SEC-3034: AclPermissionEvaluator specifies Locale.ENGLISH

acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java

@@ -3,6 +3,7 @@ package org.springframework.security.acls;
 import java.io.Serializable;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Locale;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -131,7 +132,7 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 				p = permissionFactory.buildFromName(permString);
 			}
 			catch (IllegalArgumentException notfound) {
-				p = permissionFactory.buildFromName(permString.toUpperCase());
+				p = permissionFactory.buildFromName(permString.toUpperCase(Locale.ENGLISH));
 			}
 
 			if (p != null) {

acl/src/test/java/org/springframework/security/acls/AclPermissionEvaluatorTests.java

@@ -4,6 +4,8 @@ import static org.junit.Assert.assertTrue;
 import static org.mockito.Matchers.*;
 import static org.mockito.Mockito.*;
 
+import java.util.Locale;
+
 import org.junit.Test;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AclService;
@@ -36,4 +38,26 @@ public class AclPermissionEvaluatorTests {
 
 		assertTrue(pe.hasPermission(mock(Authentication.class), new Object(), "READ"));
 	}
+
+	@Test
+	public void resolvePermissionNonEnglishLocale() {
+		Locale systemLocale = Locale.getDefault();
+		Locale.setDefault(new Locale("tr"));
+
+		AclService service = mock(AclService.class);
+		AclPermissionEvaluator pe = new AclPermissionEvaluator(service);
+		ObjectIdentity oid = mock(ObjectIdentity.class);
+		ObjectIdentityRetrievalStrategy oidStrategy = mock(ObjectIdentityRetrievalStrategy.class);
+		when(oidStrategy.getObjectIdentity(anyObject())).thenReturn(oid);
+		pe.setObjectIdentityRetrievalStrategy(oidStrategy);
+		pe.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
+		Acl acl = mock(Acl.class);
+
+		when(service.readAclById(any(ObjectIdentity.class), anyList())).thenReturn(acl);
+		when(acl.isGranted(anyList(), anyList(), eq(false))).thenReturn(true);
+
+		assertTrue(pe.hasPermission(mock(Authentication.class), new Object(), "write"));
+
+		Locale.setDefault(systemLocale);
+	}
 }