mirror of
https://github.com/apache/struts.git
synced 2026-08-11 01:27:14 +00:00
Lukasz Lenart
690c4c2737
* WW-5626 add ParameterAuthorizer#resolveTarget for centralized ModelDriven resolution Move the ValueStack peek logic that derives the target object from action+ModelDriven state out of ParametersInterceptor and into ParameterAuthorizer. Callers that need both authorization and the resolved target (for downstream OGNL allowlisting) can now call resolveTarget once and reuse the result. * WW-5626 delegate ModelDriven target resolution to ParameterAuthorizer Replace the inline ValueStack peek in ParametersInterceptor#isParameterAnnotatedAndAllowlist with a call to ParameterAuthorizer#resolveTarget. The ModelDriven import is no longer needed in this class. * WW-5626 defensively skip non-String JSON keys in authorization filter The (String) cast in filterUnauthorizedKeysRecursive threw ClassCastException for any custom JSONReader producing non-String keys. Replace with an instanceof pattern that debug-logs and skips entries whose key cannot be converted to a parameter path. * WW-5626 add real JacksonJsonHandler integration tests for @StrutsParameter filtering The existing ContentTypeInterceptorTest uses mock ContentTypeHandlers, so its requireAnnotations=true tests verify only that intercept() returns SUCCESS — they assert nothing about which properties were actually filtered. These integration tests use a real JacksonJsonHandler + a real StrutsParameterAuthorizer to verify end-to-end property-level filtering for top-level annotated/unannotated properties and nested properties at varying authorized depths. The SecureRestAction fixture documents a semantic divergence: REST's recursive copy authorizes each path level independently, so depth-0 authorization on the top-level property requires @StrutsParameter on the setter even when nested field access is the actual goal. ParametersInterceptor only requires the getter annotation. This divergence is tracked for the Approach C refactor. * WW-5626 make ParameterAuthorizer#resolveTarget a default method to preserve SAM Making resolveTarget abstract broke ParameterAuthorizer as a functional interface, which the existing JSON and REST plugin tests rely on for lambda-based stubs: interceptor.setParameterAuthorizer((parameterName, target, action) -> true); The default returns the action unchanged — adequate for lambda test stubs whose authorization decisions don't depend on the resolved target. The production implementation (StrutsParameterAuthorizer) overrides this with the proper ModelDriven value-stack peek.
Struts 2 REST plugin
The REST Plugin provides high level support for the implementation of RESTful resource based web applications with the Convention Plugin. You will find more details in documentation.
Installation
Just drop this plugin JAR into WEB-INF/lib folder or add it as a Maven dependency.