# GLobalMethodSecurityConfiguration security hotspots

**URL:** <https://community.sonarsource.com/t/globalmethodsecurityconfiguration-security-hotspots/37767>\
**Category:** SonarQube Server / Community Build\
**Tags:** security-hotspot, security, java\
**Created:** [January 29, 2021, 10:44am UTC](https://community.sonarsource.com/t/globalmethodsecurityconfiguration-security-hotspots/37767 "2021-01-29T10:44:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lnoel](https://avatars.discourse-cdn.com/v4/letter/l/7feea3/32.png) [@lnoel](https://community.sonarsource.com/u/lnoel)\
**Post date:** [January 29, 2021, 10:44am UTC](https://community.sonarsource.com/t/globalmethodsecurityconfiguration-security-hotspots/37767/1 "2021-01-29T10:44:25Z")

</div>

Hello everyone,

I have scanned my code and I have a security hotspots about extends GlobalMethodSecurityConfiguration.  
The fact is that I have override one function from this class.

Do you have any option or solution to this security become safe please ?

```auto
  public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    @Autowired
    private CustomPermissionEvaluator permissionEvaluator;

    /**
     * To handle the security Expression with CustomPermissionEvaluatorimplements.
     * 
     * @return
     */
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(permissionEvaluator);
        // expressionHandler.setParameterNameDiscoverer(new
        // AnnotationParameterNameDiscoverer(PathVariable.class.getName(), P.class.getName()));
        return expressionHandler;
    }

```

---

<div class="post-metadata">

**Author:** ![eric.therond](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/eric.therond/32/10661_2.png) [@eric.therond](https://community.sonarsource.com/u/eric.therond)\
**Post date:** [February 2, 2021, 1:40pm UTC](https://community.sonarsource.com/t/globalmethodsecurityconfiguration-security-hotspots/37767/4 "2021-02-02T13:40:44Z")

</div>

Hello again @lnoel

This is the same rule / problem than in the [other thread](https://community.sonarsource.com/t/preauthorized-security-hotspots/37769/7) you created.

Thank you for your report.

Eric

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\
**Post date:** [February 9, 2021, 1:41pm UTC](https://community.sonarsource.com/t/globalmethodsecurityconfiguration-security-hotspots/37767/5 "2021-02-09T13:41:18Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.