[jira] [Created] (WW-5709) @StrutsParameter enforcement does not recognise fluent (non-void) setters

["Lukasz Lenart (Jira)" <ji...@apache.org>]

Lukasz Lenart created WW-5709:
---------------------------------

             Summary: @StrutsParameter enforcement does not recognise fluent (non-void) setters
                 Key: WW-5709
                 URL: https://issues.apache.org/jira/browse/WW-5709
             Project: Struts 2
          Issue Type: Task
          Components: Core
            Reporter: Lukasz Lenart
             Fix For: 7.4.0


{{java.beans.Introspector}} treats a {{set*}} method as a property write method only when its return type is {{void}}. OGNL does not: {{OgnlRuntime._getSetMethod}} matches a setter on name and argument count alone, with no return-type check.

{{StrutsParameterAuthorizer}} derives its view of what a target can bind from {{java.beans}} property descriptors, so a fluent setter such as

    public MyAction setFoo(String foo) { this.foo = foo; return this; }

is invisible to the authorizer while remaining perfectly bindable by OGNL. Two symptoms follow from that one cause.

h3. 1. {{@StrutsParameter}} on a fluent setter has no effect

{{hasValidAnnotatedPropertyDescriptor}} reads {{propDesc.getWriteMethod()}}, which is {{null}} here, so it returns {{false}} and the check falls through to {{hasValidAnnotatedField}}. Unless the backing field also carries the annotation, the parameter is rejected even though the developer annotated the setter. This fails closed, but it is silent and hard to diagnose.

h3. 2. On a ModelDriven action, an unannotated fluent setter on the action escapes the requirement

{{declaresProperty}}, added in WW-5698, asks the same {{java.beans}} question to decide whether a property belongs to the model or to the action. A fluent setter on the action answers "neither", so the parameter takes the "declared on neither the model nor the action" fallback that exists for custom OGNL property accessors, and is exempted. OGNL then binds it through the fluent setter on the action.

This is not a regression: before WW-5698 every parameter on a ModelDriven action was exempt unconditionally, so it is no more permissive than the previous behaviour. It is the one case where WW-5698 does not fully reach its stated goal of subjecting a ModelDriven action's own members to the annotation requirement.

h3. Suggested fix

Identify setters the way OGNL does — by name and arity rather than by {{java.beans}} write methods — in both {{StrutsParameterAuthorizer.declaresProperty}} and {{hasValidAnnotatedPropertyDescriptor}}, so the authorizer's model of what is bindable matches what OGNL will actually bind.

Found while reviewing WW-5698 / PR [#1872|https://github.com/apache/struts/pull/1872].



--
This message was sent by Atlassian Jira
(v8.20.10#820010)