Use ReflectionTestUtils rather than Whitebox

This is better because it no longer uses Mockito's internal API

Fixes gh-4305

config/src/test/java/org/springframework/security/config/SecurityNamespaceHandlerTests.java

@@ -26,10 +26,10 @@ import org.junit.rules.ExpectedException;
 import org.junit.runner.RunWith;
 import org.powermock.core.classloader.annotations.PrepareForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
-import org.powermock.reflect.internal.WhiteboxImpl;
 import org.springframework.beans.factory.parsing.BeanDefinitionParsingException;
 import org.springframework.messaging.Message;
 import org.springframework.security.config.util.InMemoryXmlApplicationContext;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.util.ClassUtils;
 
 /**
@@ -87,7 +87,7 @@ public class SecurityNamespaceHandlerTests {
 
 		Log logger = mock(Log.class);
 		SecurityNamespaceHandler handler = new SecurityNamespaceHandler();
-		WhiteboxImpl.setInternalState(handler, Log.class, logger);
+		ReflectionTestUtils.setField(handler, "logger", logger);
 
 		handler.init();
 

config/src/test/java/org/springframework/security/config/http/DefaultFilterChainValidatorTests.java

@@ -28,8 +28,8 @@ import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
-import org.mockito.internal.util.reflection.Whitebox;
 import org.mockito.runners.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.security.access.AccessDecisionManager;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.AuthenticationEntryPoint;
@@ -74,7 +74,8 @@ public class DefaultFilterChainValidatorTests {
 				AnyRequestMatcher.INSTANCE, aaf, etf, fsi);
 		fcp = new FilterChainProxy(securityChain);
 		validator = new DefaultFilterChainValidator();
-		Whitebox.setInternalState(validator, "logger", logger);
+
+		ReflectionTestUtils.setField(validator, "logger", logger);
 	}
 
 	// SEC-1878

web/src/main/java/org/springframework/security/web/debug/DebugFilter.java

@@ -45,7 +45,7 @@ import java.util.*;
  * @since 3.1
  */
 public final class DebugFilter implements Filter {
-	private static final String ALREADY_FILTERED_ATTR_NAME = DebugFilter.class.getName()
+	static final String ALREADY_FILTERED_ATTR_NAME = DebugFilter.class.getName()
 			.concat(".FILTERED");
 
 	private final FilterChainProxy fcp;

web/src/test/java/org/springframework/security/web/debug/DebugFilterTest.java

@@ -37,9 +37,9 @@ import org.mockito.Captor;
 import org.mockito.Mock;
 import org.powermock.core.classloader.annotations.PrepareOnlyThisForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
-import org.powermock.reflect.internal.WhiteboxImpl;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.web.FilterChainProxy;
+import org.springframework.test.util.ReflectionTestUtils;
 
 /**
  *
@@ -75,9 +75,8 @@ public class DebugFilterTest {
 				Collections.enumeration(Collections.<String> emptyList()));
 		when(request.getServletPath()).thenReturn("/login");
 		filter = new DebugFilter(fcp);
-		WhiteboxImpl.setInternalState(filter, Logger.class, logger);
-		requestAttr = WhiteboxImpl.getInternalState(filter, "ALREADY_FILTERED_ATTR_NAME",
-				filter.getClass());
+		ReflectionTestUtils.setField(filter, "logger", logger);
+		requestAttr = DebugFilter.ALREADY_FILTERED_ATTR_NAME;
 	}
 
 	@Test

web/src/test/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestFilterTests.java

@@ -34,7 +34,6 @@ import org.mockito.Captor;
 import org.mockito.Mock;
 import org.powermock.core.classloader.annotations.PrepareForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
-import org.powermock.reflect.internal.WhiteboxImpl;
 
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -48,6 +47,7 @@ import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.authentication.logout.LogoutHandler;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.util.ClassUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -331,10 +331,9 @@ public class SecurityContextHolderAwareRequestFilterTests {
 		DelegatingSecurityContextRunnable wrappedRunnable = (DelegatingSecurityContextRunnable) runnableCaptor
 				.getValue();
 		assertThat(
-				WhiteboxImpl.<SecurityContext>getInternalState(wrappedRunnable, "delegateSecurityContext"))
+				ReflectionTestUtils.getField(wrappedRunnable, "delegateSecurityContext"))
 						.isEqualTo(context);
-		assertThat(WhiteboxImpl.<SecurityContext>getInternalState(wrappedRunnable, "delegate"))
-				.isEqualTo(runnable);
+		assertThat(ReflectionTestUtils.getField(wrappedRunnable, "delegate"));
 	}
 
 	@Test
@@ -361,10 +360,9 @@ public class SecurityContextHolderAwareRequestFilterTests {
 		DelegatingSecurityContextRunnable wrappedRunnable = (DelegatingSecurityContextRunnable) runnableCaptor
 				.getValue();
 		assertThat(
-				WhiteboxImpl.<SecurityContext>getInternalState(wrappedRunnable, "delegateSecurityContext"))
+			ReflectionTestUtils.getField(wrappedRunnable, "delegateSecurityContext"))
 						.isEqualTo(context);
-		assertThat(WhiteboxImpl.<SecurityContext>getInternalState(wrappedRunnable, "delegate"))
-				.isEqualTo(runnable);
+		assertThat(ReflectionTestUtils.getField(wrappedRunnable, "delegate"));
 	}
 
 	@Test
@@ -392,10 +390,9 @@ public class SecurityContextHolderAwareRequestFilterTests {
 		DelegatingSecurityContextRunnable wrappedRunnable = (DelegatingSecurityContextRunnable) runnableCaptor
 				.getValue();
 		assertThat(
-				WhiteboxImpl.<SecurityContext>getInternalState(wrappedRunnable, "delegateSecurityContext"))
+			ReflectionTestUtils.getField(wrappedRunnable, "delegateSecurityContext"))
 						.isEqualTo(context);
-		assertThat(WhiteboxImpl.<SecurityContext>getInternalState(wrappedRunnable, "delegate"))
-				.isEqualTo(runnable);
+		assertThat(ReflectionTestUtils.getField(wrappedRunnable, "delegate"));
 	}
 
 	// SEC-3047