Skip to content

SecurityAnnotationScanner's method comparison should use .equals #17143

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom
Closed
jzheaux opened this issue May 19, 2025 · 1 comment
Closed

SecurityAnnotationScanner's method comparison should use .equals #17143

jzheaux opened this issue May 19, 2025 · 1 comment
Assignees
@jzheaux
Labels
in: aspects An issue in spring-security-aspects in: core An issue in spring-security-core type: bug A general bug
Milestone
6.4.6

Comments

@jzheaux
Copy link
Contributor

jzheaux commented May 19, 2025

When using == to look for a method match, it may not account for technologies like AspectJ that weave behavior around a method at compile time.
@jzheaux jzheaux added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels May 19, 2025
@jzheaux jzheaux self-assigned this May 19, 2025
@jzheaux jzheaux added in: core An issue in spring-security-core in: aspects An issue in spring-security-aspects and removed status: waiting-for-triage An issue we've not yet triaged labels May 19, 2025
@jzheaux jzheaux added this to the 6.4.6 milestone May 19, 2025
@jzheaux jzheaux mentioned this issue May 19, 2025
Closed
jzheaux added a commit that referenced this issue May 19, 2025
@jzheaux
Use .equals to Compare Methods
bf2aaa1 
Closes gh-17143
@jzheaux jzheaux mentioned this issue May 19, 2025
Closed
@Alina-Podoba
Copy link

Hi, thanks for the clarification and the fix.
Just to confirm- is spring-security-core considered affected by CVE-2025-41232 as well?

# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@jzheaux jzheaux

Labels
in: aspects An issue in spring-security-aspects in: core An issue in spring-security-core type: bug A general bug
Projects
None yet
Milestone
6.4.6
Development

No branches or pull requests
2 participants
@jzheaux @Alina-Podoba