Re: [PR] fix(json-plugin): WW-5624 enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4205109223

   Thanks for reporting this. The issue in the JSON plugin looks valid: `JSONPopulator.populateObject()` currently bypasses the `ParametersInterceptor` checks for `@StrutsParameter`.
   
   That said, I don't think this fix is sufficient as-is. In Struts, `@StrutsParameter` support is not only a check for an annotated setter. The core `ParametersInterceptor` logic also enforces nesting depth and related authorization semantics. This change currently adds only a setter-level annotation check, so it does not fully match existing Struts behavior.
   
   My main concern is that `JSONPopulator` recursively populates nested beans, collections, arrays, and maps. Requiring `@StrutsParameter` on every nested setter would be stricter than current Struts semantics, where authorization is based on the exposed root member and the permitted depth. That could break valid nested binding scenarios while still not aligning fully with the core parameter-binding contract.
   
   I think the right direction is to align the JSON plugin with the shared parameter-binding authorization rules used by `ParametersInterceptor`, instead of implementing a local setter-only check.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org