You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "g0w6y (via GitHub)" <gi...@apache.org> on 2026/10/06 14:18:49 UTC
[PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
g0w6y opened a new pull request, #347:
URL: https://github.com/apache/struts-site/pull/347
Documents the `@StrutsParameter` authorization added to `AliasInterceptor` in [apache/struts#1991](https://github.com/apache/struts/pull/1991) (WW-5758), per [lukaszlenart's review request](https://github.com/apache/struts/pull/1991#pullrequestreview-3541146007) on that PR.
Adds a "Parameter Authorization" section to the Alias Interceptor page, mirroring the Chaining Interceptor page's existing section of the same name: the raw-request-parameter fallback follows `struts.parameters.requireAnnotations` like the Parameters Interceptor, and copying a value already resolved on the stack follows the opt-in `struts.chaining.requireAnnotations` like the Chaining Interceptor. Includes the `transitionMode` note requested in the review (an alias target is always non-nested, so the same exemption applies).
Adds an entry for the Alias Interceptor to the `@StrutsParameter` page's "Where authorization applies" list.
Version cited as 7.5.0 to match the two prior related fixes (WW-5752, WW-5753) and the current `pom.xml` SNAPSHOT — apache/struts#1991's Fix Version isn't set yet, so this may need a correction once it is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "g0w6y (via GitHub)" <gi...@apache.org>.
g0w6y commented on PR #347:
URL: https://github.com/apache/struts-site/pull/347#issuecomment-6061906130
Both fixed with your exact suggested wording, verified the ordering claim against struts-default.xml first (confirmed: alias is at line 191, modelDriven at line 202 in defaultStack, so alias does run first).
1. ModelDriven sentence reworded: the exemption only applies in a custom stack that places alias after modelDriven.
2. "once requireAnnotations is enabled" and "silently skipped" fixed to match your suggested text.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "g0w6y (via GitHub)" <gi...@apache.org>.
g0w6y commented on PR #347:
URL: https://github.com/apache/struts-site/pull/347#issuecomment-6060910536
Good catch on the nested-target claim — verified against the merged code, you're right, nothing restricts an alias target to a non-nested name.
1. Fixed: dropped the "always non-nested" claim, added the "nested targets still need the annotation" note with your suggested wording and example.
2. Fixed both wording issues with your suggested text: the contradictory "always requires... governed by" sentence, and dropped "separately-authorized" from the stack-resolved description.
3. Added an "Upgrading an existing application" section stating the foo/bar example's bar now needs @StrutsParameter.
4. Fixed the review link (was pointing to the wrong review id) and left the 7.5.0 version as-is per your note.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #347:
URL: https://github.com/apache/struts-site/pull/347
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on PR #347:
URL: https://github.com/apache/struts-site/pull/347#issuecomment-6061369250
Thanks, the nested-target note and the upgrade section read well now. Two last things in `alias-interceptor.md`:
1. **Line 80: "The `ModelDriven` exemption applies here too."** That isn't true in the default setup. In `defaultStack`, `alias` runs before `modelDriven`, so when the alias runs the model isn't on the stack yet. The check, and the write itself, both land on the action. The exemption only matters in a custom stack that places `alias` after `modelDriven`. Please either drop the sentence or make it: "In a custom stack that places `alias` after `modelDriven`, a target on the model gets the same `ModelDriven` exemption as the Parameters Interceptor."
2. **Lines 89-90:** "once `struts.parameters.requireAnnotations` is enabled" reads as if the setting were opt-in, but it's on by default since 7.0.0. "Silently skipped (logged at `WARN`)" also contradicts itself. Suggest: "…for the alias to keep working with `struts.parameters.requireAnnotations` enabled (the default). Without it, the alias is skipped and logged at `WARN` instead of setting `bar`."
After that it's ready. It will be merged when 7.5.0 is released.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "g0w6y (via GitHub)" <gi...@apache.org>.
g0w6y commented on PR #347:
URL: https://github.com/apache/struts-site/pull/347#issuecomment-6063184224
@lukaszlenart Sent you an invite to a private repo to continue this — let me know if it didn't come through.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "g0w6y (via GitHub)" <gi...@apache.org>.
g0w6y commented on PR #347:
URL: https://github.com/apache/struts-site/pull/347#issuecomment-6061806051
> For future reports: if you believe something is a vulnerability, please send it to [security@struts.apache.org](mailto:security@struts.apache.org) first, per [SECURITY.md](https://github.com/apache/struts/blob/main/SECURITY.md). Anything opened as a public ticket or PR is handled as regular hardening, credited on the ticket.
@lukaszlenart Thanks , Noted
LMK if i report the issue through mail will i able to submit my own pr ? like as am doing now. i can continue submit pr and if all okay then merge the pr with the proper credit possible ??
