Prevent circular ACL parent relationships

Contribution Overview

The Engineering Context

This contribution was made to the spring-projects/spring-securityopen-source repository. The work involved understanding the existing codebase, identifying the underlying engineering problem, implementing a focused solution, and validating the change against the project's existing behaviour and testing standards.

Original Issue

Circular parent relationships could be created in ACL hierarchies.

AclImpl#setParent prevented only direct self-parenting, allowing indirect cycles to be introduced through existing parent relationships.

Engineering Problem

Understanding the Problem

ACL parent validation only rejected an ACL being assigned as its own direct parent. Indirect cycles could still be created, resulting in circular ACL hierarchies.

Solution

Implementation Approach

Updated AclImpl#setParent to walk the proposed parent's existing hierarchy and reject the operation when the current ACL is encountered. Added regression tests for both direct and indirect circular parent relationships.

Technologies

Engineering Stack