Affects: At least 4.2.1 - 5.3.9, probably all versions.
A !target(class) pointcut doesn't behave as expected: It seems like the negation implementation is wrong.
From my testing x && !target(org.springframework.web.filter.GenericFilterBean) behaves like x || target(org.springframework.web.filter.GenericFilterBean) instead.
I've created an example project https://github.com/F43nd1r/spring-aop-negation-issue-demo. Just try to run the application. You'll see a stacktrace like this:
java.lang.NullPointerException: Cannot invoke "org.apache.commons.logging.Log.isDebugEnabled()" because "this.logger" is null
at org.springframework.web.filter.GenericFilterBean.init(GenericFilterBean.java:241)
That means a bean extending GenericFilterBean must've matched the pointcut and thus was proxied (GenericFilterBean implementations cannot be cglib proxied due to its implementation).
Note: This issue was also described in this stackoverflow post nearly six years ago https://stackoverflow.com/questions/33136530/target-negation-not-working-in-spring-aop.
Comment From: quaff
@F43nd1r FYI, I may be same as #27119
Comment From: F43nd1r
@quaff sounds similar and might have the same root cause. I don't have the deep understanding to say for sure.
Comment From: Trympyrym
Investigated this a bit.
@Around("exrp && !target(another_expr)") correctly intercepts beans matching expr and not matching another_expr
But when one of GenericFilterBean subclass matches expr (for example OrderedRequestContextFilter), then this bean is wrapped in SpringCBLIB (OrderedRequestContextFilter$$SpringCBLIB), and its logger field is not initialized, which leads to NPE
tested on 6.0.3