WebSecurityConfiguration NullPointerException when ObjectPostProcessor is not present

Summary

org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.objectObjectPostProcessor field is marked as not required. When it is not present, the method springSecurityFilterChain throws a NullPointerException

Actual Behavior

If there are webSecurityConfigurers, and there is no objectObjectPostProcessor org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain() throws NPE in line number 99. (Version 5.1.5-RELEASE).

The method looks like this currently:

	/**
	 * Creates the Spring Security Filter Chain
	 * @return the {@link Filter} that represents the security filter chain
	 * @throws Exception
	 */
	@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
	public Filter springSecurityFilterChain() throws Exception {
		boolean hasConfigurers = webSecurityConfigurers != null
				&& !webSecurityConfigurers.isEmpty();
		if (!hasConfigurers) {
			WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor
					.postProcess(new WebSecurityConfigurerAdapter() {
					});
			webSecurity.apply(adapter);
		}
		return webSecurity.build();
	}

Expected Behavior

I think the method should look like this:

	/**
	 * Creates the Spring Security Filter Chain
	 * @return the {@link Filter} that represents the security filter chain
	 * @throws Exception
	 */
	@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
	public Filter springSecurityFilterChain() throws Exception {
		boolean hasConfigurers = webSecurityConfigurers != null
				&& !webSecurityConfigurers.isEmpty();
		if (!hasConfigurers && objectObjectPostProcessor != null ) {
			WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor
					.postProcess(new WebSecurityConfigurerAdapter() {
					});
			webSecurity.apply(adapter);
		}
		return webSecurity.build();
	}

Configuration

I am not currently sure why this ObjectPostProcessor is null by me. I will add details here, as soon as I figure it out. Still the NPE is something wrong, if the objectPostProcessor is not required.

Version

5.1.5-RELEASE. The code is still wrong in master, as far as I see

Sample

I think no sample is required, since the code is simple to understand.

Start at WebSecurityConfiguration.springSecurityFilterChain(), especially the objectObjectPostProcessor use described in the issue. Reproduce the case with webSecurityConfigurers present and no ObjectPostProcessor, then verify the filter chain builds without a NullPointerException when the issue's expected condition is met. Add or update regression coverage if the surrounding project tests identify an appropriate location.