This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a change to branch WW-5650-json-per-request-reader-writer
in repository https://gitbox.apache.org/repos/asf/struts.git
from d4c969c2f WW-5650 resolve JSONUtil lazily only on JSON request paths
add b70ecc8e1 WW-5645 Canonicalise static content paths and remove
redundant URL decode (#1777)
add 40fcae310 WW-4858 test(json): cover nested-leaf accepted-name and
include patterns (#1783)
add cf22320e3 docs(security): treat a fix or PR as disclosure, require
private report first (#1785)
add e5eb01abd WW-5642 fix(rest): authorize @StrutsParameter on
record/creator-bound REST body properties (#1774)
add de599c91d WW-5646 Modernize path normalization in Include component
(#1780)
add e867106a9 Merge remote-tracking branch 'origin/main' into
WW-5650-json-per-request-reader-writer
No new revisions were added by this update.
Summary of changes:
SECURITY.md | 29 ++-
.../main/java/org/apache/struts2/RequestUtils.java | 5 +
.../org/apache/struts2/components/Include.java | 19 +-
.../dispatcher/DefaultStaticContentLoader.java | 38 ++--
.../struts2/dispatcher/StaticContentLoader.java | 31 ++-
.../parameter/ParameterAuthorizationContext.java | 48 +++++
.../struts2/webjars/DefaultWebJarUrlProvider.java | 11 +-
.../dispatcher/DefaultStaticContentLoaderTest.java | 19 +-
.../DefaultStaticContentLoaderWebJarTest.java | 12 +-
.../dispatcher/StaticContentLoaderTest.java | 2 -
.../ParameterAuthorizationContextTest.java | 43 ++++
.../apache/struts2/views/jsp/IncludeTagTest.java | 12 ++
.../apache/struts2/json/JSONInterceptorTest.java | 47 ++++
.../jackson/AuthorizingSettableBeanProperty.java | 20 ++
.../jackson/AuthorizingValueDeserializer.java | 92 ++++++++
.../jackson/ParameterAuthorizingModule.java | 11 +
.../jackson/RedactionAwareDeserializer.java | 96 +++++++++
.../jackson/ParameterAuthorizingModuleTest.java | 240 +++++++++++++++++++++
18 files changed, 727 insertions(+), 48 deletions(-)
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/AuthorizingValueDeserializer.java
create mode 100644
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/RedactionAwareDeserializer.java
