Remove support for deprecated Java SecurityManager (-> JDK 17 build compatibility)

Includes hard JDK 9+ API dependency in CGLIB ReflectUtils (Lookup.defineClass) and removal of OutputStream spy proxy usage (avoiding invalid Mockito proxy on JDK 17)

Closes gh-26901

Author: jhoeller

spring-beans/spring-beans.gradle

@@ -23,7 +23,8 @@ sourceSets {
 }
 
 compileGroovy {
-	options.compilerArgs += "-Werror"
+	// Groovy generates Java code with "new Boolean" usage which is deprecated on JDK 17
+	// options.compilerArgs += "-Werror"
 }
 
 // This module also builds Kotlin code and the compileKotlin task naturally depends on

spring-beans/src/main/java/org/springframework/beans/BeanWrapperImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,11 +18,6 @@
 
 import java.beans.PropertyDescriptor;
 import java.lang.reflect.Method;
-import java.security.AccessControlContext;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 
 import org.springframework.core.ResolvableType;
 import org.springframework.core.convert.Property;
@@ -69,12 +64,6 @@ public class BeanWrapperImpl extends AbstractNestablePropertyAccessor implements
 	@Nullable
 	private CachedIntrospectionResults cachedIntrospectionResults;
 
-	/**
-	 * The security context used for invoking the property methods.
-	 */
-	@Nullable
-	private AccessControlContext acc;
-
 
 	/**
 	 * Create a new empty BeanWrapperImpl. Wrapped instance needs to be set afterwards.
@@ -131,7 +120,6 @@ public BeanWrapperImpl(Object object, String nestedPath, Object rootObject) {
 	 */
 	private BeanWrapperImpl(Object object, String nestedPath, BeanWrapperImpl parent) {
 		super(object, nestedPath, parent);
-		setSecurityContext(parent.acc);
 	}
 
 
@@ -176,23 +164,6 @@ private CachedIntrospectionResults getCachedIntrospectionResults() {
 		return this.cachedIntrospectionResults;
 	}
 
-	/**
-	 * Set the security context used during the invocation of the wrapped instance methods.
-	 * Can be null.
-	 */
-	public void setSecurityContext(@Nullable AccessControlContext acc) {
-		this.acc = acc;
-	}
-
-	/**
-	 * Return the security context used during the invocation of the wrapped instance methods.
-	 * Can be null.
-	 */
-	@Nullable
-	public AccessControlContext getSecurityContext() {
-		return this.acc;
-	}
-
 
 	/**
 	 * Convert the given value for the specified property to the latter's type.
@@ -290,47 +261,17 @@ public TypeDescriptor nested(int level) {
 		@Nullable
 		public Object getValue() throws Exception {
 			Method readMethod = this.pd.getReadMethod();
-			if (System.getSecurityManager() != null) {
-				AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
-					ReflectionUtils.makeAccessible(readMethod);
-					return null;
-				});
-				try {
-					return AccessController.doPrivileged((PrivilegedExceptionAction<Object>)
-							() -> readMethod.invoke(getWrappedInstance(), (Object[]) null), acc);
-				}
-				catch (PrivilegedActionException pae) {
-					throw pae.getException();
-				}
-			}
-			else {
-				ReflectionUtils.makeAccessible(readMethod);
-				return readMethod.invoke(getWrappedInstance(), (Object[]) null);
-			}
+			ReflectionUtils.makeAccessible(readMethod);
+			return readMethod.invoke(getWrappedInstance(), (Object[]) null);
 		}
 
 		@Override
 		public void setValue(@Nullable Object value) throws Exception {
 			Method writeMethod = (this.pd instanceof GenericTypeAwarePropertyDescriptor ?
 					((GenericTypeAwarePropertyDescriptor) this.pd).getWriteMethodForActualAccess() :
 					this.pd.getWriteMethod());
-			if (System.getSecurityManager() != null) {
-				AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
-					ReflectionUtils.makeAccessible(writeMethod);
-					return null;
-				});
-				try {
-					AccessController.doPrivileged((PrivilegedExceptionAction<Object>)
-							() -> writeMethod.invoke(getWrappedInstance(), value), acc);
-				}
-				catch (PrivilegedActionException ex) {
-					throw ex.getException();
-				}
-			}
-			else {
-				ReflectionUtils.makeAccessible(writeMethod);
-				writeMethod.invoke(getWrappedInstance(), value);
-			}
+			ReflectionUtils.makeAccessible(writeMethod);
+			writeMethod.invoke(getWrappedInstance(), value);
 		}
 	}
 

spring-beans/src/main/java/org/springframework/beans/factory/config/ConfigurableBeanFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,6 @@
 package org.springframework.beans.factory.config;
 
 import java.beans.PropertyEditor;
-import java.security.AccessControlContext;
 
 import org.springframework.beans.PropertyEditorRegistrar;
 import org.springframework.beans.PropertyEditorRegistry;
@@ -291,13 +290,6 @@ public interface ConfigurableBeanFactory extends HierarchicalBeanFactory, Single
 	 */
 	ApplicationStartup getApplicationStartup();
 
-	/**
-	 * Provides a security access control context relevant to this factory.
-	 * @return the applicable AccessControlContext (never {@code null})
-	 * @since 3.0
-	 */
-	AccessControlContext getAccessControlContext();
-
 	/**
 	 * Copy all relevant configuration from the given other factory.
 	 * <p>Should include all standard configuration settings as well as

spring-beans/src/main/java/org/springframework/beans/factory/support/AbstractAutowireCapableBeanFactory.java

