From b77cc0df74754091710eb247a71b1367c37f5fe6 Mon Sep 17 00:00:00 2001
From: Manuel Siggen <manuel@siggen.ch>
Date: Thu, 16 Apr 2026 08:03:31 +0200
Subject: [PATCH] Allow injection of custom PermissionEvaluator in
 PrePostMethodSecurityConfiguration.

Closes gh-19084

Signed-off-by: Manuel Siggen <manuel@siggen.ch>
---
 .../PrePostMethodSecurityConfiguration.java              | 6 ++++++
 .../PrePostMethodSecurityConfigurationTests.java         | 9 ++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java
index 990c3ffa6e5..5af3a8948c9 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java
@@ -32,6 +32,7 @@
 import org.springframework.context.annotation.ImportAware;
 import org.springframework.context.annotation.Role;
 import org.springframework.core.type.AnnotationMetadata;
+import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -127,6 +128,11 @@ void setAuthorizationManagerFactory(AuthorizationManagerFactory<MethodInvocation
 		this.expressionHandler.setAuthorizationManagerFactory(authorizationManagerFactory);
 	}
 
+	@Autowired(required = false)
+	void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
+		this.expressionHandler.setPermissionEvaluator(permissionEvaluator);
+	}
+
 	@Autowired(required = false)
 	void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
 		this.preFilterMethodInterceptor.setTemplateDefaults(templateDefaults);
diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java
index d48047980ec..9c4ca90b1bd 100644
--- a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java
+++ b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java
@@ -1527,13 +1527,13 @@ MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
 
 	}
 
+	@Configuration
 	@EnableMethodSecurity
 	static class CustomPermissionEvaluatorConfig {
 
 		@Bean
-		MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
-			DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
-			expressionHandler.setPermissionEvaluator(new PermissionEvaluator() {
+		PermissionEvaluator permissionEvaluator() {
+			return new PermissionEvaluator() {
 				@Override
 				public boolean hasPermission(Authentication authentication, Object targetDomainObject,
 						Object permission) {
@@ -1545,8 +1545,7 @@ public boolean hasPermission(Authentication authentication, Serializable targetI
 						Object permission) {
 					throw new UnsupportedOperationException();
 				}
-			});
-			return expressionHandler;
+			};
 		}
 
 	}