jdaugherty commented on code in PR #15699:
URL: https://github.com/apache/grails-core/pull/15699#discussion_r3343206187
##########
grails-web-databinding/src/main/groovy/org/grails/web/databinding/DefaultASTDatabindingHelper.java:
##########
@@ -145,9 +145,20 @@ private Set<String>
getPropertyNamesToIncludeInWhiteList(final SourceUnit source
final Set<String> propertyNamesToIncludeInWhiteList = new HashSet<>();
final Set<String> unbindablePropertyNames = new HashSet<>();
final Set<String> bindablePropertyNames = new HashSet<>();
+ final boolean isDomainClass = GrailsASTUtils.isDomainClass(classNode,
sourceUnit);
if (!classNode.getSuperClass().equals(new ClassNode(Object.class))) {
final Set<String> parentClassPropertyNames =
getPropertyNamesToIncludeInWhiteListForParentClass(sourceUnit,
classNode.getSuperClass());
- bindablePropertyNames.addAll(parentClassPropertyNames);
+ for (final String parentPropertyName : parentClassPropertyNames) {
+ // The id, version, dateCreated and lastUpdated properties of
a domain class are never bound by default.
+ // A parent class may legitimately include these in its own
whitelist when it is not itself recognised as
+ // a domain class (for example an abstract @DirtyCheck base
class in src/main/groovy onto which GORM injects
+ // id and version). Such properties must not be inherited into
a domain class' whitelist, otherwise the
+ // exclusion performed by shouldFieldBeInWhiteList is bypassed
via the inherited bindable property names.
+ if (isDomainClass &&
DOMAIN_CLASS_PROPERTIES_TO_EXCLUDE_BY_DEFAULT.contains(parentPropertyName)) {
Review Comment:
Apologies, I wasn't asking if this would skip command objects. I was asking
if this same issue exists with them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
