[
https://issues.apache.org/jira/browse/WW-5748?focusedWorklogId=1041700&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041700
]
ASF GitHub Bot logged work on WW-5748:
--------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 14:56
Start Date: 15/Sep/26 14:56
Worklog Time Spent: 10m
Work Description: sonarqubecloud[bot] commented on PR #1947:
URL: https://github.com/apache/struts/pull/1947#issuecomment-5682504713
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1947)
**Quality Gate passed**
Issues
 [2 New
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1947&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1947&issueStatuses=ACCEPTED)
Measures
 [0 Security
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=1947&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [86.7% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1947&metric=new_coverage&view=list)
 [0.0% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1947&metric=new_duplicated_lines_density&view=list)
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1041700)
Time Spent: 20m (was: 10m)
> Registering ParameterAuthorizingModule breaks unwrapped XML lists in
> JacksonXmlHandler
> --------------------------------------------------------------------------------------
>
> Key: WW-5748
> URL: https://issues.apache.org/jira/browse/WW-5748
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.4.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h2. Summary
> {{JacksonXmlHandler}} registers {{ParameterAuthorizingModule}} on its
> {{XmlMapper}}. {{ObjectMapper.registerModule}} inserts a module's
> {{BeanDeserializerModifier}} at the _head_ of the modifier list, so the
> Struts modifier runs before Jackson XML's own
> {{XmlBeanDeserializerModifier}}. The Struts modifier wraps every bean
> deserializer in {{RedactionAwareDeserializer}} (a
> {{DelegatingDeserializer}}); the XML modifier then tests the deserializer it
> receives with {{instanceof BeanDeserializerBase}}, does not recognise the
> wrapper, and skips installing its {{WrapperHandlingDeserializer}}.
> Unwrapped-list handling is therefore lost for every bean read through the XML
> handler.
> h2. Current behaviour
> Reproduced with a plain {{XmlMapper}} (no authorization context bound — the
> module's mere registration is enough):
> {code:java}public class Bean {
> @JacksonXmlElementWrapper(useWrapping = false)
> public List<String> items;
> public String name;
> }
> {code}
> {code:xml}<Bean><items>a</items><items>b</items><name>n</name></Bean>
> {code}
> Without the module: {{items = [a, b]}}, {{name = n}}. With the module
> registered: {{MismatchedInputException: Cannot construct instance of
> java.util.ArrayList ... no String-argument constructor/factory method to
> deserialize from String value ('a')}}. {{@JacksonXmlText}} is unaffected
> (verified).
> Present since the module was introduced (7.2.0); independent of
> {{struts.parameters.requireAnnotations}}.
> h2. Proposed change
> Let the XML module's modifier see a {{BeanDeserializerBase}}. Options, in
> order of preference:
> * in {{ParameterAuthorizingModule.setupModule}}, or in {{JacksonXmlHandler}},
> register the modifier so that it runs _after_ the format module's (e.g.
> construct the handler's mapper with the XML module first and add the Struts
> modifier through {{SimpleModule.setDeserializerModifier}} on a module
> registered last — verify the resulting order, since {{insertInListNoDup}}
> prepends);
> * or have {{RedactionAwareDeserializer}} be applied from a later hook than
> {{modifyDeserializer}}.
> Add a test on {{JacksonXmlHandler}} with an unwrapped list, with and without
> an authorization context.
> h2. Compatibility notes
> No configuration or API change; only restores documented Jackson XML
> behaviour for the REST plugin's XML handler.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
