jamesfredley commented on PR #15808: URL: https://github.com/apache/grails-core/pull/15808#issuecomment-4928020391
## Redesign note Per maintainer feedback and product direction, mass assignment will be fixed on **existing `bindData`** rather than introducing `secureBindData`. New PR: will land as a separate branch `fix/binddata-mass-assignment` with: - default deny unless `bindable: true` - `@BindAllowed` on action parameters for action-level allowlists - no `secureBindData` naming - **no** `nullMissing` / stale-data clearing (that will be a second follow-up PR) This PR (#15808) can be closed once the replacement is up and reviewed, or kept open as a reference for reusable allowlist filtering / AST validation ideas. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
