Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-11 01:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added the same warning that appears in the ParametersInterceptor about using ParameterNameAware to the JavaDoc for this interface

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1508075 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Bruce Allen Phillips
2013-07-29 14:07:56 +00:00
parent 6cfc28b359
commit 49d339f8f3
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterNameAware.java
+7
View File
@@ -22,6 +22,13 @@ package com.opensymphony.xwork2.interceptor;
* ParametersInterceptor}. For example, actions may want to create a whitelist of parameters they will accept or a
* blacklist of paramters they will reject to prevent clients from setting other unexpected (and possibly dangerous)
* parameters.
*
* Using {@link ParameterNameAware} could be dangerous as {@link ParameterNameAware#acceptableParameterName(String)} takes precedence
* over {@link ParametersInterceptor} which means if ParametersInterceptor excluded given parameter name you can accept it with
* {@link ParameterNameAware#acceptableParameterName(String)}.
*
* The best idea is to define very tight restrictions with ParametersInterceptor and relax them per action with
* {@link ParameterNameAware#acceptableParameterName(String)}
*
* <!-- END SNIPPET: javadoc -->
*