Skip @PostFilter when method returns null

[seonwooj0810]

Closes gh-19280

Background

When a @PostFilter-annotated method returns null, the legacy @EnableGlobalMethodSecurity pipeline returned null to the caller. After migrating the same method to @EnableMethodSecurity, it now throws IllegalArgumentException: Filter target must be a collection, array, map or stream type, but was null. The issue suggests this is either a behavioural bug in the new interceptor or a documentation gap; this PR takes the first option and restores the legacy behaviour.

Root cause

PostFilterAuthorizationMethodInterceptor#invoke calls MethodSecurityExpressionHandler#filter unconditionally with whatever the intercepted method returned. DefaultMethodSecurityExpressionHandler#filter requires the filter target to be a Collection, array, Map, or Stream and otherwise throws IllegalArgumentException. null does not satisfy any of those instanceof checks (the array check is explicitly null-guarded), so the handler always throws when the method returns null.

The deprecated legacy implementation, ExpressionBasedPostInvocationAdvice#after, guards the call explicitly:

if (returnedObject != null) {
    returnedObject = this.expressionHandler.filter(returnedObject, postFilter, ctx);
}
else {
    this.logger.debug("Return object is null, filtering will be skipped");
}

That guard was not carried over to the new AuthorizationManager-based interceptor, which is what made the migration a behavioural breaking change for any service that returns null as a "nothing to filter" signal.

Change

PostFilterAuthorizationMethodInterceptor#invoke now short-circuits when the intercepted method returns null: it logs the same debug message as the legacy advice and returns null to the caller without consulting the expression handler. The MethodSecurityExpressionHandler#filter contract is intentionally left unchanged — semantically null is not a collection, so the handler should still reject it; the interceptor is the right layer to decide that @PostFilter over a null return is a no-op.

Tests

Added invokeWhenReturnedObjectIsNullThenSkipsFilteringAndReturnsNull in PostFilterAuthorizationMethodInterceptorTests covering the scenario from the issue: an intercepted invocation whose proceed() returns null now resolves to null instead of throwing. Before the fix this test fails with IllegalArgumentException from DefaultMethodSecurityExpressionHandler#filter; after, it passes.

./gradlew :spring-security-core:test --tests 'org.springframework.security.authorization.method.*' runs all 117 method-authorization tests green, so no other consumer of the interceptor is affected. :spring-security-core:checkstyleMain and :checkstyleTest also pass.

Verification done

1. No in-flight PR / claim: gh pr list --repo spring-projects/spring-security --search "PostFilter null" and ... "PostFilterAuthorizationMethodInterceptor" returned no open PRs touching this code path; the issue thread has no "I'll work on this" claim.
2. Code still on main: confirmed PostFilterAuthorizationMethodInterceptor#invoke on main (HEAD bf06d19225) still calls expressionHandler.filter without a null guard.
3. Legacy implementation present: confirmed ExpressionBasedPostInvocationAdvice#after in access/src/main/java/... still has the explicit if (returnedObject != null) branch this PR mirrors.
4. Behavioural impact: reproduced the IAE via the new regression test before applying the fix; after the fix the test passes and all sibling tests in the package remain green.