[#1585] Migrate to Jakarta EE 10 (3.x)

.github/workflows/maven.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Set up JDK
         uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
         with:
-          java-version: 11
+          java-version: 17
           distribution: temurin
 
       - name: License Check

config/core/src/main/java/org/apache/shiro/config/Ini.java

@@ -446,8 +446,7 @@ protected static String getSectionName(String line) {
     }
 
     public boolean equals(Object obj) {
-        if (obj instanceof Ini) {
-            Ini ini = (Ini) obj;
+        if (obj instanceof Ini ini) {
             return this.sections.equals(ini.sections);
         }
         return false;
@@ -710,8 +709,7 @@ public String toString() {
 
         @Override
         public boolean equals(Object obj) {
-            if (obj instanceof Section) {
-                Section other = (Section) obj;
+            if (obj instanceof Section other) {
                 return getName().equals(other.getName()) && this.props.equals(other.props);
             }
             return false;

config/ogdl/src/main/java/org/apache/shiro/config/ogdl/ReflectionBuilder.java

@@ -232,23 +232,23 @@ protected EventBus findEventBus(Map<String, ?> objects) {
 
         //prefer a named object first:
         Object value = objects.get(EVENT_BUS_NAME);
-        if (value instanceof EventBus) {
-            return (EventBus) value;
+        if (value instanceof EventBus bus) {
+            return bus;
         }
 
         //couldn't find a named 'eventBus' EventBus object.  Try to find the first typed value we can:
         for (Object v : objects.values()) {
-            if (v instanceof EventBus) {
-                return (EventBus) v;
+            if (v instanceof EventBus bus) {
+                return bus;
             }
         }
 
         return null;
     }
 
     private boolean applyEventBusIfNecessary(Object value) {
-        if (value instanceof EventBusAware) {
-            ((EventBusAware) value).setEventBus(this.eventBus);
+        if (value instanceof EventBusAware aware) {
+            aware.setEventBus(this.eventBus);
             return true;
         }
         return false;
@@ -357,8 +357,8 @@ protected void createNewInstance(Map<String, Object> objects, String name, Strin
         Object instance;
         try {
             instance = ClassUtils.newInstance(value);
-            if (instance instanceof Nameable) {
-                ((Nameable) instance).setName(name);
+            if (instance instanceof Nameable nameable) {
+                nameable.setName(name);
             }
         } catch (Exception e) {
             instance = alternateObjectSupplier.apply(value);
@@ -455,8 +455,8 @@ protected Object resolveReference(String reference) {
         String id = getId(reference);
         LOGGER.debug("Encountered object reference '{}'.  Looking up object with id '{}'", reference, id);
         final Object referencedObject = getReferencedObject(id);
-        if (referencedObject instanceof Factory) {
-            return ((Factory) referencedObject).getInstance();
+        if (referencedObject instanceof Factory factory) {
+            return factory.getInstance();
         }
         return referencedObject;
     }
@@ -492,8 +492,8 @@ protected Set<?> toSet(String sValue) {
         //SHIRO-423: check to see if the value is a referenced Set already, and if so, return it immediately:
         if (tokens.length == 1 && isReference(tokens[0])) {
             Object reference = resolveReference(tokens[0]);
-            if (reference instanceof Set) {
-                return (Set) reference;
+            if (reference instanceof Set set) {
+                return set;
             }
         }
 
@@ -518,8 +518,8 @@ protected Set<?> toSet(String sValue) {
         //SHIRO-423: check to see if the value is a referenced Map already, and if so, return it immediately:
         if (tokens.length == 1 && isReference(tokens[0])) {
             Object reference = resolveReference(tokens[0]);
-            if (reference instanceof Map) {
-                return (Map) reference;
+            if (reference instanceof Map map) {
+                return map;
             }
         }
 
@@ -556,8 +556,8 @@ protected Collection<?> toCollection(String sValue) {
         //SHIRO-423: check to see if the value is a referenced Collection already, and if so, return it immediately:
         if (tokens.length == 1 && isReference(tokens[0])) {
             Object reference = resolveReference(tokens[0]);
-            if (reference instanceof Collection) {
-                return (Collection) reference;
+            if (reference instanceof Collection collection) {
+                return collection;
             }
         }
 
@@ -579,8 +579,8 @@ protected List<?> toList(String sValue) {
         //SHIRO-423: check to see if the value is a referenced List already, and if so, return it immediately:
         if (tokens.length == 1 && isReference(tokens[0])) {
             Object reference = resolveReference(tokens[0]);
-            if (reference instanceof List) {
-                return (List) reference;
+            if (reference instanceof List list) {
+                return list;
             }
         }
 
