Consistent validation of annotated methods behind AOP proxies [SPR-13816]

[spring-projects-issues]

Piotr Findeisen opened SPR-13816 and commented

steps to reproduce

• annotate a private method with @EventListener
• make sure the bean is proxied, e.g. due to @Transactional
• publish event

observed

• the non-overriden method on proxy is called

expected

• either this is supported and the method is called on actual instance, not on the proxy (like @Autowired)
• OR forbidden, detected and reported with an explicit exception during context start

---

Affects: 4.2.2

Issue Links:

• Scheduled method is not invoked via proxy [SPR-13914] #18488 Scheduled method is not invoked via proxy
• Validate @RequestMapping methods on AOP proxies [SPR-13842] #18415 Validate @RequestMapping methods on AOP proxies

Referenced from: commits 826a00a, 470ea97

[spring-projects-issues]

Juergen Hoeller commented

Good catch. We are validating @Scheduled on private methods already but not so for @JmsListener and @EventListener yet. Since such methods may lurk around in existing codebases without any effect (i.e. never invoked if no corresponding messages or events come in), I'd rather consistently validate and reject such invalid annotated callback methods as of 4.3 only.

As a detail, we actually just need to reject private non-static methods, since private static methods can get reliably invoked even against a CGLIB proxy class.

Juergen