lukaszlenart opened a new pull request, #319:
URL: https://github.com/apache/struts-site/pull/319

   ## What
   
   `@StrutsParameter` makes parameter binding default-deny, but there is one 
exemption that was documented nowhere on the site: when an action implements 
`ModelDriven` and its model is on top of the ValueStack, the **model** becomes 
the authorization target and its members are exempt from the annotation 
requirement — the whole model is the binding surface.
   
   Two properties matter and are now written down:
   
   - **Channel-independent** — `ParametersInterceptor`, `CookieInterceptor`, 
`JSONInterceptor` and the REST `ContentTypeInterceptor` all resolve the target 
through the same `ParameterAuthorizer`, so this is not JSON- or REST-specific.
   - **Narrowly scoped** — the action must implement `ModelDriven` *and* the 
target must not be the action itself. A JSON interceptor `root` expression on a 
non-ModelDriven action is not exempt and still requires annotations.
   
   This is intended, long-standing behavior (the model has been the 
authorization target since `@StrutsParameter` enforcement landed in Struts 
7.0.0); the gap was purely documentation.
   
   ## Changes
   
   - `source/core-developers/struts-parameter-annotation.md` — new `## 
ModelDriven actions` section: the exemption, its channel-independence, its 
narrow scoping, the fact that it lifts only the annotation requirement 
(accepted/excluded patterns and `ParameterNameAware` still apply), and guidance 
to use a request DTO rather than a domain/persistence entity.
   - `source/core-developers/model-driven-interceptor.md` — short note that 
pushing the model onto the stack also makes it the binding/authorization 
target, with a link to the annotation page.
   - `source/plugins/rest/index.md` — note by the `OrdersController implements 
ModelDriven<Order>` example that `ModelDriven` also decides what is bindable 
*from* the request body, so `Order` should be shaped as a request contract. The 
example itself is unchanged.
   
   Documentation only — no framework behavior change is proposed or implied.
   
   ## Verification
   
   Every claim was checked against the framework source 
(`StrutsParameterAuthorizer.resolveTarget` / `isAuthorized`, 
`ParametersInterceptor.isParameterAnnotatedAndAllowlist`, 
`JSONInterceptor.isAcceptableNode`, `ContentTypeInterceptor`). Anchor slugs 
(`#modeldriven-actions`) follow kramdown's existing generation on the published 
site; a local Jekyll build was not possible (broken local bundle, no Docker 
daemon), so please eyeball the staging render.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to