@@ -806,8 +806,7 @@ public void add(Statement statement) {
             //we execute bean configuration statements in the order they are declared.
             statements.add(statement);
 
-            if (statement instanceof InstantiationStatement) {
-                InstantiationStatement is = (InstantiationStatement) statement;
+            if (statement instanceof InstantiationStatement is) {
                 beanConfigurations.add(new BeanConfiguration(is));
             } else {
                 AssignmentStatement as = (AssignmentStatement) statement;

core/src/main/java/org/apache/shiro/authc/AbstractAuthenticator.java

@@ -203,8 +203,8 @@ public final AuthenticationInfo authenticate(AuthenticationToken token) throws A
             }
         } catch (Throwable t) {
             AuthenticationException ae = null;
-            if (t instanceof AuthenticationException) {
-                ae = (AuthenticationException) t;
+            if (t instanceof AuthenticationException exception) {
+                ae = exception;
             }
             if (ae == null) {
                 //Exception thrown was not an expected AuthenticationException.  Therefore it is probably a little more

core/src/main/java/org/apache/shiro/authc/SimpleAccount.java

@@ -99,7 +99,7 @@ public SimpleAccount(Object principal, Object credentials, String realmName) {
      * @since 1.1
      */
     public SimpleAccount(Object principal, Object hashedCredentials, ByteSource credentialsSalt, String realmName) {
-        this(principal instanceof PrincipalCollection ? (PrincipalCollection) principal
+        this(principal instanceof PrincipalCollection pc ? pc
                         : ImmutablePrincipalCollection.ofSinglePrincipal(principal, realmName),
                 hashedCredentials, credentialsSalt);
     }
@@ -448,8 +448,7 @@ public void merge(AuthenticationInfo info) {
         authcInfo.merge(info);
 
         // Merge SimpleAccount specific info
-        if (info instanceof SimpleAccount) {
-            SimpleAccount otherAccount = (SimpleAccount) info;
+        if (info instanceof SimpleAccount otherAccount) {
             if (otherAccount.isLocked()) {
                 setLocked(true);
             }
@@ -482,8 +481,7 @@ public boolean equals(Object o) {
         if (o == this) {
             return true;
         }
-        if (o instanceof SimpleAccount) {
-            SimpleAccount sa = (SimpleAccount) o;
+        if (o instanceof SimpleAccount sa) {
             //principal should be unique across the application, so only check this for equality:
             return (getPrincipals() != null ? getPrincipals().equals(sa.getPrincipals()) : sa.getPrincipals() == null);
         }

core/src/main/java/org/apache/shiro/authc/SimpleAuthenticationInfo.java

@@ -23,6 +23,7 @@
 import org.apache.shiro.subject.ImmutablePrincipalCollection;
 import org.apache.shiro.subject.PrincipalCollection;
 
+import java.io.Serial;
 import java.util.Collection;
 import java.util.HashSet;
 import java.util.Objects;
@@ -38,6 +39,7 @@
  */
 public class SimpleAuthenticationInfo implements MergableAuthenticationInfo, SaltedAuthenticationInfo {
 
+    @Serial
     private static final long serialVersionUID = 5390456512469696779L;
     /**
      * The principals identifying the account associated with this AuthenticationInfo instance.
@@ -220,8 +222,8 @@ public void merge(AuthenticationInfo info) {
         //is null, then it can't hurt to pull in a non-null value if one exists.
         //
         //since 1.1:
-        if (this.credentialsSalt == null && info instanceof SaltedAuthenticationInfo) {
-            this.credentialsSalt = ((SaltedAuthenticationInfo) info).getCredentialsSalt();
+        if (this.credentialsSalt == null && info instanceof SaltedAuthenticationInfo authenticationInfo) {
+            this.credentialsSalt = authenticationInfo.getCredentialsSalt();
         }
 
         Object thisCredentials = getCredentials();
@@ -245,10 +247,8 @@ public void merge(AuthenticationInfo info) {
         // At this point, the credentials should be a collection
         @SuppressWarnings("unchecked")
         Collection<Object> credentialCollection = (Collection<Object>) getCredentials();
-        if (otherCredentials instanceof Collection) {
-            @SuppressWarnings("unchecked")
-            Collection<Object> otherCredentialsCollection = (Collection<Object>) otherCredentials;
-            credentialCollection.addAll(otherCredentialsCollection);
+        if (otherCredentials instanceof Collection<?> collection) {
+            credentialCollection.addAll(collection);
         } else {
             credentialCollection.add(otherCredentials);
         }

core/src/main/java/org/apache/shiro/authc/credential/DefaultPasswordService.java

@@ -169,9 +169,7 @@ public boolean passwordsMatch(Object submittedPlaintext, String saved) {
         //configuration changes.
         HashFormat discoveredFormat = this.hashFormatFactory.getInstance(saved);
 
