This is an automated email from the ASF dual-hosted git repository. jamesfredley pushed a commit to branch 8.0.x in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 11ebb5a8cdecc9359654dd60bce1e6ab282c3b18 Merge: 1628a9c31f dad867634c Author: James Fredley <[email protected]> AuthorDate: Sat Aug 15 11:29:05 2026 -0400 Merge pull request #15947 from apache/fix/binddata-mass-assignment Add opt-in deny-by-default data binding and always honor bindable:false .../main/groovy/grails/artefact/Controller.groovy | 8 +- .../compiler/web/ControllerActionTransformer.java | 102 ++- .../src/main/groovy/grails/config/Settings.groovy | 2 + .../grails/databinding/SimpleDataBinder.groovy | 46 +- .../grails/databinding/SimpleDataBinderSpec.groovy | 36 + .../META-INF/spring-configuration-metadata.json | 6 + .../guide/theWebLayer/controllers/dataBinding.adoc | 4 +- grails-doc/src/en/guide/upgrading.adoc | 13 + grails-doc/src/en/ref/Constraints/bindable.adoc | 5 +- grails-doc/src/en/ref/Controllers/bindData.adoc | 30 +- .../web/databinding/GrailsWebDataBinderSpec.groovy | 310 +++++++- ...ngHelperDomainClassSpecialPropertiesSpec.groovy | 100 ++- .../web/commandobjects/CommandObjectsSpec.groovy | 29 + .../grails/web/servlet/BindDataMethodTests.groovy | 785 +++++++++++++++++++++ .../groovy/grails/web/databinding/BindAllowed.java | 30 + .../grails/web/databinding/DataBinder.groovy | 5 + .../grails/web/databinding/DataBindingUtils.java | 347 ++++++++- .../web/databinding/GrailsWebDataBinder.groovy | 391 +++++++++- .../DataBindingEventMulticastListener.groovy | 4 + .../databinding/DefaultASTDatabindingHelper.java | 107 ++- .../web/databinding/DenyByDefaultConfigSpec.groovy | 103 +++ 21 files changed, 2410 insertions(+), 53 deletions(-)
