SPR-16060 - Enhance AnnotationUtils to find annotations on generic interfaces

[christor]

When scanning for annotations on a class that implements a generic interface where the generic
type is specified in the implementing class, annotation scanning would fail to identify annotations
from the interface since the parameter types do not match.

For example, given an interface:

   public interface Foo<T> {
       @Order
       void foo(T t);
   }

and a class:

   public class StringFoo implements Foo<String> {
       public void foo(String s) { ... }
   }

when scanning StringFoo.foo for annotations, no annotations were identified.

This commit changes annotation scanning so that when scanning for annotations, the parameters are
compared for assignability (using Class.isAssignableFrom()) rather than requiring exact matches.

Issue: SEC-3081

[pivotal-issuemaster]

@christor Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-issuemaster]

@christor Thank you for signing the Contributor License Agreement!

[christor]

Fixes spring-projects/spring-security#3286

[sbrannen]

Hi @christor,

Since your proposed change is in the core Spring Framework and not in Spring Security, please create a JIRA issue for the SPR project so that we can track it there.

Cheers,

Sam

[christor]

Done, @sbrannen - https://jira.spring.io/browse/SPR-16060

Is there anything more that needs to be done?

[christor]

Just following up to see if there's anything more needed.

[sbrannen]

Thanks for raising the JIRA issue!

AFAIK, @jhoeller is going to look into this.

[christor]

Just checking in again, since it's been a couple of months. Does this change look reasonable, @jhoeller?

[christor]

Looks like some other commit has caused a conflict. If/when you want to merge this I can help resolve those.

[JacobBrandt]

Yea this one just bit me as well. @sbrannen @jhoeller how long are we expected to wait? It's been quite awhile. I just ran into this with Pre/PostAuthorize annotations. It's not a great problem to run into for these kinds of annotations.

[sbrannen]

SPR-16060 is scheduled for 5.1 RC1.

So that means it's on the radar, but I'll let @jhoeller comment on an ETA in 5.1 snapshots.

[jhoeller]

Finally resolved in master now, and scheduled for a backport to 5.0.8. The implementation is somewhat different since it goes through generics resolution for the type variable instead of an assignability check. Thanks for the pull request, in any case!

[christor]

Great news, thanks!

I guess this is the relevant change? d78e27f#diff-44945edabd4176dfd3966252ff4a589e

[jhoeller]

It's a follow-up to that which is actually pushed to master now: 23d4862