Updated: 09/Dec/15 23:17
• Resolved: 29/Oct/15 06:47

Description

Short Overview of What I'm trying to Do

I'm trying to make a CDI-based equivalent of javax.annotation.security.RolesAllowed that uses my custom ROLE enum.

@Target({TYPE, METHOD, FIELD})
@Retention(RUNTIME)
@Inherited
@Stereotype
@Secured(MyRoleAccessDecisionVoter.class)
public @interface MyRolesAllowed {

    ROLE[] value();

}

@RequestScoped
public class MyRoleAccessDecisionVoter extends AbstractAccessDecisionVoter {
    @Inject
    private Principal principal;

    @Override
    protected void checkPermission(AccessDecisionVoterContext voterContext, Set<SecurityViolation> violations) {
        // get the roles from the annotation
        ROLE[] rolesAllowed = voterContext.getMetaDataFor(MyRolesAllowed.class.getName(), MyRolesAllowed.class).value();
        // BUG ABOVE!  it'll have class-level annotation instead of the method-level annotation
    }
}
        
@MyRolesAllowed({ADMIN, ROOT, USER})
@Stateless
public class TestBean {
    @MyRolesAllowed({ADMIN, ROOT})
    public List<String> getWhatever() {
        return ImmutableList.of();
    }
}

My Thoughts

It looks like org.apache.deltaspike.security.impl.authorization.SecuredAnnotationAuthorizer is where the bug is.

It parses both method- and class-level annotations in extractMetadata(), in that order (method first, then class).

Then that data gets passed to DefaultAccessDecisionVoterContext.addMetaData(), which puts it in a HashMap.

Because the order is method-first, that entry in the map gets overwritten by the class-level info.

Workaround

Use AccessDecisionVoterContext.getSource().getMethod().getAnnotationsByType() and use the annotation's value, if any.

        InvocationContext context = voterContext.getSource();
        // get the metadata from the method, only required if using DS <= 1.5.1
        MyRolesAllowed[] methodLevelAnnotations = context.getMethod().getAnnotationsByType(MyRolesAllowed.class);
        if(methodLevelAnnotations.length != 0) {
            rolesAllowed = methodLevelAnnotations[0].value();
        } else {
            // get the roles from the class-level annotation, if available
            rolesAllowed = voterContext.getMetaDataFor(MyRolesAllowed.class.getName(), MyRolesAllowed.class).value();
        }