Copilot commented on code in PR #1945:
URL: https://github.com/apache/struts/pull/1945#discussion_r4014943677
##########
plugins/rest/src/main/java/org/apache/struts2/rest/handler/jackson/ParameterAuthorizingModule.java:
##########
@@ -103,18 +103,32 @@ public JsonDeserializer<?>
modifyDeserializer(DeserializationConfig config,
* Jackson builds the {@code ObjectIdReader} for a property-based {@code
@JsonIdentityInfo} before
* the deserializer modifiers run, capturing the id property as it was
then, and the
* {@code ObjectIdValueProperty} it adds at build time assigns the id
through that captured
- * property rather than through the builder's. Rebuild the reader around a
wrapped one.
+ * property rather than through the builder's. Rebuild the reader around a
wrapped one, and around
+ * a deserializer that puts a bean-typed id's members under the id
property's path.
*/
private static void authorizeObjectIdProperty(BeanDeserializerBuilder
builder) {
ObjectIdReader reader = builder.getObjectIdReader();
- if (reader == null || reader.idProperty == null
- || reader.idProperty instanceof
AuthorizingSettableBeanProperty) {
- return;
+ if (reader != null) {
+ builder.setObjectIdReader(authorizedObjectIdReader(reader));
}
- SettableBeanProperty idProperty = new AuthorizingSettableBeanProperty(
- reader.idProperty, memberNameOf(reader.idProperty));
- builder.setObjectIdReader(ObjectIdReader.construct(reader.getIdType(),
reader.propertyName,
- reader.generator, reader.getDeserializer(), idProperty,
reader.resolver));
+ }
+
+ /**
+ * The same rebuild for a reader Jackson constructs later, in {@code
createContextual}, for a
+ * {@code @JsonIdentityInfo} placed on the referring property; returns the
reader itself when it
+ * carries no id property or is already rebuilt.
+ */
+ static ObjectIdReader authorizedObjectIdReader(ObjectIdReader reader) {
+ if (reader.idProperty == null || reader.getDeserializer() instanceof
ObjectIdPathDeserializer) {
+ return reader;
+ }
+ String memberName = memberNameOf(reader.idProperty);
+ SettableBeanProperty idProperty = reader.idProperty instanceof
AuthorizingSettableBeanProperty
+ ? reader.idProperty
+ : new AuthorizingSettableBeanProperty(reader.idProperty,
memberName);
+ JsonDeserializer<?> idDeserializer = new
ObjectIdPathDeserializer(reader.getDeserializer(), memberName);
Review Comment:
This change touches security-sensitive framework code. Please confirm it is
not a fix for a suspected vulnerability before merging — see `SECURITY.md`.
Vulnerability fixes go through the private process at
`[email protected]`, not a public pull request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
