sonatype/security — pull request #24 by mcculls (2013-03-20 04:15:37+00:00)
Title: Fix mediator registration

FilterChainManagerProvider implements Mediator\ and therefore the key used to register it with the container should match, ie. Key.get(Filter.class, Named.class). Unfortunately the compiler can't catch this because the com.google.inject.Key generic signature doesn't encode the qualifier type. (note to self: I should look into enforcing this at runtime in the container instead.)

With the current registration of Key.get(Filter.class) the mediator could receive Filters annotated with non-Named annotations. This would cause a ClassCastException when the annotation was implicitly cast to Named, which would be caught by the container and logged as a warning. However this would _not_ break/stop the application, since the mediation call is initiated by the container.

Alternatively the key could have been left as Key.get(Filter.class) and the type parameters changed to Mediator\, but then you'd need a way to map any old Annotation to a filter-name.