5.8.12: @Secured annotation on subclasses is not read by SecuredAuthorizationManager when method in superclass was called #15002
Description
If I have 2 classes,
public abstract class AbstractService {
public void doSmth() {...}
}
@Secured("SECURE")
@Service
public class Service extends AbstractService {
...
}
and when I call service.doSmth(), security is not applied, because method org.springframework.security.authorization.method.SecuredAuthorizationManager.SecuredAuthorizationManagerRegistry#findSecuredAnnotation will try to get annotation of AbstractService, not of Service.
See the 6 version of this method https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/authorization/method/SecuredAuthorizationManager.java
This bug was fixed there.