-        if (discoveredFormat instanceof ParsableHashFormat) {
-
-            ParsableHashFormat parsableHashFormat = (ParsableHashFormat) discoveredFormat;
+        if (discoveredFormat instanceof ParsableHashFormat parsableHashFormat) {
             Hash savedHash = parsableHashFormat.parse(saved);
 
             return passwordsMatch(submittedPlaintext, savedHash);

core/src/main/java/org/apache/shiro/authc/credential/HashedCredentialsMatcher.java

@@ -402,8 +402,8 @@ public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo
      */
     protected Object hashProvidedCredentials(AuthenticationToken token, AuthenticationInfo info) {
         final Object salt;
-        if (info instanceof SaltedAuthenticationInfo) {
-            salt = ((SaltedAuthenticationInfo) info).getCredentialsSalt();
+        if (info instanceof SaltedAuthenticationInfo authenticationInfo) {
+            salt = authenticationInfo.getCredentialsSalt();
         } else if (isHashSalted()) {
             //retain 1.0 backwards compatibility:
             salt = getSalt(token);

core/src/main/java/org/apache/shiro/authc/credential/PasswordMatcher.java

@@ -49,8 +49,7 @@ public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo
         Object storedCredentials = getStoredPassword(info);
         assertStoredCredentialsType(storedCredentials);
 
-        if (storedCredentials instanceof Hash) {
-            Hash hashedPassword = (Hash) storedCredentials;
+        if (storedCredentials instanceof Hash hashedPassword) {
             return hashedPassword.matchesPassword(ByteSource.Util.bytes(submittedPassword));
         }
         //otherwise they are a String (asserted in the 'assertStoredCredentialsType' method call above):
@@ -89,8 +88,8 @@ private void assertStoredCredentialsType(Object credentials) {
     protected Object getStoredPassword(AuthenticationInfo storedAccountInfo) {
         Object stored = storedAccountInfo != null ? storedAccountInfo.getCredentials() : null;
         //fix for https://issues.apache.org/jira/browse/SHIRO-363
-        if (stored instanceof char[]) {
-            stored = new String((char[]) stored);
+        if (stored instanceof char[] chars) {
+            stored = new String(chars);
         }
         return stored;
     }

core/src/main/java/org/apache/shiro/authc/pam/AbstractAuthenticationStrategy.java

@@ -87,8 +87,8 @@ public AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token,
      * {@link org.apache.shiro.authc.MergableAuthenticationInfo MergableAuthenticationInfo} is not desired for some reason.
      */
     protected AuthenticationInfo merge(AuthenticationInfo info, AuthenticationInfo aggregate) {
-        if (aggregate instanceof MergableAuthenticationInfo) {
-            ((MergableAuthenticationInfo) aggregate).merge(info);
+        if (aggregate instanceof MergableAuthenticationInfo authenticationInfo) {
+            authenticationInfo.merge(info);
             return aggregate;
         } else {
             throw new IllegalArgumentException("Attempt to merge authentication info from multiple realms, but aggregate "

core/src/main/java/org/apache/shiro/authc/pam/AllSuccessfulStrategy.java

@@ -80,9 +80,9 @@ public AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token,
                                            AuthenticationInfo info, AuthenticationInfo aggregate, Throwable t)
             throws AuthenticationException {
         if (t != null) {
-            if (t instanceof AuthenticationException) {
+            if (t instanceof AuthenticationException exception) {
                 //propagate:
-                throw ((AuthenticationException) t);
+                throw exception;
             } else {
                 String msg = "Unable to acquire account data from realm [" + realm + "].  The ["
                         + getClass().getName() + " implementation requires all configured realm(s) to operate successfully "

core/src/main/java/org/apache/shiro/authc/pam/ModularRealmAuthenticator.java

@@ -294,8 +294,8 @@ public void onLogout(PrincipalCollection principals) {
         Collection<Realm> realms = getRealms();
         if (!CollectionUtils.isEmpty(realms)) {
             for (Realm realm : realms) {
-                if (realm instanceof LogoutAware) {
-                    ((LogoutAware) realm).onLogout(principals);
+                if (realm instanceof LogoutAware aware) {
+                    aware.onLogout(principals);
                 }
             }
         }

