[
https://issues.apache.org/jira/browse/WW-5720?focusedWorklogId=1041745&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041745
]
ASF GitHub Bot logged work on WW-5720:
--------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 17:08
Start Date: 15/Sep/26 17:08
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1948:
URL: https://github.com/apache/struts/pull/1948
Fixes [WW-5720](https://issues.apache.org/jira/browse/WW-5720)
With `struts.rest.anySetter.requireAnnotations` enabled,
`AuthorizingSettableAnyProperty` wrote one WARN per rejected dynamic key. An
any-setter's key space is the request body, so a body with ten thousand unknown
keys wrote ten thousand WARN lines.
**Change**
- New request-scoped `DynamicKeyRejections` tallies rejections per
any-setter (`Class#member`, or `Class#creator[n]` for a creator parameter) and
reason.
- Per-key detail moves to DEBUG; one WARN per any-setter and reason is
written when `ParameterAuthorizingModule.clearRequestState()` runs — both
Jackson handlers already call it in a `finally`, and `ContentTypeInterceptor`
once more after unbinding, where the second call is a no-op.
- The four reasons (missing consent, creator-parameter form, depth exceeded,
property name unavailable) keep distinct wording, since they point at different
fixes on the application side.
- Rejection itself is unchanged: `redactAndSkip` still runs on every path.
The tally is its own holder rather than part of
`DynamicKeyAuthorizationContext`, which is the nested-scope depth stack pushed
and popped per accepted key; the tally is per request and flushed at a
different point. It is keyed by the class model and a four-value enum, so its
size does not depend on the body.
**Tests**
`ParameterAuthorizingModuleTest` captures the `DynamicKeyRejections` logger:
zero WARNs during the read and exactly one after the clear with the count and
sink; a second clear logs nothing; distinct summaries per reason and per sink;
the creator-parameter label.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1041745)
Remaining Estimate: 0h
Time Spent: 10m
> AuthorizingSettableAnyProperty logs one WARN per rejected dynamic key
> ---------------------------------------------------------------------
>
> Key: WW-5720
> URL: https://issues.apache.org/jira/browse/WW-5720
> Project: Struts 2
> Issue Type: Improvement
> Components: Plugin - REST
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Follow-up to WW-5712.
> When {{struts.rest.anySetter.requireAnnotations}} is enabled,
> {{AuthorizingSettableAnyProperty.rejectPermission}} and {{rejectDepth}} emit
> a WARN for every rejected dynamic key. For the existing
> {{AuthorizingSettableBeanProperty}} a per-property WARN is fine, because the
> set of property names is bounded by the target class's declared members. For
> an any-setter the key space is whatever the request body contains, so the
> number of WARN lines written per request is bounded only by the body itself:
> a body with ten thousand unknown keys against an unannotated sink produces
> ten thousand WARN lines.
> Log once per body instead. Suggested shape:
> * keep the per-key detail at DEBUG;
> * count rejections per request in the same request-scoped state that
> {{DynamicKeyAuthorizationContext}} already holds, and emit a single WARN with
> the count and the sink (target class plus member) when the scope is cleared
> at the end of the mapper read, which both Jackson handlers already do in a
> {{finally}};
> * keep the distinct messages for the three rejection reasons (missing
> consent, depth exceeded, creator-parameter form), since they point at
> different fixes on the application side.
> The rejection behaviour itself does not change; only the log volume does.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
