You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/08/15 15:29:11 UTC
(grails-core) 01/01: Merge pull request #15947 from apache/fix/binddata-mass-assignment
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch 8.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 11ebb5a8cdecc9359654dd60bce1e6ab282c3b18
Merge: 1628a9c31f dad867634c
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Sat Aug 15 11:29:05 2026 -0400
Merge pull request #15947 from apache/fix/binddata-mass-assignment
Add opt-in deny-by-default data binding and always honor bindable:false
.../main/groovy/grails/artefact/Controller.groovy | 8 +-
.../compiler/web/ControllerActionTransformer.java | 102 ++-
.../src/main/groovy/grails/config/Settings.groovy | 2 +
.../grails/databinding/SimpleDataBinder.groovy | 46 +-
.../grails/databinding/SimpleDataBinderSpec.groovy | 36 +
.../META-INF/spring-configuration-metadata.json | 6 +
.../guide/theWebLayer/controllers/dataBinding.adoc | 4 +-
grails-doc/src/en/guide/upgrading.adoc | 13 +
grails-doc/src/en/ref/Constraints/bindable.adoc | 5 +-
grails-doc/src/en/ref/Controllers/bindData.adoc | 30 +-
.../web/databinding/GrailsWebDataBinderSpec.groovy | 310 +++++++-
...ngHelperDomainClassSpecialPropertiesSpec.groovy | 100 ++-
.../web/commandobjects/CommandObjectsSpec.groovy | 29 +
.../grails/web/servlet/BindDataMethodTests.groovy | 785 +++++++++++++++++++++
.../groovy/grails/web/databinding/BindAllowed.java | 30 +
.../grails/web/databinding/DataBinder.groovy | 5 +
.../grails/web/databinding/DataBindingUtils.java | 347 ++++++++-
.../web/databinding/GrailsWebDataBinder.groovy | 391 +++++++++-
.../DataBindingEventMulticastListener.groovy | 4 +
.../databinding/DefaultASTDatabindingHelper.java | 107 ++-
.../web/databinding/DenyByDefaultConfigSpec.groovy | 103 +++
21 files changed, 2410 insertions(+), 53 deletions(-)