Bean creation does not propagate the current calling AccessControlContext [SPR-4543]

[spring-projects-issues]

Rostislav Georgiev Georgiev opened SPR-4543 and commented

When invoking getBean(...) from within a PrivilegedAction and the bean is not yet initialized (scope="prototype") it gets created inside PrivilegedAction  in the AbstractAutowireCapableBeanFactory. But without propagating the outer(calling) AccessControlContext. So if your bean creation(initialization) relays on the calling context, it will fail.
The issue was introduced after the fix of http://jira.springframework.org/browse/SPR-4017 

I can also provide a simple test case, if it's needed.

---

Affects: 2.5.2

Attachments:

• test_patch.txt (4.16 kB)

[spring-projects-issues]

Juergen Hoeller commented

How exactly would you expect the calling AccessControlContext to be propagated? What exactly are you relying on there?

Juergen

[spring-projects-issues]

Rostislav Georgiev Georgiev commented

Something like this :

AccessControlContext context = AccessController.getContext();
AccessController.doPrivileged(new PrivilegedAction() {
public Object run() {
// do something
}
}, context);

[spring-projects-issues]

Rostislav Georgiev Georgiev commented

Attaching test patch to reproduce the case

[spring-projects-issues]

Juergen Hoeller commented

Thanks for the clarification - I've added this for 2.5.3.

This will be available in tonight's 2.5.3 snapshot (http://static.springframework.org/downloads/nightly/snapshot-download.php?project=SPR) already. Feel free to give it a try...

Juergen