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on PR #347:
URL: https://github.com/apache/struts-site/pull/347#issuecomment-6061517201
For future reports: if you believe something is a vulnerability, please send it to security@struts.apache.org first, per [SECURITY.md](https://github.com/apache/struts/blob/main/SECURITY.md). Anything opened as a public ticket or PR is handled as regular hardening, credited on the ticket.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on code in PR #347:
URL: https://github.com/apache/struts-site/pull/347#discussion_r4198729026
##########
source/core-developers/alias-interceptor.md:
##########
@@ -49,6 +49,39 @@ before `conversionError` so that a conversion failure while binding the aliased
There is no `overwrite` flag on this interceptor; the ordering above is the supported way to get that behavior.
+## Parameter Authorization
+
+The value this interceptor copies onto the alias target can come from two different places, and
+each is authorized differently:
+
+- **The source name does not resolve anywhere on the value stack**, so the interceptor falls back
+ to the raw HTTP request parameter of that name — the behavior the `foo`/`bar` example above
+ relies on. This path always requires [`@StrutsParameter`](struts-parameter-annotation.html) on
Review Comment:
"always requires" and "governed by `struts.parameters.requireAnnotations`" contradict each other: with the setting off, nothing is required. Suggest: "This path requires `@StrutsParameter` on the target when `struts.parameters.requireAnnotations` is enabled (the default since Struts 7.0.0), the same as the Parameters Interceptor."
##########
source/core-developers/alias-interceptor.md:
##########
@@ -49,6 +49,39 @@ before `conversionError` so that a conversion failure while binding the aliased
There is no `overwrite` flag on this interceptor; the ordering above is the supported way to get that behavior.
+## Parameter Authorization
+
+The value this interceptor copies onto the alias target can come from two different places, and
+each is authorized differently:
+
+- **The source name does not resolve anywhere on the value stack**, so the interceptor falls back
+ to the raw HTTP request parameter of that name — the behavior the `foo`/`bar` example above
+ relies on. This path always requires [`@StrutsParameter`](struts-parameter-annotation.html) on
+ the target, governed by `struts.parameters.requireAnnotations` (default `true` since Struts
+ 7.0.0), the same as the [Parameters Interceptor](parameters-interceptor.html).
+- **The source name resolves on the value stack** — typically a property an earlier action in a
+ chain already bound through its own, separately-authorized setter. Copying this is the same
+ category of operation as the [Chaining Interceptor](chaining-interceptor.html), so it follows
+ the same opt-in constant:
+
+ ```xml
+ <constant name="struts.chaining.requireAnnotations" value="true"/>
+ ```
+
+ With this off (the default), a stack-resolved value is copied regardless of annotation, matching
+ this interceptor's traditional behavior. With it on, an unannotated target is rejected here too,
+ not just on the request-parameter fallback.
+
+In both cases a rejected target is skipped and logged at `WARN`, and authorization uses the same
+`ParameterAuthorizer` service the Parameters and Chaining interceptors use. An alias target is
+always a direct (non-nested) property, so while an application is migrating,
Review Comment:
An alias target can be a nested path. `#{ 'foo' : 'bean.bar' }` is valid, because the target only has to match the accepted parameter-name pattern. `transitionMode` exempts only non-nested names (`StrutsParameterAuthorizer`), so a nested target is still checked. Suggest: "While an application is migrating, `struts.parameters.requireAnnotations.transitionMode=true` exempts non-nested alias targets, the same way it exempts any other non-nested setter, on both paths above. Nested targets still need the annotation."
##########
source/core-developers/alias-interceptor.md:
##########
@@ -49,6 +49,39 @@ before `conversionError` so that a conversion failure while binding the aliased
There is no `overwrite` flag on this interceptor; the ordering above is the supported way to get that behavior.
+## Parameter Authorization
+
+The value this interceptor copies onto the alias target can come from two different places, and
+each is authorized differently:
+
+- **The source name does not resolve anywhere on the value stack**, so the interceptor falls back
+ to the raw HTTP request parameter of that name — the behavior the `foo`/`bar` example above
+ relies on. This path always requires [`@StrutsParameter`](struts-parameter-annotation.html) on
+ the target, governed by `struts.parameters.requireAnnotations` (default `true` since Struts
+ 7.0.0), the same as the [Parameters Interceptor](parameters-interceptor.html).
+- **The source name resolves on the value stack** — typically a property an earlier action in a
+ chain already bound through its own, separately-authorized setter. Copying this is the same
Review Comment:
Please drop "separately-authorized". A value on the stack can be any state of the earlier action, not only something that was bound from the request through an annotated setter. "typically a property an earlier action in a chain already holds" is accurate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document AliasInterceptor's @StrutsParameter authorization [struts-site]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart commented on PR #347:
URL: https://github.com/apache/struts-site/pull/347#issuecomment-6062422080
> > For future reports: if you believe something is a vulnerability, please send it to [security@struts.apache.org](mailto:security@struts.apache.org) first, per [SECURITY.md](https://github.com/apache/struts/blob/main/SECURITY.md). Anything opened as a public ticket or PR is handled as regular hardening, credited on the ticket.
>
> Thanks, noted.
>
> If I report through [security@struts.apache.org](mailto:security@struts.apache.org) first, am I still able to submit my own PR for the fix the same way I'm doing now? I'd like to keep contributing the actual code change myself, with it merged and credited properly once everything looks good.
Let's keep such discussions confidential instead of discussing on a public forum
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org