(shiro) 01/02: bugfix(aspectj): added handling for annotations for class with static methods

[lp...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git

commit 4a52195b7d96840feae579976648e204de891e68
Author: lprimak <le...@flowlogix.com>
AuthorDate: Fri Aug 21 19:37:32 2026 -0500

    bugfix(aspectj): added handling for annotations for class with static methods
---
 .../shiro/aop/DefaultAnnotationResolver.java       |  4 +--
 .../org/apache/shiro/aspectj/DummyServiceTest.java |  7 +++++
 .../apache/shiro/aspectj/StaticDummyService.java   | 32 ++++++++++++++++++++++
 3 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/org/apache/shiro/aop/DefaultAnnotationResolver.java b/core/src/main/java/org/apache/shiro/aop/DefaultAnnotationResolver.java
index 3c76bacb6..c7784836b 100644
--- a/core/src/main/java/org/apache/shiro/aop/DefaultAnnotationResolver.java
+++ b/core/src/main/java/org/apache/shiro/aop/DefaultAnnotationResolver.java
@@ -62,8 +62,8 @@ public class DefaultAnnotationResolver implements AnnotationResolver {
         Annotation annotation = m.getAnnotation(clazz);
         if (annotation == null) {
             Object miThis = mi.getThis();
-            //SHIRO-473 - miThis could be null for static methods, just return null
-            annotation = miThis != null ? getAnnotationFromClassHierarchy(miThis.getClass(), clazz) : null;
+            Class<?> targetClass = miThis != null ? miThis.getClass() : m.getDeclaringClass();
+            annotation = getAnnotationFromClassHierarchy(targetClass, clazz);
         }
         return annotation;
     }
diff --git a/support/aspectj/src/test/java/org/apache/shiro/aspectj/DummyServiceTest.java b/support/aspectj/src/test/java/org/apache/shiro/aspectj/DummyServiceTest.java
index 53779b826..2a243f5b2 100644
--- a/support/aspectj/src/test/java/org/apache/shiro/aspectj/DummyServiceTest.java
+++ b/support/aspectj/src/test/java/org/apache/shiro/aspectj/DummyServiceTest.java
@@ -203,4 +203,11 @@ public class DummyServiceTest {
         restrictedService.retrieve();
     }
 
+    @Test
+    void testStaticMethodOnClassLevelRequiresRoles_asUser() throws Exception {
+        assertThatExceptionOfType(UnauthorizedException.class).isThrownBy(() -> {
+            loginAsUser();
+            StaticDummyService.staticAdminOnly();
+        });
+    }
 }
diff --git a/support/aspectj/src/test/java/org/apache/shiro/aspectj/StaticDummyService.java b/support/aspectj/src/test/java/org/apache/shiro/aspectj/StaticDummyService.java
new file mode 100644
index 000000000..eb19b3c25
--- /dev/null
+++ b/support/aspectj/src/test/java/org/apache/shiro/aspectj/StaticDummyService.java
@@ -0,0 +1,32 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.shiro.aspectj;
+
+import org.apache.shiro.authz.annotation.RequiresRoles;
+
+@RequiresRoles("admin")
+public class StaticDummyService {
+    public static void staticAdminOnly() {
+        // no-op
+    }
+
+    public void instanceAdminOnly() {
+        // no-op
+    }
+}