lukaszlenart opened a new pull request, #1784: URL: https://github.com/apache/struts/pull/1784
Fixes [WW-4858](https://issues.apache.org/jira/browse/WW-4858) ## What & why Follow-up to #1773. That change added `ParametersInterceptor`-style name/value filtering to `JSONInterceptor`'s reflection population path, but applied **every** name check at **every** node of the JSON tree before recursing. Two of those checks — **accepted name patterns** (`AcceptedPatternsChecker`) and the **`ParameterNameAware`** callback — target the *full dotted binding path*, so evaluating them on an intermediate node was wrong: - A leaf-targeting accepted pattern such as `bean\.stringField` fails to match the intermediate node `bean`, so the whole `bean` subtree was dropped before the leaf was ever visited. The flat `ParametersInterceptor` path only evaluates the complete name `bean.stringField`, so it accepts it. Divergence. - Same shape for `ParameterNameAware`: `acceptableParameterName("bean")` was invoked on the intermediate node, which the flat path never sees. - For arrays, the accepted allowlist judged the **container** name (`list`) instead of the element path (`list[0]`), so a container-matching pattern let elements through that the flat path would reject at `list[0]`. These only ever *tightened* acceptance (no security bypass), but they made restrictive accepted/`ParameterNameAware` config silently drop nested JSON. ## Change Split the per-key gate in the recursive walk: - **Per-node (every node):** key length, excluded name patterns, `@StrutsParameter` authorization, and (opt-in) property filters. Exclusion is prefix-safe and authorization is intentionally hierarchical, so these are correct at intermediate nodes — unchanged. - **Leaf keys only:** accepted name patterns and `ParameterNameAware`, now also applied to scalar array elements at their indexed path (`items[0]`). This reproduces the flat-path semantics exactly. `excludeProperties`/`includeProperties` behavior is unchanged (include patterns already hierarchy-expand across levels). ## Tests (`JSONInterceptorTest`) - `testAcceptedNamePatternRejectsNestedKey` — leaf-targeting accepted pattern now populates the nested leaf and drops the non-matching sibling. - `testAcceptedNamePatternAppliesToListElementPath` — accepted patterns evaluated at the array element path, not the container. - `testParameterNameAwareDoesNotRejectIntermediateNode` — an action rejecting the intermediate node name no longer drops the subtree. - `testIncludePropertiesAppliedToNestedInputWhenEnabled` — regression guard; nested include-property filtering still works. All three fix-driving tests were confirmed to fail before the change. ## Testing `mvn test -pl plugins/json -am -DskipAssembly` — 146 tests, all pass. ## Note Supersedes #1783 (which documented the accepted-name limitation as a test); that PR can be closed. The still-valid include-properties test from it is carried here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
