Copilot commented on code in PR #1784:
URL: https://github.com/apache/struts/pull/1784#discussion_r3578625942
##########
plugins/json/src/main/java/org/apache/struts2/json/JSONInterceptor.java:
##########
@@ -263,15 +270,23 @@ private void filterUnacceptableList(java.util.List list,
String prefix, Object t
filterUnacceptableKeysRecursive((Map) item, elementPrefix,
target, action);
} else if (item instanceof java.util.List) {
filterUnacceptableList((java.util.List) item, elementPrefix,
target, action);
- // Scalar list elements are value-checked only; their parent key
already passed name/authorization checks.
- } else if (!isAcceptableValue(elementPrefix, item, action)) {
+ // Scalar list elements are leaf binding targets: apply the leaf
name-allowlist checks at
+ // the element path (e.g. "items[0]") plus value checks. The
container key already passed
+ // the per-node checks in the caller.
+ } else if (!isAcceptableLeafName(elementPrefix, action) ||
!isAcceptableValue(elementPrefix, item, action)) {
Review Comment:
Scalar list elements now run accepted-name/ParameterNameAware checks via
isAcceptableLeafName(elementPrefix, …), but they still skip the per-node gate
(length limit, excluded patterns, `@StrutsParameter` authorization, and
optional include/exclude property filters). This diverges from the method’s own
comment (“per-node checks apply to every node”) and from ParametersInterceptor,
which applies these checks to the full leaf name (e.g. "items[0]"). Consider
also applying isAcceptableNode(elementPrefix, target, action) before value/name
checks for scalar elements.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
