Add support in AopUtils for obtaining target class transitively when target is an AopProxy [SPR-7074]

[spring-projects-issues]

Luke Taylor opened SPR-7074 and commented

See SEC-1454. Methods like AopUtils.getMostSpecificMethod(method, target) do not currently take account of the situation where the target is a proxy.

---

Affects: 3.0.2

Issue Links:

• SEC-1454 @PreAutorize(#username == principal.username) issues - when target is AOPProxy ("is depended on by")
• Add option to Proxy factories to copy parameter-level annotations [SPR-8560] #13204 Add option to Proxy factories to copy parameter-level annotations

Referenced from: commits 87e3277

1 votes, 1 watchers

[spring-projects-issues]

Juergen Hoeller commented

I've introduced an AopProxyUtils.ultimateTargetClass method for this purpose, traversing nested Advised objects with SingletonTargetSources as well. Note that other TargetSources won't be traversed because even introspecting the target object would cause a side effect...

Juergen

[spring-projects-issues]

Pether Sorling commented

Thanks, Will test it as soon as the snapshots have been updated!