[jira] [Resolved] (WW-5631) Add opt-in @StrutsParameter enforcement to ChainingInterceptor

["Lukasz Lenart (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WW-5631?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lukasz Lenart resolved WW-5631.
-------------------------------
    Resolution: Fixed

> Add opt-in @StrutsParameter enforcement to ChainingInterceptor
> --------------------------------------------------------------
>
>                 Key: WW-5631
>                 URL: https://issues.apache.org/jira/browse/WW-5631
>             Project: Struts 2
>          Issue Type: New Feature
>          Components: Core Interceptors
>            Reporter: Lukasz Lenart
>            Assignee: Lukasz Lenart
>            Priority: Major
>             Fix For: 7.2.0
>
>          Time Spent: 50m
>  Remaining Estimate: 0h
>
> h2. Summary
> Add an opt-in option to make {{ChainingInterceptor}} honour the {{@StrutsParameter}} annotation on the target action when copying properties during action chaining.
> h2. Background
> {{@StrutsParameter}} currently gates a single channel: binding of HTTP request parameters to action properties via {{ParametersInterceptor}}. Action chaining is a separate, developer-configured channel — {{ChainingInterceptor}} copies all eligible properties between actions regardless of annotations. This is by design, but some applications would prefer chaining to respect the same annotation boundary as parameter injection.
> h2. Proposal
>   
> Introduce a new constant {{struts.chaining.requireAnnotations}} (default {{false}}):
> * When {{false}} (default), behaviour is unchanged — no overhead, fully backward compatible.
> * When {{true}}, {{ChainingInterceptor}} only copies a property if the target action member is authorized by {{@StrutsParameter}}, reusing the existing {{ParameterAuthorizer}} service so {{requireAnnotations}}, {{transitionMode}} and {{depth}} semantics stay consistent with {{ParametersInterceptor}}.
> h2. Behaviour notes
> * Rejected properties are skipped and logged at {{WARN}}.
> * Fail-closed: if the target action cannot be introspected, nothing is copied for that object.
> * Global constant only (no per-interceptor-ref override).
>   
> h2. Acceptance criteria
>   
> * New {{struts.chaining.requireAnnotations}} constant and {{default.properties}} entry (default {{false}}).
> * {{ChainingInterceptor}} enforces {{@StrutsParameter}} on the target when enabled.
> * Unit tests cover: flag off, flag on with annotated/unannotated target, transition mode, proxied target, and fail-closed introspection.
>   * Updated {{ChainingInterceptor}} JavaDoc.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)