spring-projects / spring-projects/spring-security
SEC-2524: Allow dynamic determination of processDomainObjectClass and requirePermision attribute in AclEntryVoter
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Manuel EVENO (Migrated from SEC-2524) said:
processDomainObjectClass and requirePermision attribute are set in construction in org.springframework.security.acls.AclEntryVoter.
It would be great to be able to determine thoses elements dynamically to avoid declaring multiple Voter for the various domain object to secure.
As an example, we could use permission configured and stored in a database.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading org.springframework.security.acls.AclEntryVoter and how processDomainObjectClass and requirePermision are currently set during construction. Define how those values should be determined dynamically, including the database-backed permission example, and verify the design against multiple secured domain objects.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100