docs: scope the @StrutsParameter "never set" claim to named properties - #328
Open
lukaszlenart wants to merge 1 commit into
Open
docs: scope the @StrutsParameter "never set" claim to named properties#328lukaszlenart wants to merge 1 commit into
lukaszlenart wants to merge 1 commit into
Conversation
The annotation page told readers that JSON and REST deserialization means unauthorized fields are never set on the target object. That is true of the properties the deserializer binds by name, but a Jackson any-setter is a separate sink that the REST plugin's authorization wrapper never wraps, so unknown keys routed to it are bound with no @StrutsParameter check at all -- in the same request in which an ordinary unannotated setter on the same class is correctly rejected. Qualify the bullet and document the gap in its own section, alongside the existing creator-bound-properties note that covers the same class of problem. The JSON plugin is unaffected: it does not use Jackson, so its own page's identical wording stays accurate and is left alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012HF8BGrYmCVnqUdQJJ1XPM
|
Staged site is ready at https://struts.staged.apache.org/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
@StrutsParameterpage told readers that JSON and REST deserialization means "unauthorized fields are never set". That holds for properties the deserializer binds by name, but a Jackson any-setter is a separate sink that the REST plugin's authorization wrapper never wraps — unknown keys routed to it are bound with no@StrutsParametercheck, even withstruts.parameters.requireAnnotationsenabled and in the same request in which an ordinary unannotated setter on the same class is correctly rejected.That sentence is what made the behaviour look like a broken promise when it was reported. This qualifies the bullet and documents the gap in its own section, next to the existing creator-bound-properties note covering the same class of problem.
Also documented, because both are easy to assume wrongly:
@JsonUnwrappedis a named property and is unaffected.The JSON plugin is not affected — it uses no Jackson, so
source/plugins/json/index.mdkeeps its identical wording unchanged.Describes current behaviour only. The framework-side control is tracked as WW-5712, which is not yet merged, so no configuration flag is documented here.
🤖 Generated with Claude Code
https://claude.ai/code/session_012HF8BGrYmCVnqUdQJJ1XPM