[
https://issues.apache.org/jira/browse/WW-5709?focusedWorklogId=1041214&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041214
]
ASF GitHub Bot logged work on WW-5709:
--------------------------------------
Author: ASF GitHub Bot
Created on: 13/Sep/26 16:22
Start Date: 13/Sep/26 16:22
Worklog Time Spent: 10m
Work Description: lukaszlenart merged PR #1931:
URL: https://github.com/apache/struts/pull/1931
Issue Time Tracking
-------------------
Worklog Id: (was: 1041214)
Time Spent: 0.5h (was: 20m)
> @StrutsParameter enforcement does not recognise fluent (non-void) setters
> -------------------------------------------------------------------------
>
> Key: WW-5709
> URL: https://issues.apache.org/jira/browse/WW-5709
> Project: Struts 2
> Issue Type: Task
> Components: Core
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.4.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> {{java.beans.Introspector}} treats a {{set*}} method as a property write
> method only when its return type is {{void}}. OGNL does not:
> {{OgnlRuntime._getSetMethod}} matches a setter on name and argument count
> alone, with no return-type check.
> {{StrutsParameterAuthorizer}} derives its view of what a target can bind from
> {{java.beans}} property descriptors, so a fluent setter such as
> public MyAction setFoo(String foo) { this.foo = foo; return this; }
> is invisible to the authorizer while remaining perfectly bindable by OGNL.
> Two symptoms follow from that one cause.
> h3. 1. {{@StrutsParameter}} on a fluent setter has no effect
> {{hasValidAnnotatedPropertyDescriptor}} reads {{propDesc.getWriteMethod()}},
> which is {{null}} here, so it returns {{false}} and the check falls through
> to {{hasValidAnnotatedField}}. Unless the backing field also carries the
> annotation, the parameter is rejected even though the developer annotated the
> setter. This fails closed, but it is silent and hard to diagnose.
> h3. 2. On a ModelDriven action, an unannotated fluent setter on the action
> escapes the requirement
> {{declaresProperty}}, added in WW-5698, asks the same {{java.beans}} question
> to decide whether a property belongs to the model or to the action. A fluent
> setter on the action answers "neither", so the parameter takes the "declared
> on neither the model nor the action" fallback that exists for custom OGNL
> property accessors, and is exempted. OGNL then binds it through the fluent
> setter on the action.
> This is not a regression: before WW-5698 every parameter on a ModelDriven
> action was exempt unconditionally, so it is no more permissive than the
> previous behaviour. It is the one case where WW-5698 does not fully reach its
> stated goal of subjecting a ModelDriven action's own members to the
> annotation requirement.
> h3. Suggested fix
> Identify setters the way OGNL does — by name and arity rather than by
> {{java.beans}} write methods — in both
> {{StrutsParameterAuthorizer.declaresProperty}} and
> {{hasValidAnnotatedPropertyDescriptor}}, so the authorizer's model of what is
> bindable matches what OGNL will actually bind.
> Found while reviewing WW-5698 / PR
> [#1872|https://github.com/apache/struts/pull/1872].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
