This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch docs/struts-7.3.0-content-audit in repository https://gitbox.apache.org/repos/asf/struts-site.git
commit 619ee1bd3793807f586877743afc46761e532a85 Author: Lukasz Lenart <[email protected]> AuthorDate: Mon Aug 3 07:37:37 2026 +0200 docs: document Weld client-proxy recognition in the CDI plugin WW-5604: Struts resolved the target class behind Spring and Hibernate proxies but not behind Weld client proxies, so members of normal-scoped CDI beans were evaluated against the proxy class in SecurityMemberAccess. The plugin now registers CdiProxyService as struts.proxyService out of the box; Weld detection activates only when Weld is on the classpath. Co-Authored-By: Claude Opus 5 <[email protected]> --- source/plugins/cdi/index.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/source/plugins/cdi/index.md b/source/plugins/cdi/index.md index bdcab636f..1c7887e20 100644 --- a/source/plugins/cdi/index.md +++ b/source/plugins/cdi/index.md @@ -143,6 +143,27 @@ the right name. Just add a constant like this to your struts.xml to be on the ha ``` +### Proxied beans + +> Since Struts 7.3.0 + +Normal-scoped CDI beans (`@SessionScoped`, `@RequestScoped`, `@ApplicationScoped`, …) are injected as client proxies. +Struts resolves the real target class of a proxy before evaluating the OGNL member allowlist, but only knew about +Spring and Hibernate proxies — a Weld client proxy was not recognised, so members reached through it were evaluated +against the proxy class, see [WW-5604](https://issues.apache.org/jira/browse/WW-5604). + +The plugin now registers its own `ProxyService` implementation, which adds Weld client-proxy detection on top of the +default one: + +```xml +<bean type="org.apache.struts2.util.ProxyService" name="cdi" class="org.apache.struts2.cdi.CdiProxyService"/> +<constant name="struts.proxyService" value="cdi"/> +``` + +Both lines ship in the plugin's `struts-plugin.xml`, so nothing has to be configured. Weld detection activates only +when Weld is on the classpath; with any other CDI implementation the plugin behaves exactly as the default +`ProxyService` did. Override `struts.proxyService` only if you supply your own implementation. + ## Usage CDI has an extremely rich feature set, and this section is not intended as a replacement for the CDI reference
