This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro.git
commit b8b883cc27af4a71945db7ba5951230e52fe8dc6 Author: lprimak <[email protected]> AuthorDate: Fri Aug 21 20:07:26 2026 -0500 bugfix(aop): make annotation processing consistent in all cases (method annotations override class ones, not add) --- .../main/java/org/apache/shiro/cdi/AopHelper.java | 23 +++++++++------------- .../web/jaxrs/ShiroAnnotationFilterFeature.java | 7 +++---- 2 files changed, 12 insertions(+), 18 deletions(-) diff --git a/support/cdi/src/main/java/org/apache/shiro/cdi/AopHelper.java b/support/cdi/src/main/java/org/apache/shiro/cdi/AopHelper.java index fc6ea6a90..7f211f197 100644 --- a/support/cdi/src/main/java/org/apache/shiro/cdi/AopHelper.java +++ b/support/cdi/src/main/java/org/apache/shiro/cdi/AopHelper.java @@ -83,25 +83,20 @@ class AopHelper { */ static List<SecurityInterceptor> createSecurityInterceptors(Method method, Class<?> clazz) { List<SecurityInterceptor> result = new ArrayList<>(); + boolean checkClassAnnotations = isInterceptOnClassAnnotation(method.getModifiers()); - if (isInterceptOnClassAnnotation(method.getModifiers())) { - for (Class<? extends Annotation> ac - : getAuthorizationAnnotationClasses()) { - Annotation annotationOnClass = clazz.getAnnotation(ac); - if (annotationOnClass != null) { - result.add(new SecurityInterceptor(annotationOnClass)); + for (Class<? extends Annotation> ac : getAuthorizationAnnotationClasses()) { + Annotation methodAnnotation = method.getAnnotation(ac); + if (methodAnnotation != null) { + result.add(new SecurityInterceptor(methodAnnotation)); + } else if (checkClassAnnotations) { + Annotation classAnnotation = clazz.getAnnotation(ac); + if (classAnnotation != null) { + result.add(new SecurityInterceptor(classAnnotation)); } } } - for (Class<? extends Annotation> ac - : getAuthorizationAnnotationClasses()) { - Annotation annotation = method.getAnnotation(ac); - if (annotation != null) { - result.add(new SecurityInterceptor(annotation)); - } - } - return result; } diff --git a/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/ShiroAnnotationFilterFeature.java b/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/ShiroAnnotationFilterFeature.java index 536545629..4e24ba0b1 100644 --- a/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/ShiroAnnotationFilterFeature.java +++ b/support/jaxrs/src/main/java/org/apache/shiro/web/jaxrs/ShiroAnnotationFilterFeature.java @@ -69,14 +69,13 @@ public class ShiroAnnotationFilterFeature implements DynamicFeature { for (Class<? extends Annotation> annotationClass : annotations) { // XXX What is the performance of getAnnotation vs getAnnotations? - Annotation classAuthzSpec = resourceInfo.getResourceClass().getAnnotation(annotationClass); Annotation methodAuthzSpec = resourceInfo.getResourceMethod().getAnnotation(annotationClass); + Annotation classAuthzSpec = resourceInfo.getResourceClass().getAnnotation(annotationClass); - if (classAuthzSpec != null) { - authzSpecs.add(classAuthzSpec); - } if (methodAuthzSpec != null) { authzSpecs.add(methodAuthzSpec); + } else if (classAuthzSpec != null) { + authzSpecs.add(classAuthzSpec); } }
