Spring Security Default class loader in SpringSecurityMessageSource only works if Spring Security and Spring Framework share a classloader

Describe the bug

SpringSecurityMessageSource.getAccessor() is used in multiple places to set the default message source but the configured default class loader does not work if the spring security class loader is a different one to the spring framework class loader.

The super class has a null bundleClassLoader and defaults the bean class loader to:

ClassUtils.getDefaultClassLoader();

If no context class loader is present, it will be the class loader which loaded the ClassUtils class.

I would suggest that getAccessor should do something like:

    public static MessageSourceAccessor getAccessor() {
        final SpringSecurityMessageSource source = new SpringSecurityMessageSource();
        source.setBundleClassLoader(SpringSecurityMessageSource.class.getClassLoader());
        return new MessageSourceAccessor(source);
    }

It is possible to work around this by setting my own message source with the class loader correctly configured, but this is tedious and requires multiple internally created objects to be reconfigured.

Comment From: jzheaux

Thanks, @aclemons, for the suggestion. Would you be able to provide a PR?

Comment From: aclemons

I've linked a PR now.

Comment From: jzheaux

Based on https://github.com/spring-projects/spring-security/pull/9163#issuecomment-719641497 I believe this issue can now be closed. Please feel free to reopen if there's more to discuss.