diff --git a/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java b/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java index e3f12de4ae..21f5961ed1 100644 --- a/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java +++ b/config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java @@ -34,6 +34,7 @@ import java.nio.file.Paths; import java.time.Instant; import java.util.ArrayList; +import java.util.Arrays; import java.util.Collection; import java.util.Date; import java.util.HashMap; @@ -42,7 +43,6 @@ import java.util.Locale; import java.util.Map; import java.util.Set; -import java.util.stream.Collectors; import java.util.stream.Stream; import jakarta.servlet.http.Cookie; @@ -762,7 +762,7 @@ static Stream getFilesToDeserialize() throws IOException { } @Test - void listClassesMissingSerialVersion() throws Exception { + void allSerializableClassesShouldHaveSerialVersionOrSuppressWarnings() throws Exception { ClassPathScanningCandidateComponentProvider provider = new ClassPathScanningCandidateComponentProvider(false); provider.addIncludeFilter(new AssignableTypeFilter(Serializable.class)); List> classes = new ArrayList<>(); @@ -770,10 +770,6 @@ void listClassesMissingSerialVersion() throws Exception { Set components = provider.findCandidateComponents("org/springframework/security"); for (BeanDefinition component : components) { Class clazz = Class.forName(component.getBeanClassName()); - boolean isAbstract = Modifier.isAbstract(clazz.getModifiers()); - if (isAbstract) { - continue; - } if (clazz.isEnum()) { continue; } @@ -783,15 +779,16 @@ void listClassesMissingSerialVersion() throws Exception { boolean hasSerialVersion = Stream.of(clazz.getDeclaredFields()) .map(Field::getName) .anyMatch((n) -> n.equals("serialVersionUID")); - if (!hasSerialVersion) { + SuppressWarnings suppressWarnings = clazz.getAnnotation(SuppressWarnings.class); + boolean hasSerialIgnore = suppressWarnings == null + || Arrays.asList(suppressWarnings.value()).contains("Serial"); + if (!hasSerialVersion && !hasSerialIgnore) { classes.add(clazz); } } - if (!classes.isEmpty()) { - System.out - .println("Found " + classes.size() + " Serializable classes that don't declare a seriallVersionUID"); - System.out.println(classes.stream().map(Class::getName).collect(Collectors.joining("\r\n"))); - } + assertThat(classes) + .describedAs("Found Serializable classes that are either missing a serialVersionUID or a @SuppressWarnings") + .isEmpty(); } static Stream> getClassesToSerialize() throws Exception {