ffang commented on PR #3669:
URL: https://github.com/apache/cxf/pull/3669#issuecomment-6605797220
Thanks Colm, enforcing every applicable `@RolesAllowed` makes sense, and
core plus `JAXRSSimpleSecurityTest`, `JAXRSSamlAuthorizationTest` and
`JWTAuthnAuthzTest` pass.
One case is stricter than both main and JSR-250: a subclass with a
class-level role inheriting an annotated method without overriding it:
```java
public class Base {
@RolesAllowed("user") public void operation() {}
}
@RolesAllowed("admin")
public class Service extends Base {}
```
On main a caller with `user` can call `operation()`; with this PR they need
`user` and `admin`. `findRoles` adds `Service`'s class roles to every method of
`cls.getMethods()`, including inherited ones, and `isReplacedByMethodRoles`
doesn't drop them because the method roles come from a superclass. Per JSR-250
the class-level annotation only covers methods declared by `Service`, and it's
the mirror of `testSuperclassClassRolesDoNotApplyToSubclassMethods`. The
existing tests only cover the overriding variant (`AdminSubService`). Could the
class roles be applied to a method not declared in `cls` only when it has no
method-level roles? That keeps unannotated inherited methods protected.
Freeman
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