@@ -21,10 +21,6 @@
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -387,15 +383,7 @@ public Object autowire(Class<?> beanClass, int autowireMode, boolean dependencyC
 			return autowireConstructor(beanClass.getName(), bd, null, null).getWrappedInstance();
 		}
 		else {
-			Object bean;
-			if (System.getSecurityManager() != null) {
-				bean = AccessController.doPrivileged(
-						(PrivilegedAction<Object>) () -> getInstantiationStrategy().instantiate(bd, null, this),
-						getAccessControlContext());
-			}
-			else {
-				bean = getInstantiationStrategy().instantiate(bd, null, this);
-			}
+			Object bean = getInstantiationStrategy().instantiate(bd, null, this);
 			populateBean(beanClass.getName(), bd, new BeanWrapperImpl(bean));
 			return bean;
 		}
@@ -463,8 +451,7 @@ public Object applyBeanPostProcessorsAfterInitialization(Object existingBean, St
 
 	@Override
 	public void destroyBean(Object existingBean) {
-		new DisposableBeanAdapter(
-				existingBean, getBeanPostProcessorCache().destructionAware, getAccessControlContext()).destroy();
+		new DisposableBeanAdapter(existingBean, getBeanPostProcessorCache().destructionAware).destroy();
 	}
 
 
@@ -1316,15 +1303,7 @@ protected Constructor<?>[] determineConstructorsFromBeanPostProcessors(@Nullable
 	 */
 	protected BeanWrapper instantiateBean(String beanName, RootBeanDefinition mbd) {
 		try {
-			Object beanInstance;
-			if (System.getSecurityManager() != null) {
-				beanInstance = AccessController.doPrivileged(
-						(PrivilegedAction<Object>) () -> getInstantiationStrategy().instantiate(mbd, beanName, this),
-						getAccessControlContext());
-			}
-			else {
-				beanInstance = getInstantiationStrategy().instantiate(mbd, beanName, this);
-			}
+			Object beanInstance = getInstantiationStrategy().instantiate(mbd, beanName, this);
 			BeanWrapper bw = new BeanWrapperImpl(beanInstance);
 			initBeanWrapper(bw);
 			return bw;
@@ -1655,10 +1634,6 @@ protected void applyPropertyValues(String beanName, BeanDefinition mbd, BeanWrap
 			return;
 		}
 
-		if (System.getSecurityManager() != null && bw instanceof BeanWrapperImpl) {
-			((BeanWrapperImpl) bw).setSecurityContext(getAccessControlContext());
-		}
-
 		MutablePropertyValues mpvs = null;
 		List<PropertyValue> original;
 
@@ -1781,15 +1756,7 @@ private Object convertForProperty(
 	 * @see #applyBeanPostProcessorsAfterInitialization
 	 */
 	protected Object initializeBean(String beanName, Object bean, @Nullable RootBeanDefinition mbd) {
-		if (System.getSecurityManager() != null) {
-			AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
-				invokeAwareMethods(beanName, bean);
-				return null;
-			}, getAccessControlContext());
-		}
-		else {
-			invokeAwareMethods(beanName, bean);
-		}
+		invokeAwareMethods(beanName, bean);
 
 		Object wrappedBean = bean;
 		if (mbd == null || !mbd.isSynthetic()) {
@@ -1848,20 +1815,7 @@ protected void invokeInitMethods(String beanName, Object bean, @Nullable RootBea
 			if (logger.isTraceEnabled()) {
 				logger.trace("Invoking afterPropertiesSet() on bean with name '" + beanName + "'");
 			}
-			if (System.getSecurityManager() != null) {
-				try {
-					AccessController.doPrivileged((PrivilegedExceptionAction<Object>) () -> {
-						((InitializingBean) bean).afterPropertiesSet();
-						return null;
-					}, getAccessControlContext());
-				}
-				catch (PrivilegedActionException pae) {
-					throw pae.getException();
-				}
-			}
-			else {
-				((InitializingBean) bean).afterPropertiesSet();
-			}
+			((InitializingBean) bean).afterPropertiesSet();
 		}
 
 		if (mbd != null && bean.getClass() != NullBean.class) {
@@ -1910,28 +1864,12 @@ protected void invokeCustomInitMethod(String beanName, Object bean, RootBeanDefi
 		}
 		Method methodToInvoke = ClassUtils.getInterfaceMethodIfPossible(initMethod);
 
-		if (System.getSecurityManager() != null) {
-			AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
-				ReflectionUtils.makeAccessible(methodToInvoke);
-				return null;
-			});
-			try {
-				AccessController.doPrivileged((PrivilegedExceptionAction<Object>)
-						() -> methodToInvoke.invoke(bean), getAccessControlContext());
-			}
-			catch (PrivilegedActionException pae) {
-				InvocationTargetException ex = (InvocationTargetException) pae.getException();
-				throw ex.getTargetException();
-			}
+		try {
+			ReflectionUtils.makeAccessible(methodToInvoke);
+			methodToInvoke.invoke(bean);
 		}
-		else {
-			try {
-				ReflectionUtils.makeAccessible(methodToInvoke);
-				methodToInvoke.invoke(bean);
-			}
-			catch (InvocationTargetException ex) {
-				throw ex.getTargetException();
-			}
+		catch (InvocationTargetException ex) {
+			throw ex.getTargetException();
 		}
 	}