Lukasz Lenart created WW-5745:
---------------------------------
Summary: REST plugin authorizes a forward-referenced object-id
property at the depth where the reference resolves
Key: WW-5745
URL: https://issues.apache.org/jira/browse/WW-5745
Project: Struts 2
Issue Type: Bug
Components: Plugin - REST
Reporter: Lukasz Lenart
h2. Summary
When a property refers to an object by {{@JsonIdentityInfo}} id before that
object has appeared in the body, Jackson defers the assignment:
{{ObjectIdReferenceProperty}} registers a {{PropertyReferring}} and, once the
referenced object is deserialized, calls the referring property's {{set()}}
from {{handleResolvedForwardReference}}. That call happens wherever the
referenced object turns up in the document, which can be at a different nesting
depth than the referring property.
{{AuthorizingSettableBeanProperty.set()}} authorizes with
{{ParameterAuthorizationContext.pathFor(memberName)}}, i.e. the member name
appended to whatever path prefix is on the stack _at the time of the call_. For
a deferred assignment that prefix belongs to the object being deserialized when
the reference resolves, not to the bean that owns the referring property, so
the path checked is wrong.
Surfaced by the WW-5727 reviews; pre-existing and independent of that fix.
h2. Current behaviour
The mis-computed path can only add a rejection (the wrong prefix is unlikely to
be granted), so this fails closed: a correctly annotated forward reference may
be dropped with a WARN naming a path the developer never wrote. The first,
non-deferred read of the referring property is authorized at the correct path
through {{AuthorizingValueDeserializer}}, so no unauthorized value is assigned.
h2. Proposed change
Capture the path prefix when the referring property is first read and use it
when the deferred {{set()}} runs — e.g. wrap the {{Referring}} Jackson
registers, or record the prefix on the wrapper before the reference is
deferred. Add a test with two identified objects where the reference appears
before its target at a different depth, asserting the referring property binds
under its own path when granted and is rejected when not.
h2. Compatibility notes
No configuration or API change. Only forward references across nesting depths
are affected, and only in the direction of a spurious rejection.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
