jamesfredley opened a new pull request, #15947: URL: https://github.com/apache/grails-core/pull/15947
## Summary Hardens existing `bindData` and controller action auto-binding against mass assignment (OWASP / CWE-915). Does **not** add a new `secureBindData` method. ### Changes - Default property binding is deny-by-default unless a property is explicitly `bindable: true` - New `@BindAllowed([...])` annotation on controller action parameters for action-specific allowlists - Auto-binding of domain/command action params honors `@BindAllowed` via `initializeCommandObject(..., allowedList)` - Migration opt-out: `grails.databinding.legacyBindableDefault=true` restores prior \"all static properties bindable\" behavior - Docs updated for `bindable`, `bindData`, data binding guide, and upgrading notes - Tests updated for default deny, empty include, and allowlist behavior ### Explicitly out of scope (follow-up PR) - Stale-data / omitted-field clearing (`nullMissing`) - will be a separate PR - Replaces the approach in #15808 (which introduced `secureBindData`) ### Migration 1. Mark form-editable properties with `bindable: true` in constraints, **or** 2. Use `bindData(target, source, [include: [...]])`, **or** 3. Annotate action params: `def update(@BindAllowed(['title','author.id']) Book book)`, **or** 4. Temporarily set `grails.databinding.legacyBindableDefault=true` ### Related - Supersedes direction of #15808 (address jdaugherty feedback: fix `bindData`, do not invent a \"secure\" alias) - Mass assignment references: OWASP Mass Assignment Cheat Sheet, CWE-915 Assisted-by: Sisyphus:xai/grok-4.5 [gpt-coding] -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
