[No, this isn't a bug that has bitten me, I just noticed this in the code while I was trying to get my head around what SecurityUtil does / doesn't do. Also, this is probably just a performance bug, not a real failure. I noticed this in the 6.0.18 source and confirmed that it's still on the trunk, even though there have been code changes nearby, e.g revision 711600 for issue 46011]. ApplicationFilterChain.internalDoFilterEvent() invokes SecurityUtil.doAsPrivileged() for "doFilterEvent" and "event", but as far as I can see, SecurityUtil.createMethodAndCacheIt() will never cache the Method descriptors for those two methods -- bad (for performance)? Also... the fix for issue 46011 modified internalDoFilter(), but should there be a similar modification in internalDoFilterEvent() too?
I have fixed the internalDoFilterEvent() oart if this issue in trunk and proposed it for 6.0.x
I've fixed the performance issues in trunk. I do not intend to propose this for back port - it will be included with Tomcat 7.
The patch has been applied to 6.0.x and will be included in 6.0.19 onwards.