Skip to content

Reject effectively private handler methods on CGLIB proxied controllers #35352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 15 commits into from
Closed

Reject effectively private handler methods on CGLIB proxied controllers #35352

wants to merge 15 commits into from
+306 −1

Conversation

YongGoose
Copy link
Contributor

fixes #30938

@YongGoose
Prevent reflective invocation of private methods in web dispatcher
2eddd3b 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose YongGoose mentioned this pull request Aug 20, 2025
Closed
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Aug 20, 2025
rstoyanchev
rstoyanchev previously requested changes Oct 1, 2025
View reviewed changes
Copy link
Contributor

@rstoyanchev rstoyanchev left a comment •
edited by sbrannen
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Couldn't this be checked in RequestMappingHandlerMapping when request mappings are being initialized?

It would avoid repeating that on every call.

@rstoyanchev rstoyanchev added the in: web Issues in web modules (web, webmvc, webflux, websocket) label Oct 1, 2025
sbrannen
sbrannen requested changes Oct 3, 2025
View reviewed changes
Copy link
Member

@sbrannen sbrannen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I requested a few changes.

Please also take Rossen's comment into account.

@sbrannen sbrannen added the status: waiting-for-feedback We need additional information before we can continue label Oct 3, 2025
@YongGoose
Copy link
Contributor Author

I'm currently traveling, so I should be able to work on it around Wednesday or Thursday this week.
@rstoyanchev @sbrannen Thank you both so much for the great reviews! 🙇🏻‍♂️

@spring-projects-issues spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Oct 6, 2025
@YongGoose
Apply code review
72ff98a 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose
Revert changes
549acc0 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose
Create test code
6819d95 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose
Copy link
Contributor Author

Couldn't this be checked in RequestMappingHandlerMapping when request mappings are being initialized?

It would avoid repeating that on every call.

Please take a look :)

@YongGoose
Copy link
Contributor Author

@sbrannen @rstoyanchev

If you have some time, I’d really appreciate it if you could take a look at this PR as well. 🙇🏻‍♂️🙇🏻‍♂️

It’s similar to the this PR, focusing on the access modifiers and proxies!!

sbrannen
sbrannen requested changes Oct 10, 2025
View reviewed changes
Copy link
Member

@sbrannen sbrannen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the requested changes. It's looking better. 👍

I've requested a few additional changes in this follow up review.

Also, please make analogous changes to org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerMapping and org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerMappingTests.

@sbrannen sbrannen self-assigned this Oct 10, 2025
@sbrannen sbrannen added type: enhancement A general enhancement status: waiting-for-feedback We need additional information before we can continue and removed status: feedback-provided Feedback has been provided labels Oct 10, 2025
YongGoose and others added 8 commits October 11, 2025 09:55
@YongGoose @sbrannen
Update spring-webmvc/src/main/java/org/springframework/web/servlet/mv…
e278799 
…c/method/annotation/RequestMappingHandlerMapping.java

Co-authored-by: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Signed-off-by: Yongjun Hong <kevin0928@naver.com>
@YongGoose @sbrannen
Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…
1ff3e61 
…c/method/annotation/RequestMappingHandlerMappingTests.java

Co-authored-by: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Signed-off-by: Yongjun Hong <kevin0928@naver.com>
@YongGoose @sbrannen
Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…
2416d27 
…c/method/annotation/RequestMappingHandlerMappingTests.java

Co-authored-by: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Signed-off-by: Yongjun Hong <kevin0928@naver.com>
@YongGoose @sbrannen
Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…
6b884fc 
…c/method/annotation/RequestMappingHandlerMappingTests.java

Co-authored-by: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Signed-off-by: Yongjun Hong <kevin0928@naver.com>
@YongGoose @sbrannen
Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…
c6678da 
…c/method/annotation/RequestMappingHandlerMappingTests.java

Co-authored-by: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Signed-off-by: Yongjun Hong <kevin0928@naver.com>
@YongGoose @sbrannen
Update spring-webmvc/src/test/java/org/springframework/web/servlet/mv…
2c5f8fd 
…c/method/annotation/RequestMappingHandlerMappingTests.java

Co-authored-by: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Signed-off-by: Yongjun Hong <kevin0928@naver.com>
@YongGoose
Revert unnecessary changes
6822c7c 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose
Apply code review
52f981e 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose
Apply analogous changes to Reactive RequestMappingHandlerMapping and …
d387e78 
…related tests

Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose
Add tests
dba200f 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@YongGoose YongGoose requested a review from sbrannen October 11, 2025 12:52
@YongGoose
Remove unused annotation
a2d706c 
Signed-off-by: yongjunhong <yongjunh@apache.org>
@sbrannen sbrannen removed status: waiting-for-feedback We need additional information before we can continue status: waiting-for-triage An issue we've not yet triaged or decided on labels Oct 11, 2025
@sbrannen sbrannen added this to the 7.0.0-RC1 milestone Oct 11, 2025
@sbrannen sbrannen changed the title Prevent reflective invocation of private methods in web dispatcher Reject invocation of private handler methods on CGLIB proxied controller Oct 11, 2025
sbrannen
sbrannen approved these changes Oct 11, 2025
View reviewed changes
Copy link
Member

@sbrannen sbrannen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making all of the requested changes. 👍

I think this PR looks pretty good now, and I'll review it once more in detail before merging it into main.

@sbrannen sbrannen dismissed rstoyanchev’s stale review October 11, 2025 15:21

The requested change has already been made.

@sbrannen sbrannen changed the title Reject invocation of private handler methods on CGLIB proxied controller Reject invocation of effectively private handler methods on CGLIB proxied controller Oct 11, 2025
@sbrannen sbrannen changed the title Reject invocation of effectively private handler methods on CGLIB proxied controller Reject effectively private handler methods on CGLIB proxied controllers Oct 11, 2025
@sbrannen sbrannen closed this in 8edc7cd Oct 11, 2025
sbrannen added a commit that referenced this pull request Oct 11, 2025
@sbrannen
Revise contribution
0389684 
See gh-35352
@sbrannen
Copy link
Member

This has been merged into main in 8edc7cd and revised in 0389684.

Thanks! 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sbrannen sbrannen sbrannen approved these changes

@rstoyanchev rstoyanchev Awaiting requested review from rstoyanchev

Assignees

@sbrannen sbrannen

Labels

in: web Issues in web modules (web, webmvc, webflux, websocket) type: enhancement A general enhancement

Projects

None yet

Milestone

7.0.0-RC1

Development

Successfully merging this pull request may close these issues.

Invoking private method on a CGLIB proxy should trigger a dedicated exception

4 participants

@YongGoose @sbrannen @rstoyanchev @spring-projects-issues