SEC-3034: AclPermissionEvaluator specifies Locale.ENGLISH

acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java

@@ -3,6 +3,7 @@ package org.springframework.security.acls;
 import java.io.Serializable;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Locale;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -121,8 +122,9 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 
             try {
                 p = permissionFactory.buildFromName(permString);
-            } catch(IllegalArgumentException notfound) {
+            }
-                p = permissionFactory.buildFromName(permString.toUpperCase());
+            catch (IllegalArgumentException notfound) {
+                p = permissionFactory.buildFromName(permString.toUpperCase(Locale.ENGLISH));
             }
 
             if (p != null) {

acl/src/test/java/org/springframework/security/acls/AclPermissionEvaluatorTests.java

@@ -4,6 +4,8 @@ import static org.junit.Assert.assertTrue;
 import static org.mockito.Matchers.*;
 import static org.mockito.Mockito.*;
 
+import java.util.Locale;
+
 import org.junit.Test;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AclService;
@@ -36,4 +38,26 @@ public class AclPermissionEvaluatorTests {
 
         assertTrue(pe.hasPermission(mock(Authentication.class), new Object(), "READ"));
     }
+
+    @Test
+    public void resolvePermissionNonEnglishLocale() {
+        Locale systemLocale = Locale.getDefault();
+        Locale.setDefault(new Locale("tr"));
+
+        AclService service = mock(AclService.class);
+        AclPermissionEvaluator pe = new AclPermissionEvaluator(service);
+        ObjectIdentity oid = mock(ObjectIdentity.class);
+        ObjectIdentityRetrievalStrategy oidStrategy = mock(ObjectIdentityRetrievalStrategy.class);
+        when(oidStrategy.getObjectIdentity(anyObject())).thenReturn(oid);
+        pe.setObjectIdentityRetrievalStrategy(oidStrategy);
+        pe.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
+        Acl acl = mock(Acl.class);
+
+        when(service.readAclById(any(ObjectIdentity.class), anyList())).thenReturn(acl);
+        when(acl.isGranted(anyList(), anyList(), eq(false))).thenReturn(true);
+
+        assertTrue(pe.hasPermission(mock(Authentication.class), new Object(), "write"));
+
+        Locale.setDefault(systemLocale);
+    }
 }