lukaszlenart opened a new pull request, #319: URL: https://github.com/apache/struts-site/pull/319
## What `@StrutsParameter` makes parameter binding default-deny, but there is one exemption that was documented nowhere on the site: when an action implements `ModelDriven` and its model is on top of the ValueStack, the **model** becomes the authorization target and its members are exempt from the annotation requirement — the whole model is the binding surface. Two properties matter and are now written down: - **Channel-independent** — `ParametersInterceptor`, `CookieInterceptor`, `JSONInterceptor` and the REST `ContentTypeInterceptor` all resolve the target through the same `ParameterAuthorizer`, so this is not JSON- or REST-specific. - **Narrowly scoped** — the action must implement `ModelDriven` *and* the target must not be the action itself. A JSON interceptor `root` expression on a non-ModelDriven action is not exempt and still requires annotations. This is intended, long-standing behavior (the model has been the authorization target since `@StrutsParameter` enforcement landed in Struts 7.0.0); the gap was purely documentation. ## Changes - `source/core-developers/struts-parameter-annotation.md` — new `## ModelDriven actions` section: the exemption, its channel-independence, its narrow scoping, the fact that it lifts only the annotation requirement (accepted/excluded patterns and `ParameterNameAware` still apply), and guidance to use a request DTO rather than a domain/persistence entity. - `source/core-developers/model-driven-interceptor.md` — short note that pushing the model onto the stack also makes it the binding/authorization target, with a link to the annotation page. - `source/plugins/rest/index.md` — note by the `OrdersController implements ModelDriven<Order>` example that `ModelDriven` also decides what is bindable *from* the request body, so `Order` should be shaped as a request contract. The example itself is unchanged. Documentation only — no framework behavior change is proposed or implied. ## Verification Every claim was checked against the framework source (`StrutsParameterAuthorizer.resolveTarget` / `isAuthorized`, `ParametersInterceptor.isParameterAnnotatedAndAllowlist`, `JSONInterceptor.isAcceptableNode`, `ContentTypeInterceptor`). Anchor slugs (`#modeldriven-actions`) follow kramdown's existing generation on the published site; a local Jekyll build was not possible (broken local bundle, no Docker daemon), so please eyeball the staging render. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
