Lukasz Lenart created WW-5682:
---------------------------------
Summary: Remove the deprecated SecurityMemberAccess configuration
setters
Key: WW-5682
URL: https://issues.apache.org/jira/browse/WW-5682
Project: Struts 2
Issue Type: Improvement
Reporter: Lukasz Lenart
Fix For: 8.0.0
WW-5675 moved all OGNL security configuration parsing into a
container-singleton bean, {{SecurityMemberAccessConfig}}. The configuration
setters on {{SecurityMemberAccess}} lost their {{@Inject}} annotations and were
deprecated rather than removed, so that existing subclasses and direct callers
keep compiling in the 7.4.0 minor release.
They are annotated {{@Deprecated(since = "7.4.0", forRemoval = true)}}. This
ticket removes them.
h2. Methods to remove
All on {{org.apache.struts2.ognl.SecurityMemberAccess}}:
* {{useAllowStaticFieldAccess}}
* {{useExcludedClasses}}
* {{useExcludedPackageNamePatterns}}
* {{useExcludedPackageNames}}
* {{useExcludedPackageExemptClasses}}
* {{useEnforceAllowlistEnabled}}
* {{useAllowlistClasses}}
* {{useAllowlistPackageNames}}
* {{useDisallowProxyObjectAccess}}
* {{useDisallowProxyMemberAccess}}
* {{useDisallowDefaultPackageAccess}}
Do _not_ remove {{useAcceptProperties}} or {{useExcludeProperties}}. Those
carry per-request state set by {{ParametersInterceptor}} through the
{{MemberAccessValueStack}} interface, are not configuration, and are not
deprecated.
h2. Why this is not trivial
At the time of writing roughly 110 call sites across {{core}} and the
{{spring}} and {{cdi}} plugins call these setters directly, almost all in
tests, to construct a {{SecurityMemberAccess}} in a particular configuration
without going through a container. Removing the setters means migrating every
one of those to configure a {{SecurityMemberAccessConfig}} instead. That
migration is the bulk of the work, not the deletion.
Two of them carry behaviour worth preserving in whatever replaces them:
* {{useAllowStaticFieldAccess(false)}} has a side effect: it also adds
{{java.lang.Class}} to the excluded classes.
* The excluded-set setters accumulate onto the current value rather than
assigning. That is what makes them commutative, which is what makes them safe
against the container's unspecified {{getDeclaredMethods()}} injection order.
h2. Related
* WW-5675 deprecated them, and its design document records the reasoning:
{{docs/superpowers/specs/2026-08-14-WW-5675-security-member-access-config-sharing-design.md}}
* WW-5678 is the sibling 8.0.0 cleanup for the package-matching helper naming
and visibility in the same class. Worth doing in the same pass.
* Also consider {{allowlistPackageNames}} on {{SecurityMemberAccess}}, which
became write-only in production code after WW-5675 and survives only because
tests read it reflectively.
Blocked by WW-5675 landing first.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
