SEC-2083: Create a MethodSecurityExpressionHandler that can handle fixed-sized collections

Mattias Severson (Migrated from SEC-2083) said:

When using annotations to filter collections based, e.g. @PostFilter("hasPermission(filterObject, 'SOME_PERMISSION')"), the DefaultMethodSecurityExpressionHandler.filter() gets called. The problem with this method is that if the filterTarget is an immutable list or an immutable set, an exception will thrown (because collection.clear() is called before the elements in the retainList are added back to the collection).

One solution to overcome this problem is to implement an "ImmutableMethodSecurityExpressionHandler" by subclassing the DefaultMethodSecurityExpressionHandler, override the filter() method if the filterTarget is of type List, Set, or SortedSet, do the filtering as before, but instead of clearing the existing collection, returning the retainList wrapped in Collections.unmodifiableList(), Collections.unmodifiableSet() or Collections.unmodifiableSortedSet() respectively.

UPDATE: We should also support Arrays.asList which is a fixed size collection

Start in core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java at filter(), then trace how @PostFilter handles immutable lists, sets, sorted sets, and Arrays.asList. Verify the existing filtering behavior and define completion as filtering these fixed-sized collections without the collection.clear() failure while preserving the retained elements.