(grails-core) branch feat/indy-default-groovy6 updated: fix: make security taglib and session lookup indy-safe

[jamesfredley]

This is an automated email from the ASF dual-hosted git repository.

jamesfredley pushed a commit to branch feat/indy-default-groovy6
in repository https://gitbox.apache.org/repos/asf/grails-core.git


The following commit(s) were added to refs/heads/feat/indy-default-groovy6 by 
this push:
     new 2cbd65150c fix: make security taglib and session lookup indy-safe
2cbd65150c is described below

commit 2cbd65150c37d5b08bcee7244f753b9095f48a6b
Author: James Fredley <jamesfred...@users.noreply.github.com>
AuthorDate: Tue Aug 18 15:10:24 2026 -0400

    fix: make security taglib and session lookup indy-safe
    
    MiscSpec is identical to 8.0.x and passed on 9.0.x when the plugin
    defaulted to indy=false. With indy on by default, Map-as-FilterChain
    and session[name] are fragile Groovy dispatch. Use a real FilterChain
    and HttpSession.getAttribute instead.
    
    Assisted-by: claude-code:claude-opus-5
---
 .../grails/plugin/springsecurity/SecurityTagLib.groovy      | 13 ++++++++++---
 .../grails-app/controllers/HackController.groovy            |  2 +-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git 
a/grails-spring-security/plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy
 
b/grails-spring-security/plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy
index 25063df458..ecd49efa99 100644
--- 
a/grails-spring-security/plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy
+++ 
b/grails-spring-security/plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy
@@ -30,6 +30,8 @@ import org.springframework.security.web.FilterInvocation
 import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator
 
 import jakarta.servlet.FilterChain
+import jakarta.servlet.ServletRequest
+import jakarta.servlet.ServletResponse
 
 /**
  * Security tags.
@@ -51,9 +53,7 @@ class SecurityTagLib implements GrailsConfigurationAware {
     /** Dependency injection for webInvocationPrivilegeEvaluator. */
     WebInvocationPrivilegeEvaluator webInvocationPrivilegeEvaluator
 
-    protected static final FilterChain DUMMY_CHAIN = [
-        doFilter: { req, res -> throw new UnsupportedOperationException() }
-    ] as FilterChain
+    protected static final FilterChain DUMMY_CHAIN = new 
UnsupportedFilterChain()
 
     protected Map<String, Expression> expressionCache = [:]
 
@@ -317,4 +317,11 @@ class SecurityTagLib implements GrailsConfigurationAware {
     void setConfiguration(Config co) {
         serverContextPath = co.getProperty('server.contextPath', String, null)
     }
+
+    private static final class UnsupportedFilterChain implements FilterChain {
+        @Override
+        void doFilter(ServletRequest req, ServletResponse res) {
+            throw new UnsupportedOperationException()
+        }
+    }
 }
diff --git 
a/grails-test-examples/spring-security/core/functional-test-app/grails-app/controllers/HackController.groovy
 
b/grails-test-examples/spring-security/core/functional-test-app/grails-app/controllers/HackController.groovy
index 3f9d8002ec..7d61288ffd 100644
--- 
a/grails-test-examples/spring-security/core/functional-test-app/grails-app/controllers/HackController.groovy
+++ 
b/grails-test-examples/spring-security/core/functional-test-app/grails-app/controllers/HackController.groovy
@@ -28,7 +28,7 @@ class HackController {
        def userCache
 
        def getSessionValue(String name) {
-               def value = session[name]
+               def value = session.getAttribute(name)
                render value ? value.toString() : ''
        }