DO NOT REPLY [Bug 27965] New: - Writing to a mapped property requires a setter for a map, but never uses it

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=27965>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=27965

Writing to a mapped property requires a setter for a map, but never uses it

           Summary: Writing to a mapped property requires a setter for a
                    map, but never uses it
           Product: Commons
           Version: 1.6 Final
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: Bean Utilities
        AssignedTo: commons-dev@jakarta.apache.org
        ReportedBy: dmitry@platonoff.com


Encountered while using struts 1.1 with beautils 1.6.1.

When you attempt to set the value of a mapped property, BeanUtils.setProperty() 
checks if the bean has a write method for a map and fails with a "Skipping read-
only property" message, even though it would never actually use or need this 
method.

The following sample illustrates the problem:

public class MyBean {
  private Map myMap;
  public Map getMyMap() { return myMap; }
  /* ... */
}

If you invoke BeanUtils.setProperty( myBean, "myMap(myKey)", value ) on an 
instance of MyBean, the invocation fails, as there's no write method for the 
myMap property (it doesn't throw an exception, it just doesn't do anything, 
leaving the map unchanged).

However, if you add setMyMap() to the bean, the setProperty call succedes, even 
though it never actually calls setMyMap(), using the getMyMap().put( "myKey", 
value ) chain instead.

This looks like an unnecessary requirement with negative security implications.

---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org