From fca704e61f80e1959fa3034a84eafe1ebe7c4b4c Mon Sep 17 00:00:00 2001
From: Rob Winch <362503+rwinch@users.noreply.github.com>
Date: Mon, 21 Jul 2025 09:01:48 -0500
Subject: [PATCH] Fix getConfigurersInInitializing Semantics

A getter should not mutate state. This removes getConfigurersInInitializing
in favor of inline code since this is just used once.

Issue gh-17020 gh-17011

Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>
---
 .../AbstractConfiguredSecurityBuilder.java           | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java b/config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java
index 2fd72457c2..29b4e7be14 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java
@@ -60,7 +60,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 
 	private final LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>> configurers = new LinkedHashMap<>();
 
-	private final List<SecurityConfigurer<O, B>> configurersAddedInInitializing = new ArrayList<>();
+	private List<SecurityConfigurer<O, B>> configurersAddedInInitializing = new ArrayList<>();
 
 	private final Map<Class<?>, Object> sharedObjects = new HashMap<>();
 
@@ -388,7 +388,9 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 			configurer.init((B) this);
 		}
 		while (!this.configurersAddedInInitializing.isEmpty()) {
-			for (SecurityConfigurer<O, B> configurer : getConfigurersInInitializing()) {
+			List<SecurityConfigurer<O, B>> toInit = this.configurersAddedInInitializing;
+			this.configurersAddedInInitializing = new ArrayList<>();
+			for (SecurityConfigurer<O, B> configurer : toInit) {
 				configurer.init((B) this);
 			}
 		}
@@ -410,12 +412,6 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		return result;
 	}
 
-	private List<SecurityConfigurer<O, B>> getConfigurersInInitializing() {
-		List<SecurityConfigurer<O, B>> result = new ArrayList<>(this.configurersAddedInInitializing);
-		this.configurersAddedInInitializing.clear();
-		return result;
-	}
-
 	/**
 	 * Determines if the object is unbuilt.
 	 * @return true, if unbuilt else false