coheigea opened a new pull request, #3687: URL: https://github.com/apache/cxf/pull/3687
SecureAnnotationsInterceptor read the roles of the configured annotation by casting its value() to String[], and silently ignored any failure. With an annotation class whose value() is a single String, or which has no value(), every method it annotated was treated as having no roles, and so was permitted to every user. A String value() is now accepted as a single role. setAnnotationClassName rejects a class which is not an annotation with a String or String[] value(), and if the roles of an annotation still can't be read, a warning is logged and the method is denied to every user rather than left unprotected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
