web/src/main/java/org/springframework/security/web/bind/support/CurrentSecurityContextArgumentResolver.java
public Object resolveArgument(MethodParameter parameter,
				ModelAndViewContainer mavContainer, NativeWebRequest webRequest,
				WebDataBinderFactory binderFactory) throws Exception {
		SecurityContext securityContext = SecurityContextHolder.getContext();
		if (securityContext == null) {
			return null;
		}
		Object securityContextResult = securityContext;

		CurrentSecurityContext securityContextAnnotation = findMethodAnnotation(
				CurrentSecurityContext.class, parameter);

		String expressionToParse = securityContextAnnotation.expression();
		if (StringUtils.hasLength(expressionToParse)) {
			StandardEvaluationContext context = new StandardEvaluationContext();
			context.setRootObject(securityContext);
			context.setVariable("this", securityContext);

			Expression expression = this.parser.parseExpression(expressionToParse);
			securityContextResult = expression.getValue(context);
		}

		if (securityContextResult != null
				&& !parameter.getParameterType().isAssignableFrom(securityContextResult.getClass())) {
			if (securityContextAnnotation.errorOnInvalidType()) {
				throw new ClassCastException(securityContextResult + " is not assignable to "
						+ parameter.getParameterType());
			}
			else {
				return null;
			}
		}
		return securityContextResult;
	}
public Object resolveArgument(MethodParameter parameter,
				ModelAndViewContainer mavContainer, NativeWebRequest webRequest,
				WebDataBinderFactory binderFactory) throws Exception {
		SecurityContext securityContext = SecurityContextHolder.getContext();
		if (securityContext == null) {
			return null;
		}
		Object securityContextResult = securityContext;

		CurrentSecurityContext securityContextAnnotation = findMethodAnnotation(
				CurrentSecurityContext.class, parameter);

		String expressionToParse = securityContextAnnotation.expression();
		if (StringUtils.hasLength(expressionToParse)) {
			StandardEvaluationContext context = new StandardEvaluationContext();
			context.setRootObject(securityContext);
			context.setVariable("this", securityContext);

			Expression expression = this.parser.parseExpression(expressionToParse);
			securityContextResult = expression.getValue(context);
		}

		if (securityContextResult != null
				&& !parameter.getParameterType().isAssignableFrom(securityContextResult.getClass())) {
			if (securityContextAnnotation.errorOnInvalidType()) {
				throw new ClassCastException(securityContextResult + " is not assignable to "
						+ parameter.getParameterType());
			}
			else {
				return null;
			}
		}
		return securityContextResult;
	}
resolve the argument to inject into the controller parameter.
@param parameter the method parameter.
@param mavContainer the model and view container.
@param webRequest the web request.
@param binderFactory the web data binder factory.

@see org.springframework.web.method.support.HandlerMethodArgumentResolver#
resolveArgument (org.springframework.core.MethodParameter,
org.springframework.web.method.support.ModelAndViewContainer,
org.springframework.web.context.request.NativeWebRequest,
org.springframework.web.bind.support.WebDataBinderFactory)