spring-projects / spring-projects/spring-security
AclAuthorizationStrategyImpl mandates use of BasePermission
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
AclAuthorizationStrategyImpl line #127 assumes BasePermission is being used.
When BasePermission is not used, this will result in a check against a random custom permission mask just because the custom mask is the same as BasePermission.ADMINISTRATION .
// Try to get permission via ACEs within the ACL
`
List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
if (acl.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), sids, false)) {
return;
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java at the referenced line and trace how ACL permission masks are checked. Identify the behavior when custom permissions are used, then add coverage for that case and verify the ACL test suite passes with the administration check no longer depending on BasePermission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100