fix method search in SecurityActions.findMethod() #1045
Conversation
The previous implementation considered all superclasses, but only implemented interfaces of the bean class. The new implementation also considers implemented interfaces of all superclasses and superinterfaces.
Ladicek
force-pushed
the
fix-method-search
branch
from
d2e916f
to
03bcc84
Compare
| Class<?> clazz = declaringClass; | ||
| while (clazz != null) { | ||
| Deque<Class<?>> worklist = new ArrayDeque<>(); | ||
| worklist.add(declaringClass); | ||
| while (!worklist.isEmpty()) { | ||
| Class<?> clazz = worklist.removeFirst(); | ||
| for (Method m : clazz.getDeclaredMethods()) { | ||
| result.add(m.getName()); | ||
| } | ||
| clazz = clazz.getSuperclass(); | ||
| } | ||
|
|
||
| for (Class<?> iface : declaringClass.getInterfaces()) { | ||
| for (Method m : iface.getMethods()) { | ||
| result.add(m.getName()); | ||
| if (clazz.getSuperclass() != null) { | ||
| worklist.add(clazz.getSuperclass()); | ||
| } | ||
| Collections.addAll(worklist, clazz.getInterfaces()); |
There was a problem hiding this comment.
Are these really needed?
The comment above says:
// if we find a matching method on the bean class or one of its superclasses or superinterfaces,
// then we have to check that the method is either identical to or an override of a method that:
// - is declared on a class which is a superclass of the declaring class, or
// - is declared on an interface which implemented by the declaring class
which according to my understanding (and assuming it's correct) means that we only need to get the methods declared on the declaring class and its superclasses, plus the methods declared on the interfaces implemented by the declaring class only.
I believe the previous version of the code was fine and perhaps it would also suffice to replace iface.getMethods() with iface.getDeclaredMethod() (so that we don't need the whole hierarchy).
Yeah, that unfortunately only works for |
Ooops, right. What about |
The previous implementation considered all superclasses, but only implemented interfaces of the bean class. The new implementation also considers implemented interfaces of all superclasses and superinterfaces.