intercept-url without access throws strange assertion error (spring / spring-security 6) #18503
Description
Describe the bug
Spring accepts broken config and then fails with cryptic stack trace that the constructor cannot be called with an empty string ("").
To Reproduce
add a spring security config section with this element:
<intercept-url pattern="/r/*"/> Then start up the application server that contains the spring webmvc deployment.
Expected behavior
A proper error message should be thrown or the xml could be rejected by adding validation that access is present
Sample
<http use-expressions="true" create-session="never">
<!-- this is how this element usually looks -->
<intercept-url pattern="/test.jsp" access="hasRole('ADMIN') or hasRole('USER')"/>
<!-- this will cause an error since access is not defined -->
<intercept-url pattern="/r/*"/>
<http-basic/>
<csrf request-matcher-ref="csrfMatcherAll" disabled="false" />
<headers>
...
</headers>
<access-denied-handler ref="customAccessDeniedHandler"/>
</http>