lukaszlenart opened a new pull request, #1773: URL: https://github.com/apache/struts/pull/1773
Fixes [WW-4858](https://issues.apache.org/jira/browse/WW-4858) ## What & why `JSONInterceptor` populates action/model properties from a JSON request body via `JSONPopulator` (pure Java reflection over bean setters), which historically bypassed most of the name/value acceptability controls that `ParametersInterceptor` applies to ordinary HTTP parameters. WW-5624 already retrofitted `@StrutsParameter` authorization onto this path; this change closes the remaining consistency gaps. Population stays **pure-reflection** — no OGNL name evaluation is introduced (that is intentionally kept out of the JSON path as a security property). All filtering hooks into the single existing recursive tree-walk, using the same dotted/indexed paths (`address.city`, `items[0].name`) that `ParametersInterceptor` uses, so the shared pattern checkers behave equivalently on JSON and form input. ## Controls added to the JSON population path **Always-on (security / app-owned):** - Excluded + accepted **name** patterns, via the shared `ExcludedPatternsChecker` / `AcceptedPatternsChecker` singletons (same instances `ParametersInterceptor` uses). - Param-name max length (default 100). - `ParameterNameAware` / `ParameterValueAware` action callbacks. - `@StrutsParameter` authorization (unchanged, from WW-5624). **Opt-in (default off — preserves existing behavior for permissive JSON apps):** - Excluded / accepted **value** patterns (`setExcludedValuePatterns` / `setAcceptedValuePatterns`). - Applying the interceptor's own `excludeProperties` / `includeProperties` to input, gated by `applyPropertyFiltersToInput`. ## Scope notes - The JSON-RPC path (`application/json-rpc`, SMD method invocation) is out of scope — it binds to method arguments, not stack properties. - `ParametersInterceptor` is not modified. ## Testing New tests in `JSONInterceptorTest` cover each gap plus nested-object and list-element paths. Full JSON plugin suite passes (`mvn test -pl plugins/json -am -DskipAssembly`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
