Closed
Description
Related to spring-projects/spring-security#13625 (GitHub reproducer)
In a hierarchy like this:
interface Hello {
@PreAuthorize("...")
void sayHello();
}
interface SayHello extends Hello {}
class HelloImpl implements SayHello {
public void sayHello() {}
}
a call to MergedAnnoatations
like this:
MergedAnnotations mergedAnnotations = MergedAnnotations.from(HelloImpl.class.getMethod("sayHello"),
SearchStrategy.TYPE_HIERARCHY);
will return multiple instances of MergedAnnotation
for PreAuthorize.class
.
It's expected that such an arrangement would only produce one MergedAnnotation
instance since there is only one in the hierarchy.
Thanks to @philwebb for helping me find a workaround. Since PreAuthorize
is not a repeatable annotation, Spring Security can ignore subsequent MergedAnnotation
instances from the same MergedAnnotation#getSource
.