core/src/main/java/org/apache/shiro/authz/ModularRealmAuthorizer.java

@@ -137,8 +137,8 @@ protected void applyPermissionResolverToRealms() {
         Collection<Realm> realms = getRealms();
         if (resolver != null && realms != null && !realms.isEmpty()) {
             for (Realm realm : realms) {
-                if (realm instanceof PermissionResolverAware) {
-                    ((PermissionResolverAware) realm).setPermissionResolver(resolver);
+                if (realm instanceof PermissionResolverAware aware) {
+                    aware.setPermissionResolver(resolver);
                 }
             }
         }
@@ -193,8 +193,8 @@ protected void applyRolePermissionResolverToRealms() {
         Collection<Realm> realms = getRealms();
         if (resolver != null && realms != null && !realms.isEmpty()) {
             for (Realm realm : realms) {
-                if (realm instanceof RolePermissionResolverAware) {
-                    ((RolePermissionResolverAware) realm).setRolePermissionResolver(resolver);
+                if (realm instanceof RolePermissionResolverAware aware) {
+                    aware.setRolePermissionResolver(resolver);
                 }
             }
         }

core/src/main/java/org/apache/shiro/authz/SimpleRole.java

@@ -102,8 +102,7 @@ public boolean equals(Object o) {
         if (o == this) {
             return true;
         }
-        if (o instanceof SimpleRole) {
-            SimpleRole sr = (SimpleRole) o;
+        if (o instanceof SimpleRole sr) {
             //only check name, since role names should be unique across an entire application:
             return (getName() != null ? getName().equals(sr.getName()) : sr.getName() == null);
         }

core/src/main/java/org/apache/shiro/authz/permission/DomainPermission.java

@@ -20,6 +20,7 @@
 
 import org.apache.shiro.lang.util.StringUtils;
 
+import java.io.Serial;
 import java.util.Set;
 
 /**
@@ -32,6 +33,7 @@
  */
 public class DomainPermission extends WildcardPermission {
 
+    @Serial
     private static final long serialVersionUID = 1L;
 
     private String domain;

core/src/main/java/org/apache/shiro/authz/permission/WildcardPermission.java

@@ -252,8 +252,7 @@ public String toString() {
     }
 
     public boolean equals(Object o) {
-        if (o instanceof WildcardPermission) {
-            WildcardPermission wp = (WildcardPermission) o;
+        if (o instanceof WildcardPermission wp) {
             return parts.equals(wp.parts);
         }
         return false;

core/src/main/java/org/apache/shiro/ini/IniSecurityManagerFactory.java

@@ -132,9 +132,8 @@ private Ini.Section getConfigSection(Ini ini) {
 
     protected boolean isAutoApplyRealms(SecurityManager securityManager) {
         boolean autoApply = true;
-        if (securityManager instanceof RealmSecurityManager) {
-            //only apply realms if they haven't been explicitly set by the user:
-            RealmSecurityManager realmSecurityManager = (RealmSecurityManager) securityManager;
+        if (securityManager instanceof RealmSecurityManager realmSecurityManager) {
+            // only apply realms if they haven't been explicitly set by the user:
             Collection<Realm> realms = realmSecurityManager.getRealms();
             if (!CollectionUtils.isEmpty(realms)) {
                 LOGGER.info("Realms have been explicitly set on the SecurityManager instance - auto-setting of "
@@ -215,15 +214,14 @@ private Collection<Realm> getRealms(Map<String, ?> instances) {
             String name = entry.getKey();
             Object value = entry.getValue();
 
-            if (value instanceof RealmFactory) {
-                addToRealms(realms, (RealmFactory) value);
-            } else if (value instanceof Realm) {
-                Realm realm = (Realm) value;
+            if (value instanceof RealmFactory factory) {
+                addToRealms(realms, factory);
+            } else if (value instanceof Realm realm) {
                 //set the name if null:
                 String existingName = realm.getName();
                 if (existingName == null || existingName.startsWith(realm.getClass().getName())) {
-                    if (realm instanceof Nameable) {
-                        ((Nameable) realm).setName(name);
+                    if (realm instanceof Nameable nameable) {
+                        nameable.setName(name);
                         LOGGER.debug("Applied name '{}' to Nameable realm instance {}", name, realm);
                     } else {
                         LOGGER.info("Realm does not implement the {} interface.  Configured name will not be applied.",

core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java

@@ -276,7 +276,7 @@ public void setCipherKey(byte[] cipherKey) {
      * @return true if remember me services should be performed as a result of the successful authentication attempt.
      */
     protected boolean isRememberMe(AuthenticationToken token) {
-        return token instanceof RememberMeAuthenticationToken && ((RememberMeAuthenticationToken) token).isRememberMe();
+        return token instanceof RememberMeAuthenticationToken rmat && rmat.isRememberMe();
     }
 
     /**