This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch WW-5675-share-parsed-ognl-security-config in repository https://gitbox.apache.org/repos/asf/struts.git
commit 6216411b4def47b1ac76e374dab0f3db29d1e782 Author: Lukasz Lenart <[email protected]> AuthorDate: Fri Aug 14 13:49:00 2026 +0200 WW-5675 docs(ognl): record that bootstrapFactories is on the production path Co-Authored-By: Claude Opus 5 <[email protected]> --- ...WW-5675-security-member-access-config-sharing-design.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/superpowers/specs/2026-08-14-WW-5675-security-member-access-config-sharing-design.md b/docs/superpowers/specs/2026-08-14-WW-5675-security-member-access-config-sharing-design.md index b5435fe33..3523beb01 100644 --- a/docs/superpowers/specs/2026-08-14-WW-5675-security-member-access-config-sharing-design.md +++ b/docs/superpowers/specs/2026-08-14-WW-5675-security-member-access-config-sharing-design.md @@ -87,6 +87,20 @@ Concrete class, no interface, **not** aliased in `StrutsBeanSelectionProvider`. the shape of `ProviderAllowlist` and `ThreadAllowlist` (`DefaultConfiguration.java:418-419`), not a user extension point. +`bootstrapFactories` is on the production path, not test-only: `ConfigurationManager.addDefaultContainerProviders` +(`ConfigurationManager.java:94`) registers `StrutsDefaultConfigurationProvider`, which calls it at +`StrutsDefaultConfigurationProvider.java:116`, and `Dispatcher` drives `ConfigurationManager`. It reads as +test-oriented in a grep only because a dozen tests name the provider explicitly and `XWorkTestCaseHelper` — test +scaffolding that lives in `core/src/main` — registers it too. + +The method serves both the bootstrap container (`DefaultConfiguration.java:360`) and the main container, so each +gets its own configuration singleton. The bootstrap container carries only `BOOTSTRAP_CONSTANTS`, so most security +constants are absent there, the `required = false` setters do not fire, and the bean falls back to defaults — +exactly as a `SecurityMemberAccess` constructed in that container behaves today. + +The `TODO: SpringObjectFactoryTest fails when these are SINGLETON` comment at the top of `bootstrapFactories` +applies to the `*Factory` beans in the first block, not to this region, where singletons are already the norm. + It takes over these sixteen `@Inject` setters from `SecurityMemberAccess`: | Setter | Constant |
