(struts-site) branch docs/struts-7.3.0-json-param-filtering created (now 9631fa5c9)

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a change to branch docs/struts-7.3.0-json-param-filtering
in repository https://gitbox.apache.org/repos/asf/struts-site.git


      at 9631fa5c9 docs: note @StrutsParameter getter enforcement for JSON/REST scalar collections (7.3.0)

This branch includes the following new commits:

     new ebe740e63 docs: document JSON input parameter filtering (Struts 7.3.0)
     new 9631fa5c9 docs: note @StrutsParameter getter enforcement for JSON/REST scalar collections (7.3.0)

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(struts-site) 02/02: docs: note @StrutsParameter getter enforcement for JSON/REST scalar collections (7.3.0)

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a commit to branch docs/struts-7.3.0-json-param-filtering
in repository https://gitbox.apache.org/repos/asf/struts-site.git

commit 9631fa5c9c0663c994e4e4addcd7ca76ddad82ef
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Tue Jul 14 14:43:17 2026 +0200

    docs: note @StrutsParameter getter enforcement for JSON/REST scalar collections (7.3.0)
    
    Under requireAnnotations, JSON/REST population of a scalar collection now
    authorizes element paths (list[0]) on the getter at depth=1, matching the
    Parameters Interceptor. Actions relying on the old container-setter check
    must annotate the getter (WW-4858, apache/struts#1784).
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 source/core-developers/struts-parameter-annotation.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/source/core-developers/struts-parameter-annotation.md b/source/core-developers/struts-parameter-annotation.md
index 1c2ac830e..32f19fdd5 100644
--- a/source/core-developers/struts-parameter-annotation.md
+++ b/source/core-developers/struts-parameter-annotation.md
@@ -125,6 +125,24 @@ public class MyAction {
 }
 ```
 
+{:.alert .alert-warning}
+**Struts 7.3.0 behavior change (JSON/REST).** When a JSON or REST payload
+populates a collection of *simple* types element by element — e.g.
+`{"mySelection":["A","B"]}` binds to `mySelection[0]`, `mySelection[1]` — the
+element paths are now authorized on the **getter** at `depth = 1`, matching how
+the [Parameters Interceptor](parameters-interceptor.html) gates the flat name
+`mySelection[0]`. Previously the JSON path checked only the container setter
+(`depth = 0`). If your action populates a scalar collection from a JSON/REST body
+under `requireAnnotations`, annotate the getter as well:
+```java
+@StrutsParameter(depth = 1)
+public List<String> getMySelection() {
+    return mySelection;
+}
+```
+List-of-objects payloads (`items[0].name`, `depth = 2`) are unaffected — they
+already required the annotated getter.
+
 When populating properties of objects that are already in a collection, annotate the
 getter. Because reaching an element's property requires indexing into the collection
 *and then* following the property, this needs `depth = 2` (see

(struts-site) 01/02: docs: document JSON input parameter filtering (Struts 7.3.0)

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a commit to branch docs/struts-7.3.0-json-param-filtering
in repository https://gitbox.apache.org/repos/asf/struts-site.git

commit ebe740e63cab6850fe93aafe11a7591ad09977ca
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Tue Jul 14 14:42:36 2026 +0200

    docs: document JSON input parameter filtering (Struts 7.3.0)
    
    JSON population now applies the same name/value acceptability controls
    as the Parameters Interceptor (WW-4858, apache/struts#1773):
    
    - Always-on: framework-wide accepted/excluded name patterns, param-name
      max length (paramNameMaxLength, default 100), ParameterNameAware /
      ParameterValueAware callbacks, @StrutsParameter authorization.
    - Opt-in: acceptedValuePatterns / excludedValuePatterns and
      applyPropertyFiltersToInput (reuse excludeProperties/includeProperties
      on input).
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 source/plugins/json/index.md | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/source/plugins/json/index.md b/source/plugins/json/index.md
index cfa7cff04..9be23a5ad 100644
--- a/source/plugins/json/index.md
+++ b/source/plugins/json/index.md
@@ -590,6 +590,48 @@ annotation **per property, during deserialization** — unauthorized fields are
 never set on the target object. Annotate the action properties that may be
 populated from the JSON request body.
 
+### Input parameter filtering
+
+Since Struts 7.3.0, populating an action from a JSON request body applies the
+same name/value acceptability controls that the
+[Parameters Interceptor](../../core-developers/parameters-interceptor.html)
+applies to ordinary HTTP request parameters. Filtering uses the same
+dotted/indexed key paths as form parameters (`address.city`, `items[0].name`),
+so the shared pattern checkers behave identically on JSON and form input.
+Population itself stays pure reflection over bean setters — no OGNL name
+evaluation is introduced on the JSON path.
+
+The following controls are **always on**:
+
+- **Excluded and accepted name patterns** — the same framework-wide
+  accepted/excluded parameter-name patterns the Parameters Interceptor uses. A
+  JSON key whose full dotted/indexed path matches an excluded pattern, or fails
+  to match any accepted pattern, is not populated.
+- **Maximum key-path length** — set with the `paramNameMaxLength` interceptor
+  param (default `100`). JSON keys whose full dotted path is longer are rejected.
+- **`ParameterNameAware` / `ParameterValueAware`** action callbacks — honored for
+  JSON input exactly as for form parameters.
+- **`@StrutsParameter` authorization** — see
+  [Parameter authorization](#parameter-authorization) above.
+
+The following controls are **opt-in** — disabled by default to preserve existing
+behavior for permissive JSON apps:
+
+| Interceptor param | Default | Effect |
+|-------------------|---------|--------|
+| `acceptedValuePatterns` | *(none)* | Comma-delimited regular expressions; when set, only JSON leaf **values** matching one of them are accepted (matching is case-insensitive). |
+| `excludedValuePatterns` | *(none)* | Comma-delimited regular expressions; JSON leaf **values** matching any of them are removed (matching is case-insensitive). |
+| `applyPropertyFiltersToInput` | `false` | When `true`, the interceptor's own `excludeProperties` / `includeProperties` patterns — otherwise used only for serialization output — also gate which JSON keys are populated on **input**. |
+
+```xml
+<interceptor-ref name="json">
+  <param name="paramNameMaxLength">120</param>
+  <param name="acceptedValuePatterns">[\w\s.@-]+</param>
+  <param name="applyPropertyFiltersToInput">true</param>
+  <param name="excludeProperties">login.password</param>
+</interceptor-ref>
+```
+
 ## JSON RPC
 
 The json plugin can be used to execute action methods from javascript and return the output. This feature was developed