[
https://issues.apache.org/jira/browse/WW-5745?focusedWorklogId=1041596&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041596
]
ASF GitHub Bot logged work on WW-5745:
--------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 09:14
Start Date: 15/Sep/26 09:14
Worklog Time Spent: 10m
Work Description: lukaszlenart merged PR #1944:
URL: https://github.com/apache/struts/pull/1944
Issue Time Tracking
-------------------
Worklog Id: (was: 1041596)
Time Spent: 40m (was: 0.5h)
> REST plugin authorizes a forward-referenced object-id property at the depth
> where the reference resolves
> --------------------------------------------------------------------------------------------------------
>
> Key: WW-5745
> URL: https://issues.apache.org/jira/browse/WW-5745
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> h2. Summary
> When a property refers to an object by {{@JsonIdentityInfo}} id before that
> object has appeared in the body, Jackson defers the assignment:
> {{ObjectIdReferenceProperty}} registers a {{PropertyReferring}} and, once the
> referenced object is deserialized, calls the referring property's {{set()}}
> from {{handleResolvedForwardReference}}. That call happens wherever the
> referenced object turns up in the document, which can be at a different
> nesting depth than the referring property.
> {{AuthorizingSettableBeanProperty.set()}} authorizes with
> {{ParameterAuthorizationContext.pathFor(memberName)}}, i.e. the member name
> appended to whatever path prefix is on the stack _at the time of the call_.
> For a deferred assignment that prefix belongs to the object being
> deserialized when the reference resolves, not to the bean that owns the
> referring property, so the path checked is wrong.
> Surfaced by the WW-5727 reviews; pre-existing and independent of that fix.
> h2. Current behaviour
> The mis-computed path can only add a rejection (the wrong prefix is unlikely
> to be granted), so this fails closed: a correctly annotated forward reference
> may be dropped with a WARN naming a path the developer never wrote. The
> first, non-deferred read of the referring property is authorized at the
> correct path through {{AuthorizingValueDeserializer}}, so no unauthorized
> value is assigned.
> h2. Proposed change
> Capture the path prefix when the referring property is first read and use it
> when the deferred {{set()}} runs — e.g. wrap the {{Referring}} Jackson
> registers, or record the prefix on the wrapper before the reference is
> deferred. Add a test with two identified objects where the reference appears
> before its target at a different depth, asserting the referring property
> binds under its own path when granted and is rejected when not.
> h2. Compatibility notes
> No configuration or API change. Only forward references across nesting depths
> are affected, and only in the direction of a spurious rejection.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
