You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@struts.apache.org by "tranquac (via GitHub)" <gi...@apache.org> on 2026/04/06 15:18:12 UTC

[PR] fix(json-plugin): enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

tranquac opened a new pull request, #1651:
URL: https://github.com/apache/struts/pull/1651

## Summary

`JSONPopulator.populateObject()` in the struts2-json-plugin sets action properties via direct Java reflection (`Method.invoke()`) without checking the `@StrutsParameter` annotation. This bypasses the parameter allowlisting that `ParametersInterceptor` enforces for URL parameters, enabling mass assignment of unannotated properties via JSON request body.

## Changes

- **JSONPopulator.java**: Add `@StrutsParameter` annotation check before `Method.invoke()`. When `struts.parameters.requireAnnotations` is enabled and the setter lacks the annotation, the property is skipped with a debug log message.
- **JSONInterceptor.java**: Wire the `struts.parameters.requireAnnotations` setting via `@Inject` into `JSONPopulator.setRequireAnnotations()`.

## Impact

Without this fix:
- URL params to unannotated setters: **BLOCKED** (ParametersInterceptor enforces)
- JSON body to same unannotated setters: **BYPASSES** (JSONPopulator ignores annotation)

With this fix, both pathways consistently enforce `@StrutsParameter`.

## Test

A PoC application with 8 test cases demonstrates the bypass and fix. An action with `@StrutsParameter`-annotated setter (`setUsername`) and unannotated setters (`setRole`, `setAdmin`) shows that JSON body sets unannotated fields before the fix, and blocks them after.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "tranquac (via GitHub)" <gi...@apache.org>.

tranquac commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4203271121

   hi @lukaszlenart
   
   How can I create a JIRA ticket?
   
   have a good day!
   Quac Tran


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.

lukaszlenart commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4200997966

   Could you create a JIRA ticket first? I can include also changes in #1652 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "tranquac (via GitHub)" <gi...@apache.org>.

tranquac commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4203990006

   Hi @lukaszlenart 
   
   I created JIRA ticket for this issue: https://issues.apache.org/jira/projects/WW/issues/WW-5624?filter=allissues


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): WW-5624 enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.

lukaszlenart commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4205109223

Thanks for reporting this. The issue in the JSON plugin looks valid: `JSONPopulator.populateObject()` currently bypasses the `ParametersInterceptor` checks for `@StrutsParameter`.

That said, I don't think this fix is sufficient as-is. In Struts, `@StrutsParameter` support is not only a check for an annotated setter. The core `ParametersInterceptor` logic also enforces nesting depth and related authorization semantics. This change currently adds only a setter-level annotation check, so it does not fully match existing Struts behavior.

My main concern is that `JSONPopulator` recursively populates nested beans, collections, arrays, and maps. Requiring `@StrutsParameter` on every nested setter would be stricter than current Struts semantics, where authorization is based on the exposed root member and the permitted depth. That could break valid nested binding scenarios while still not aligning fully with the core parameter-binding contract.

I think the right direction is to align the JSON plugin with the shared parameter-binding authorization rules used by `ParametersInterceptor`, instead of implementing a local setter-only check.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): WW-5624 enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.

lukaszlenart commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4358563364

   Superseded by #1657


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): WW-5624 enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.

lukaszlenart closed pull request #1651: fix(json-plugin): WW-5624 enforce @StrutsParameter in JSONPopulator.populateObject()
URL: https://github.com/apache/struts/pull/1651


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "tranquac (via GitHub)" <gi...@apache.org>.

tranquac commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4201126369

   How can I create @lukaszlenart ? 
   I have submitted this patch to: https://bughunters.google.com/open-source-security/patch-rewards


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "tranquac (via GitHub)" <gi...@apache.org>.

tranquac commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4203866456

   I requested a Jira account!
   
   And i will create create a JIRA ticket soon!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(json-plugin): WW-5624 enforce @StrutsParameter in JSONPopulator.populateObject() [struts]

Posted by "tranquac (via GitHub)" <gi...@apache.org>.

tranquac commented on PR #1651:
URL: https://github.com/apache/struts/pull/1651#issuecomment-4205215482

   Thanks for your feedback. I will quickly create a fullfill patch based on your comment. I will notify you when it's finished and create a new PR.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org