Spring Security Self-Invocation

ID

java.spring_security_self_invocation

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

reliability, spring

Description

Reports methods that call another method in the same class that is annotated with @PreAuthorize, @PostAuthorize, @PreFilter, or @PostFilter. Spring Security relies on AOP proxies to enforce these annotations, but self-invocation bypasses the proxy and the security check is never executed.

Rationale

Spring creates proxies around beans to intercept method calls and enforce security annotations. However, when a method calls another method on this, the call goes directly to the object instead of through the proxy, so the security annotation is silently ignored.

@Service
public class OrderService {
    @PreAuthorize("hasRole('ADMIN')")
    public void deleteOrder(Long id) { ... }

    public void cleanup() {
        deleteOrder(oldId); // Bug: @PreAuthorize is bypassed
    }
}

Remediation

Extract the secured method into a separate bean, inject the bean into itself, or use AopContext.currentProxy().

@Service
public class OrderService {
    @Autowired private OrderSecurityService securityService;

    public void cleanup() {
        securityService.deleteOrder(oldId); // Now goes through proxy
    }
}

References