Lukasz Lenart created WW-5709:
---------------------------------
Summary: @StrutsParameter enforcement does not recognise fluent
(non-void) setters
Key: WW-5709
URL: https://issues.apache.org/jira/browse/WW-5709
Project: Struts 2
Issue Type: Task
Components: Core
Reporter: Lukasz Lenart
Fix For: 7.4.0
{{java.beans.Introspector}} treats a {{set*}} method as a property write method
only when its return type is {{void}}. OGNL does not:
{{OgnlRuntime._getSetMethod}} matches a setter on name and argument count
alone, with no return-type check.
{{StrutsParameterAuthorizer}} derives its view of what a target can bind from
{{java.beans}} property descriptors, so a fluent setter such as
public MyAction setFoo(String foo) { this.foo = foo; return this; }
is invisible to the authorizer while remaining perfectly bindable by OGNL. Two
symptoms follow from that one cause.
h3. 1. {{@StrutsParameter}} on a fluent setter has no effect
{{hasValidAnnotatedPropertyDescriptor}} reads {{propDesc.getWriteMethod()}},
which is {{null}} here, so it returns {{false}} and the check falls through to
{{hasValidAnnotatedField}}. Unless the backing field also carries the
annotation, the parameter is rejected even though the developer annotated the
setter. This fails closed, but it is silent and hard to diagnose.
h3. 2. On a ModelDriven action, an unannotated fluent setter on the action
escapes the requirement
{{declaresProperty}}, added in WW-5698, asks the same {{java.beans}} question
to decide whether a property belongs to the model or to the action. A fluent
setter on the action answers "neither", so the parameter takes the "declared on
neither the model nor the action" fallback that exists for custom OGNL property
accessors, and is exempted. OGNL then binds it through the fluent setter on the
action.
This is not a regression: before WW-5698 every parameter on a ModelDriven
action was exempt unconditionally, so it is no more permissive than the
previous behaviour. It is the one case where WW-5698 does not fully reach its
stated goal of subjecting a ModelDriven action's own members to the annotation
requirement.
h3. Suggested fix
Identify setters the way OGNL does — by name and arity rather than by
{{java.beans}} write methods — in both
{{StrutsParameterAuthorizer.declaresProperty}} and
{{hasValidAnnotatedPropertyDescriptor}}, so the authorizer's model of what is
bindable matches what OGNL will actually bind.
Found while reviewing WW-5698 / PR
[#1872|https://github.com/apache/struts/pull/1872].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
