[
https://issues.apache.org/jira/browse/WW-5642?focusedWorklogId=1030763&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1030763
]
ASF GitHub Bot logged work on WW-5642:
--------------------------------------
Author: ASF GitHub Bot
Created on: 16/Jul/26 13:28
Start Date: 16/Jul/26 13:28
Worklog Time Spent: 10m
Work Description: lukaszlenart commented on PR #1774:
URL: https://github.com/apache/struts/pull/1774#issuecomment-4992448633
Thanks for this — the analysis is correct and the fix is well-targeted. To
frame it for anyone reading: the per-property `@StrutsParameter` enforcement
introduced in 7.2.0 covered Jackson's setter/field path but not the
creator-bound path (records, `@JsonCreator`, `@ConstructorProperties`), which
Jackson populates through the value deserializer. This PR **completes that
enforcement** rather than fixing a regression — before 7.2.0 REST bodies had no
per-property control at all, so nothing that was previously protected was
exposed.
The approach (wrapping the creator-property value deserializer, plus
fail-closing construction that fails after a redaction) is sound, and the
record / static-factory / `@ConstructorProperties` / nested / collection test
matrix is exactly what I'd want to see. I'll take it through review and merge
once CI is green. Appreciate you also checking on the disclosure process up
front — for this one, completing a brand-new control in the open is fine.
Issue Time Tracking
-------------------
Worklog Id: (was: 1030763)
Time Spent: 1h 40m (was: 1.5h)
> @StrutsParameter authorization bypassed for record/creator-bound REST body
> properties
> -------------------------------------------------------------------------------------
>
> Key: WW-5642
> URL: https://issues.apache.org/jira/browse/WW-5642
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Affects Versions: 7.2.1
> Environment: Reproducible with struts2-rest-plugin,
> struts.parameters.requireAnnotations
> enabled, and any REST action whose request body binds a Java record
> (or @JsonCreator/@ConstructorProperties type) either at the top level
> or nested. JDK 17, Jackson 2.22.0.
> Reporter: Gouri Sankar A
> Priority: Major
> Fix For: 7.3.0
>
> Time Spent: 1h 40m
> Remaining Estimate: 0h
>
> ParameterAuthorizingModule enforces @StrutsParameter on REST/JSON body
> deserialization by wrapping each Jackson property's deserializeAndSet /
> deserializeSetAndReturn (AuthorizingSettableBeanProperty). Jackson never
> calls either method for creator-bound properties — Java records,
> @JsonCreator constructors, @ConstructorProperties — it calls the final
> SettableBeanProperty#deserialize directly, which the existing wrapper
> cannot intercept.
> With struts.parameters.requireAnnotations enabled, any record-typed
> field in a REST action's request body is populated with no
> @StrutsParameter check at all, silently defeating the protection for
> that entire subtree.
> Fix: wrap the property's value deserializer (the only non-final
> interception point for the creator-bound path), scoped to
> CreatorProperty so existing setter/field/builder paths are unaffected.
> Fixed by: https://github.com/apache/struts/pull/1774
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
