SEC-2599: HttpSessionEventPublisher get required ApplicationContext

In order to get better error messages (avoid NullPointerException) the
HttpSessionEventPublisher now gets the required ApplicationContext which
throws an IllegalStateException with a good error message.

web/src/main/java/org/springframework/security/web/session/HttpSessionEventPublisher.java

@@ -49,7 +49,7 @@ public class HttpSessionEventPublisher implements HttpSessionListener {
     //~ Methods ========================================================================================================
 
     ApplicationContext getContext(ServletContext servletContext) {
-        return WebApplicationContextUtils.getWebApplicationContext(servletContext);
+        return WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
     }
 
     /**

web/src/test/java/org/springframework/security/web/session/HttpSessionEventPublisherTests.java

@@ -69,4 +69,26 @@ public class HttpSessionEventPublisherTests {
         assertNull(listener.getCreatedEvent());
         assertEquals(session, listener.getDestroyedEvent().getSession());
     }
+
+    // SEC-2599
+    @Test(expected=IllegalStateException.class)
+    public void sessionCreatedNullApplicationContext() {
+        HttpSessionEventPublisher publisher = new HttpSessionEventPublisher();
+        MockServletContext servletContext = new MockServletContext();
+        MockHttpSession session = new MockHttpSession(servletContext);
+        HttpSessionEvent event = new HttpSessionEvent(session);
+
+        publisher.sessionCreated(event);
+    }
+
+    // SEC-2599
+    @Test(expected=IllegalStateException.class)
+    public void sessionDestroyedNullApplicationContext() {
+        HttpSessionEventPublisher publisher = new HttpSessionEventPublisher();
+        MockServletContext servletContext = new MockServletContext();
+        MockHttpSession session = new MockHttpSession(servletContext);
+        HttpSessionEvent event = new HttpSessionEvent(session);
+
+        publisher.sessionDestroyed(event);
+    }
 }