jamesfredley commented on PR #15808: URL: https://github.com/apache/grails-core/pull/15808#issuecomment-4997712107
## Superseded - closing in favor of two focused PRs This PR bundled two separable concerns: mass-assignment / allowlist hardening of `bindData`, and clearing omitted fields (`nullMissing`). Per review, those have been split into two focused, independently reviewable PRs, so I'm closing this one: - **#15947 - Harden bindData against mass assignment.** Makes data binding deny-by-default (only allowlisted properties bind from request parameters), with `grails.databinding.legacyBindableDefault=true` as the opt-out and existing `bindable: true` / `include:` / `@BindAllowed` honored unchanged. This is the broader, framework-default version of the allowlist enforcement that this PR introduced as an explicit API. - **#15950 - Clear omitted bindData fields when nullMissing is enabled.** Covers the `nullMissing` / stale-data-clearing behavior. Together those two cover this PR's scope with a cleaner separation of concerns, so `secureBindData` as a separate explicit API is no longer needed. Closing; please direct further review to #15947 and #15950. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
