SEC-2189: <sec:authorize url=""> could use wrong WebInvocationPrivilegeEvaluator

q (Migrated from SEC-2189) said:

When using <sec:authorize url=""> it is possible situation when wrong WebInvocationPrivilegeEvaluator is used for access evaluation

It occurs when in security xml descriptor there're different contexts
and in the jsp in second context we use <sec:authorize url=""> to access url from second context.

for example:

in security.xml:

<http pattern="/qwe/" ...>
   ...
</http>
<http pattern="/admin/" ...>
   <intercept-url pattern="/admin/stats/**" access="hasRole('ROLE_ADMIN')"/>
   ...
</http>

in /admin/index.jsp:

<sec:authorize url="/admin/stats/index.jsp">        
   <a href="<spring:url value="/admin/stats/index.jsp"/>">link</a>
</sec:authorize>

on the /admin/index.jsp link will be displayed even if user doesn't have ROLE_ADMIN

It appears that the problem is in

org.springframework.security.taglibs.authz.AbstractAuthorizeTag#getPrivilegeEvaluator:

Map<String, WebInvocationPrivilegeEvaluator> wipes = ctx.getBeansOfType(WebInvocationPrivilegeEvaluator.class);
....
return (WebInvocationPrivilegeEvaluator) wipes.values().toArray()[0];

Start in org.springframework.security.taglibs.authz.AbstractAuthorizeTag#getPrivilegeEvaluator and inspect how multiple WebInvocationPrivilegeEvaluator beans are selected. Reproduce the example with separate contexts and an authorization tag targeting the second context. Done means the tag evaluates the URL with the evaluator for that context and does not display the link without ROLE_ADMIN.