[jira] [Created] (WW-5682) Remove the deprecated SecurityMemberAccess configuration setters

["Lukasz Lenart (Jira)" <ji...@apache.org>]

Lukasz Lenart created WW-5682:
---------------------------------

             Summary: Remove the deprecated SecurityMemberAccess configuration setters
                 Key: WW-5682
                 URL: https://issues.apache.org/jira/browse/WW-5682
             Project: Struts 2
          Issue Type: Improvement
            Reporter: Lukasz Lenart
             Fix For: 8.0.0


WW-5675 moved all OGNL security configuration parsing into a container-singleton bean, {{SecurityMemberAccessConfig}}. The configuration setters on {{SecurityMemberAccess}} lost their {{@Inject}} annotations and were deprecated rather than removed, so that existing subclasses and direct callers keep compiling in the 7.4.0 minor release.

They are annotated {{@Deprecated(since = "7.4.0", forRemoval = true)}}. This ticket removes them.

h2. Methods to remove

All on {{org.apache.struts2.ognl.SecurityMemberAccess}}:
* {{useAllowStaticFieldAccess}}
* {{useExcludedClasses}}
* {{useExcludedPackageNamePatterns}}
* {{useExcludedPackageNames}}
* {{useExcludedPackageExemptClasses}}
* {{useEnforceAllowlistEnabled}}
* {{useAllowlistClasses}}
* {{useAllowlistPackageNames}}
* {{useDisallowProxyObjectAccess}}
* {{useDisallowProxyMemberAccess}}
* {{useDisallowDefaultPackageAccess}}

Do _not_ remove {{useAcceptProperties}} or {{useExcludeProperties}}. Those carry per-request state set by {{ParametersInterceptor}} through the {{MemberAccessValueStack}} interface, are not configuration, and are not deprecated.

h2. Why this is not trivial

At the time of writing roughly 110 call sites across {{core}} and the {{spring}} and {{cdi}} plugins call these setters directly, almost all in tests, to construct a {{SecurityMemberAccess}} in a particular configuration without going through a container. Removing the setters means migrating every one of those to configure a {{SecurityMemberAccessConfig}} instead. That migration is the bulk of the work, not the deletion.

Two of them carry behaviour worth preserving in whatever replaces them:
* {{useAllowStaticFieldAccess(false)}} has a side effect: it also adds {{java.lang.Class}} to the excluded classes.
* The excluded-set setters accumulate onto the current value rather than assigning. That is what makes them commutative, which is what makes them safe against the container's unspecified {{getDeclaredMethods()}} injection order.

h2. Related
* WW-5675 deprecated them, and its design document records the reasoning: {{docs/superpowers/specs/2026-08-14-WW-5675-security-member-access-config-sharing-design.md}}
* WW-5678 is the sibling 8.0.0 cleanup for the package-matching helper naming and visibility in the same class. Worth doing in the same pass.
* Also consider {{allowlistPackageNames}} on {{SecurityMemberAccess}}, which became write-only in production code after WW-5675 and survives only because tests read it reflectively.

Blocked by WW-5675 landing first.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)