SEC-791: RequestKey.equals throws NPE if method is null

http://jira.springframework.org/browse/SEC-791. Fixed handling of equals when one http method is null.

core/src/main/java/org/springframework/security/intercept/web/RequestKey.java

@@ -3,6 +3,7 @@ package org.springframework.security.intercept.web;
 /**
  * @author Luke Taylor
  * @version $Id$
+ * @since 2.0
  */
 public class RequestKey {
     private String url;
@@ -47,10 +48,10 @@ public class RequestKey {
             return false;
         }
         
-        if (method == null && key.method != null) {
-            return false;
+        if (method == null) {
+        	return key.method == null;
         }
-        
+
         return method.equals(key.method);        
     }
 }

core/src/test/java/org/springframework/security/intercept/web/RequestKeyTests.java

@@ -0,0 +1,51 @@
+package org.springframework.security.intercept.web;
+
+import static org.junit.Assert.*;
+
+import org.junit.Test;
+
+/**
+ * 
+ * @author Luke Taylor
+ * @version $Id$
+ *
+ */
+public class RequestKeyTests {
+	
+	@Test
+	public void equalsWorksWithNullHttpMethod() {
+		RequestKey key1 = new RequestKey("/someurl");
+		RequestKey key2 = new RequestKey("/someurl");
+		
+		assertEquals(key1, key2);
+		key1 = new RequestKey("/someurl","GET");
+		assertFalse(key1.equals(key2));
+		assertFalse(key2.equals(key1));
+	}
+
+	@Test
+	public void keysWithSameUrlAndHttpMethodAreEqual() {
+		RequestKey key1 = new RequestKey("/someurl", "GET");
+		RequestKey key2 = new RequestKey("/someurl", "GET");
+		
+		assertEquals(key1, key2);
+	}
+
+	@Test
+	public void keysWithSameUrlAndDifferentHttpMethodAreNotEqual() {
+		RequestKey key1 = new RequestKey("/someurl", "GET");
+		RequestKey key2 = new RequestKey("/someurl", "POST");
+		
+		assertFalse(key1.equals(key2));
+		assertFalse(key2.equals(key1));
+	}
+
+	@Test
+	public void keysWithDifferentUrlsAreNotEquals() {
+		RequestKey key1 = new RequestKey("/someurl", "GET");
+		RequestKey key2 = new RequestKey("/anotherurl", "GET");
+		
+		assertFalse(key1.equals(key2));
+		assertFalse(key2.equals(key1));
+	}
+}