SEC-1507: Applied patch to return empty authority list rather than null from RoleHierarchyImpl.

core/src/main/java/org/springframework/security/access/hierarchicalroles/RoleHierarchyImpl.java

@@ -29,6 +29,7 @@ import java.util.regex.Pattern;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.authority.GrantedAuthorityImpl;
 
 /**
@@ -106,7 +107,7 @@ public class RoleHierarchyImpl implements RoleHierarchy {
 
     public Collection<GrantedAuthority> getReachableGrantedAuthorities(Collection<GrantedAuthority> authorities) {
         if (authorities == null || authorities.isEmpty()) {
-            return null;
+            return AuthorityUtils.NO_AUTHORITIES;
         }
 
         Set<GrantedAuthority> reachableRoles = new HashSet<GrantedAuthority>();

core/src/test/java/org/springframework/security/access/hierarchicalroles/RoleHierarchyImplTests.java

@@ -14,6 +14,7 @@
 
 package org.springframework.security.access.hierarchicalroles;
 
+import java.util.ArrayList;
 import java.util.List;
 
 import junit.framework.TestCase;
@@ -30,6 +31,19 @@ import org.springframework.security.core.authority.AuthorityUtils;
  */
 public class RoleHierarchyImplTests extends TestCase {
 
+    public void testRoleHierarchyWithNullOrEmptyAuthorities() {
+        List<GrantedAuthority> authorities0 = null;
+        List<GrantedAuthority> authorities1 = new ArrayList<GrantedAuthority>();
+
+        RoleHierarchyImpl roleHierarchyImpl = new RoleHierarchyImpl();
+        roleHierarchyImpl.setHierarchy("ROLE_A > ROLE_B");
+
+        assertNotNull(roleHierarchyImpl.getReachableGrantedAuthorities(authorities0));
+        assertEquals(0, roleHierarchyImpl.getReachableGrantedAuthorities(authorities0).size());
+        assertNotNull(roleHierarchyImpl.getReachableGrantedAuthorities(authorities1));
+        assertEquals(0, roleHierarchyImpl.getReachableGrantedAuthorities(authorities1).size());
+    }
+
     public void testSimpleRoleHierarchy() {
 
         List<GrantedAuthority> authorities0 = AuthorityUtils.createAuthorityList("ROLE_0");