apache / apache/grails-core

Tags in SecurityTagLib are not disabled when plugin is set to inactive

Open
#15,880 0 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Task List

- [x] Steps to reproduce provided
- [x] Stacktrace (if present) provided
- [x] Example that reproduces the problem uploaded to Github
- [x] Full description of the issue provided (see below)

### Steps to Reproduce

1. Create new Grails application and install Spring Security Core plugin v3.2.0
2. In application.yml, under evnironments->development, add configuration grails.plugin.springsecurity.active: false
3. Add tag to the sample index.gsp homepage.

### Expected Behaviour

If Spring Security Core plugin is disabled, tags from SecurityTagLib should be disabled as well.

### Actual Behaviour

The following error is received:
````Error executing tag : No bean named 'roleHierarchy' available````

Stacktrace (partial):
````
org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'roleHierarchy' available
at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.java:687)
at org.springframework.beans.factory.support.AbstractBeanFactory.getMergedLocalBeanDefinition(AbstractBeanFactory.java:1218)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:284)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1086)
at grails.plugin.springsecurity.SpringSecurityUtils.getBean(SpringSecurityUtils.groovy:647)
at grails.plugin.springsecurity.SpringSecurityUtils.findInferredAuthorities(SpringSecurityUtils.groovy:642)
at grails.plugin.springsecurity.SpringSecurityUtils.ifAllGranted(SpringSecurityUtils.groovy:196)
at grails.plugin.springsecurity.SpringSecurityUtils.ifAllGranted(SpringSecurityUtils.groovy:192)
at grails.plugin.springsecurity.SecurityTagLib$_closure1.doCall(SecurityTagLib.groovy:62)
at org.grails.gsp.GroovyPage.invokeTagLibClosure(GroovyPage.java:446)
at org.grails.gsp.GroovyPage.invokeTag(GroovyPage.java:364)
````

Other tags are also executed; for instance, if a block of text is surrounded with and Spring Security is set active: false in application.yml, the block of text will not appear if the user is not logged in.

### Environment Information

- **Operating System**: Windows 10
- **GORM Version:** 6.1
- **Grails Version (if using Grails):** 3.3.9
- **JDK Version:** 1.8.0_211

### Example Application

- https://github.com/davidcwalker/spring-security-taglib-issue

Contributor guide

Open the contributing guide

Research direction

Reproduce the disabled-plugin case with the linked example application, then inspect SecurityTagLib.groovy around line 62 and the SpringSecurityUtils.groovy calls shown in the stacktrace. Done means SecurityTagLib tags do not execute or raise missing-bean errors when grails.plugin.springsecurity.active is false, including ifAllGranted and ifLoggedIn.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, spring
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.