Java SpelEvaluationException: EL1007E:(pos 43): 在 null 上找不到字段或属性“组”

SpelEvaluationException: EL1007E:(pos 43): Field or property 'group' cannot be found on null

提问by hemantvsn

I have SPRING METHOD security fully configured for my web application. (with PRE/POST annotations enabled).

我为我的 Web 应用程序完全配置了 SPRING METHOD 安全性。（启用 PRE/POST 注释）。

However recently I encountered a strange issue with them. Summary as follows:

但是最近我遇到了一个奇怪的问题。总结如下：

1. Summary of POJOS

   // User Class
   public class User {
       int id;
       String name;
       // getters and setters
   }
   
   // Group Class
   public class Group {
       int id;
       String name;
       // getters and setters
   }
   
   // GroupMembership class
   public class GroupMembership {
       private int id;
       private User user;
       private Group group;
       // getters and setters
   }
   

2. PreAuthorise filter on method .

   @PreAuthorize("canIEditGroupProfile(#membership.group.id)")
   public int updateGroupMembership(GroupMembership membership)
       throws GroupsServiceException;
   

1. POJOS 总结

   // User Class
   public class User {
       int id;
       String name;
       // getters and setters
   }
   
   // Group Class
   public class Group {
       int id;
       String name;
       // getters and setters
   }
   
   // GroupMembership class
   public class GroupMembership {
       private int id;
       private User user;
       private Group group;
       // getters and setters
   }
   

2. 对方法的 PreAuthorise 过滤器。

   @PreAuthorize("canIEditGroupProfile(#membership.group.id)")
   public int updateGroupMembership(GroupMembership membership)
       throws GroupsServiceException;
   

Upon passing a fully populated GroupMembershipobject (proper user and group compositions present), the security filter throws following exception:

在传递完全填充的GroupMembership对象（存在正确的用户和组组合）时，安全过滤器会引发以下异常：

errorMessage: "Failed to evaluate expression
    canIEditGroupProfile(#membership.group.id)'"

Upon digging into the exception:

在深入研究异常后：

The cause is found to be:

查明原因是：

org.springframework.expression.spel.SpelEvaluationException:
    EL1007E:(pos 33): Field or property 'group' cannot be found on null

Please provide pointers to address the same.

请提供指向相同地址的指针。

回答by hemantvsn

getter/setters seems fine... also no case of null.

getter/setter 似乎很好......也没有null.

However a interesting observation; this one gives me an error:

然而，一个有趣的观察；这个给了我一个错误：

@PreAuthorize("canIEditGroupProfile(#membership.group.id)")
public int updateGroupMembership(GroupMembership membership)
    throws GroupsServiceException; 

This works fine:

这工作正常：

@PreAuthorize("canIEditGroupProfile(#groupmembership.group.id)")
public int updateGroupMembership(GroupMembership groupmembership)
    throws GroupsServiceException;

Further I observed, the parameter name was mismatching in case of first (i.e Service and ServiceImpl both had different parameter names).

我进一步观察到，参数名称在第一种情况下不匹配（即 Service 和 ServiceImpl 都有不同的参数名称）。

Now maintaining the uniformity, the issue seems to be fixed.

现在保持统一性，问题似乎已解决。

回答by Michael Piefel

As @zeroflagL asked: Are you compiling without debug information? This is likely the same issue as spring @Cacheable with Ehcache, spel find null for valid objectand Spring @Cacheable with SpEL key: always evaluates to null– check your POM (or Eclipse configuration or whatever) for your debug configuration, for instance <debug>false</debug>in the maven-compiler-plugin.

正如@zeroflagL 所问：您是否在没有调试信息的情况下进行编译？这可能与带有 Ehcache 的 spring @Cacheable相同的问题，spel find null for valid object和Spring @Cacheable with SpEL 键：始终评估为 null– 检查您的 POM（或 Eclipse 配置或其他）的调试配置，例如<debug>false</debug>在的maven-compiler-plugin。

回答by alonso_50

I got the same issue in my Spring Boot application. It turned out that I was compiling without my debug symbols information, as it is mentioned in a comment above. I would like to remark that I could fix the issue in two ways:

我在 Spring Boot 应用程序中遇到了同样的问题。事实证明，我在没有调试符号信息的情况下进行编译，如上面的评论中所述。我想说的是，我可以通过两种方式解决这个问题：

1.(My favourite one): Just include this in your pom.xml --> plugins

1.（我最喜欢的）：只需将其包含在您的 pom.xml --> 插件中

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-compiler-plugin</artifactId>
    <configuration>
       <compilerArgument>-parameters</compilerArgument>
       <testCompilerArgument>-parameters</testCompilerArgument>
    </configuration>
</plugin>

1. If you are using Java 1.8 and Eclipse as an IDE, go to your Project Properties --> Java Compile --> check "Store information about method parameters (usable via reflection)".

2. 如果您使用 Java 1.8 和 Eclipse 作为 IDE，请转到您的项目属性 --> Java 编译 --> 选中“存储有关方法参数的信息（可通过反射使用）”。

I found really interesting this linkto know more about the issue.

我发现这个链接真的很有趣，可以了解更多关于这个问题的信息。

Hope it helps!

希望能帮助到你！

回答by Emanuele

I had the same issue and found that the name of the object to check the authorization against must be the same in the interface and implementation.

我遇到了同样的问题，发现用于检查授权的对象的名称在接口和实现中必须相同。

For example if you have this method in your interface:

例如，如果您的界面中有此方法：

@PreAuthorize("hasPermission(#foo, 'UPDATE')")
public void testMethod(MyObject foo);

you should have the following in the implementation:

您应该在实现中具有以下内容：

public void testMethod(MyObject foo) { ... your code here... }

I hope this helps.

我希望这有帮助。