From 49d339f8f388cbb77ee0bfc1ee0fa56a110f4638 Mon Sep 17 00:00:00 2001 From: Bruce Allen Phillips Date: Mon, 29 Jul 2013 14:07:56 +0000 Subject: [PATCH] Added the same warning that appears in the ParametersInterceptor about using ParameterNameAware to the JavaDoc for this interface git-svn-id: https://svn.apache.org/repos/asf/struts/struts2/trunk@1508075 13f79535-47bb-0310-9956-ffa450edef68 --- .../xwork2/interceptor/ParameterNameAware.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterNameAware.java b/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterNameAware.java index 292dbeb83..3fb6237ed 100644 --- a/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterNameAware.java +++ b/xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParameterNameAware.java @@ -22,6 +22,13 @@ package com.opensymphony.xwork2.interceptor; * ParametersInterceptor}. For example, actions may want to create a whitelist of parameters they will accept or a * blacklist of paramters they will reject to prevent clients from setting other unexpected (and possibly dangerous) * parameters. + * + * Using {@link ParameterNameAware} could be dangerous as {@link ParameterNameAware#acceptableParameterName(String)} takes precedence + * over {@link ParametersInterceptor} which means if ParametersInterceptor excluded given parameter name you can accept it with + * {@link ParameterNameAware#acceptableParameterName(String)}. + * + * The best idea is to define very tight restrictions with ParametersInterceptor and relax them per action with + * {@link ParameterNameAware#acceptableParameterName(String)} * * *