[
https://issues.apache.org/jira/browse/WW-4858?focusedWorklogId=1030276&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1030276
]
ASF GitHub Bot logged work on WW-4858:
--------------------------------------
Author: ASF GitHub Bot
Created on: 14/Jul/26 10:52
Start Date: 14/Jul/26 10:52
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #1784:
URL: https://github.com/apache/struts/pull/1784
Fixes [WW-4858](https://issues.apache.org/jira/browse/WW-4858)
## What & why
Follow-up to #1773. That change added `ParametersInterceptor`-style
name/value
filtering to `JSONInterceptor`'s reflection population path, but applied
**every**
name check at **every** node of the JSON tree before recursing. Two of those
checks — **accepted name patterns** (`AcceptedPatternsChecker`) and the
**`ParameterNameAware`** callback — target the *full dotted binding path*, so
evaluating them on an intermediate node was wrong:
- A leaf-targeting accepted pattern such as `bean\.stringField` fails to
match the
intermediate node `bean`, so the whole `bean` subtree was dropped before
the
leaf was ever visited. The flat `ParametersInterceptor` path only
evaluates the
complete name `bean.stringField`, so it accepts it. Divergence.
- Same shape for `ParameterNameAware`: `acceptableParameterName("bean")` was
invoked on the intermediate node, which the flat path never sees.
- For arrays, the accepted allowlist judged the **container** name (`list`)
instead of the element path (`list[0]`), so a container-matching pattern
let
elements through that the flat path would reject at `list[0]`.
These only ever *tightened* acceptance (no security bypass), but they made
restrictive accepted/`ParameterNameAware` config silently drop nested JSON.
## Change
Split the per-key gate in the recursive walk:
- **Per-node (every node):** key length, excluded name patterns,
`@StrutsParameter`
authorization, and (opt-in) property filters. Exclusion is prefix-safe and
authorization is intentionally hierarchical, so these are correct at
intermediate
nodes — unchanged.
- **Leaf keys only:** accepted name patterns and `ParameterNameAware`, now
also
applied to scalar array elements at their indexed path (`items[0]`).
This reproduces the flat-path semantics exactly.
`excludeProperties`/`includeProperties`
behavior is unchanged (include patterns already hierarchy-expand across
levels).
## Tests (`JSONInterceptorTest`)
- `testAcceptedNamePatternRejectsNestedKey` — leaf-targeting accepted
pattern now
populates the nested leaf and drops the non-matching sibling.
- `testAcceptedNamePatternAppliesToListElementPath` — accepted patterns
evaluated
at the array element path, not the container.
- `testParameterNameAwareDoesNotRejectIntermediateNode` — an action
rejecting the
intermediate node name no longer drops the subtree.
- `testIncludePropertiesAppliedToNestedInputWhenEnabled` — regression guard;
nested include-property filtering still works.
All three fix-driving tests were confirmed to fail before the change.
## Testing
`mvn test -pl plugins/json -am -DskipAssembly` — 146 tests, all pass.
## Note
Supersedes #1783 (which documented the accepted-name limitation as a test);
that
PR can be closed. The still-valid include-properties test from it is carried
here.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1030276)
Time Spent: 1h (was: 50m)
> JSONInterceptor must not populate value stack directly
> ------------------------------------------------------
>
> Key: WW-4858
> URL: https://issues.apache.org/jira/browse/WW-4858
> Project: Struts 2
> Issue Type: Improvement
> Components: Plugin - JSON
> Affects Versions: 2.3.1, 6.1.1
> Reporter: Yasser Zamani
> Assignee: Lukasz Lenart
> Priority: Major
> Labels: decouple, refactoring
> Fix For: 7.3.0
>
> Attachments: StrutsUnifiedDataModel.png
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> {{JSONInterceptor}} must populate value stack via OGNL to honor our
> exclusions!
> So according to my current quick view and understanding, I'm planning
> something like below which also resolves WW-3364: {{JSONInterceptor}} could
> be an extension of {{ModelDrivenInterceptor}} via some refactoring of both.
> From hereafter, {{JSONPopulator}} could be removed and {{JSONInterceptor}}
> must give population up to {{ParametersInterceptor}}. This simply could be
> achieved by something like pushing {{JSONInterceptor.root}} into top of stack
> and also moving posted json to http params (or if was impossible some
> refactoring of {{ParametersInterceptor}}).
> Please cast here any objections, votes or idea.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
