From 5a7f12f1a9fdb4edaab6f61495f1d781a7273b61 Mon Sep 17 00:00:00 2001 From: Marcus Hert Da Coregio Date: Tue, 27 Feb 2024 09:49:08 -0300 Subject: [PATCH] Check for null Authentication Closes gh-14715 --- .../security/access/vote/AuthenticatedVoter.java | 2 +- .../security/access/vote/AuthenticatedVoterTests.java | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/springframework/security/access/vote/AuthenticatedVoter.java b/core/src/main/java/org/springframework/security/access/vote/AuthenticatedVoter.java index eec33f2d53d..95c419a6d3c 100644 --- a/core/src/main/java/org/springframework/security/access/vote/AuthenticatedVoter.java +++ b/core/src/main/java/org/springframework/security/access/vote/AuthenticatedVoter.java @@ -57,7 +57,7 @@ public class AuthenticatedVoter implements AccessDecisionVoter { private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl(); private boolean isFullyAuthenticated(Authentication authentication) { - return (!this.authenticationTrustResolver.isAnonymous(authentication) + return authentication != null && (!this.authenticationTrustResolver.isAnonymous(authentication) && !this.authenticationTrustResolver.isRememberMe(authentication)); } diff --git a/core/src/test/java/org/springframework/security/access/vote/AuthenticatedVoterTests.java b/core/src/test/java/org/springframework/security/access/vote/AuthenticatedVoterTests.java index bff472e3623..9c153dbf6fb 100644 --- a/core/src/test/java/org/springframework/security/access/vote/AuthenticatedVoterTests.java +++ b/core/src/test/java/org/springframework/security/access/vote/AuthenticatedVoterTests.java @@ -59,6 +59,7 @@ public void testAnonymousWorks() { assertThat(AccessDecisionVoter.ACCESS_GRANTED).isEqualTo(voter.vote(createAnonymous(), null, def)); assertThat(AccessDecisionVoter.ACCESS_GRANTED).isEqualTo(voter.vote(createRememberMe(), null, def)); assertThat(AccessDecisionVoter.ACCESS_GRANTED).isEqualTo(voter.vote(createFullyAuthenticated(), null, def)); + assertThat(AccessDecisionVoter.ACCESS_DENIED).isEqualTo(voter.vote(null, null, def)); } @Test @@ -68,6 +69,7 @@ public void testFullyWorks() { assertThat(AccessDecisionVoter.ACCESS_DENIED).isEqualTo(voter.vote(createAnonymous(), null, def)); assertThat(AccessDecisionVoter.ACCESS_DENIED).isEqualTo(voter.vote(createRememberMe(), null, def)); assertThat(AccessDecisionVoter.ACCESS_GRANTED).isEqualTo(voter.vote(createFullyAuthenticated(), null, def)); + assertThat(AccessDecisionVoter.ACCESS_DENIED).isEqualTo(voter.vote(null, null, def)); } @Test @@ -77,6 +79,7 @@ public void testRememberMeWorks() { assertThat(AccessDecisionVoter.ACCESS_DENIED).isEqualTo(voter.vote(createAnonymous(), null, def)); assertThat(AccessDecisionVoter.ACCESS_GRANTED).isEqualTo(voter.vote(createRememberMe(), null, def)); assertThat(AccessDecisionVoter.ACCESS_GRANTED).isEqualTo(voter.vote(createFullyAuthenticated(), null, def)); + assertThat(AccessDecisionVoter.ACCESS_DENIED).isEqualTo(voter.vote(null, null, def)); } @Test