[
https://issues.apache.org/jira/browse/WW-4858?focusedWorklogId=1030295&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1030295
]
ASF GitHub Bot logged work on WW-4858:
--------------------------------------
Author: ASF GitHub Bot
Created on: 14/Jul/26 11:42
Start Date: 14/Jul/26 11:42
Worklog Time Spent: 10m
Work Description: Copilot commented on code in PR #1784:
URL: https://github.com/apache/struts/pull/1784#discussion_r3578625942
##########
plugins/json/src/main/java/org/apache/struts2/json/JSONInterceptor.java:
##########
@@ -263,15 +270,23 @@ private void filterUnacceptableList(java.util.List list,
String prefix, Object t
filterUnacceptableKeysRecursive((Map) item, elementPrefix,
target, action);
} else if (item instanceof java.util.List) {
filterUnacceptableList((java.util.List) item, elementPrefix,
target, action);
- // Scalar list elements are value-checked only; their parent key
already passed name/authorization checks.
- } else if (!isAcceptableValue(elementPrefix, item, action)) {
+ // Scalar list elements are leaf binding targets: apply the leaf
name-allowlist checks at
+ // the element path (e.g. "items[0]") plus value checks. The
container key already passed
+ // the per-node checks in the caller.
+ } else if (!isAcceptableLeafName(elementPrefix, action) ||
!isAcceptableValue(elementPrefix, item, action)) {
Review Comment:
Scalar list elements now run accepted-name/ParameterNameAware checks via
isAcceptableLeafName(elementPrefix, …), but they still skip the per-node gate
(length limit, excluded patterns, `@StrutsParameter` authorization, and
optional include/exclude property filters). This diverges from the method’s own
comment (“per-node checks apply to every node”) and from ParametersInterceptor,
which applies these checks to the full leaf name (e.g. "items[0]"). Consider
also applying isAcceptableNode(elementPrefix, target, action) before value/name
checks for scalar elements.
Issue Time Tracking
-------------------
Worklog Id: (was: 1030295)
Time Spent: 1h 40m (was: 1.5h)
> JSONInterceptor must not populate value stack directly
> ------------------------------------------------------
>
> Key: WW-4858
> URL: https://issues.apache.org/jira/browse/WW-4858
> Project: Struts 2
> Issue Type: Improvement
> Components: Plugin - JSON
> Affects Versions: 2.3.1, 6.1.1
> Reporter: Yasser Zamani
> Assignee: Lukasz Lenart
> Priority: Major
> Labels: decouple, refactoring
> Fix For: 7.3.0
>
> Attachments: StrutsUnifiedDataModel.png
>
> Time Spent: 1h 40m
> Remaining Estimate: 0h
>
> {{JSONInterceptor}} must populate value stack via OGNL to honor our
> exclusions!
> So according to my current quick view and understanding, I'm planning
> something like below which also resolves WW-3364: {{JSONInterceptor}} could
> be an extension of {{ModelDrivenInterceptor}} via some refactoring of both.
> From hereafter, {{JSONPopulator}} could be removed and {{JSONInterceptor}}
> must give population up to {{ParametersInterceptor}}. This simply could be
> achieved by something like pushing {{JSONInterceptor.root}} into top of stack
> and also moving posted json to http params (or if was impossible some
> refactoring of {{ParametersInterceptor}}).
> Please cast here any objections, votes or idea.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
