[
https://issues.apache.org/jira/browse/WW-5642?focusedWorklogId=1030263&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1030263
]
ASF GitHub Bot logged work on WW-5642:
--------------------------------------
Author: ASF GitHub Bot
Created on: 14/Jul/26 10:22
Start Date: 14/Jul/26 10:22
Worklog Time Spent: 10m
Work Description: Copilot commented on code in PR #1774:
URL: https://github.com/apache/struts/pull/1774#discussion_r3578127280
##########
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/RedactionAwareDeserializer.java:
##########
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.struts2.rest.handler.jackson;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.JsonMappingException;
+import com.fasterxml.jackson.databind.deser.std.DelegatingDeserializer;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.apache.struts2.interceptor.parameter.ParameterAuthorizationContext;
+
+import java.io.IOException;
+
+/**
+ * Wraps every bean-type deserializer so that a construction failure caused by
+ * {@link AuthorizingValueDeserializer} / {@link
AuthorizingSettableBeanProperty} substituting a
+ * redacted ({@code null}) value for an unauthorized property
Issue Time Tracking
-------------------
Worklog Id: (was: 1030263)
Time Spent: 1h 20m (was: 1h 10m)
> @StrutsParameter authorization bypassed for record/creator-bound REST body
> properties
> -------------------------------------------------------------------------------------
>
> Key: WW-5642
> URL: https://issues.apache.org/jira/browse/WW-5642
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Affects Versions: 7.2.1
> Environment: Reproducible with struts2-rest-plugin,
> struts.parameters.requireAnnotations
> enabled, and any REST action whose request body binds a Java record
> (or @JsonCreator/@ConstructorProperties type) either at the top level
> or nested. JDK 17, Jackson 2.22.0.
> Reporter: Gouri Sankar A
> Priority: Major
> Fix For: 7.3.0
>
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> ParameterAuthorizingModule enforces @StrutsParameter on REST/JSON body
> deserialization by wrapping each Jackson property's deserializeAndSet /
> deserializeSetAndReturn (AuthorizingSettableBeanProperty). Jackson never
> calls either method for creator-bound properties — Java records,
> @JsonCreator constructors, @ConstructorProperties — it calls the final
> SettableBeanProperty#deserialize directly, which the existing wrapper
> cannot intercept.
> With struts.parameters.requireAnnotations enabled, any record-typed
> field in a REST action's request body is populated with no
> @StrutsParameter check at all, silently defeating the protection for
> that entire subtree.
> Fix: wrap the property's value deserializer (the only non-final
> interception point for the creator-bound path), scoped to
> CreatorProperty so existing setter/field/builder paths are unaffected.
> Fixed by: https://github.com/apache/struts/pull/1774
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
