Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@struts.apache.org
Date: Mon, 16 Dec 2013 07:04:07 +0000 (UTC)
From: "Lukasz Lenart (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12684460.1386937325038.41130.1387177447794@arcas>
In-Reply-To: <JIRA.12684460.1386937325038@arcas>
References: <JIRA.12684460.1386937325038@arcas>
Subject: [jira] [Commented] (WW-4257) ParametersInterceptor uses same method
 on ParameterNameAware interface to validate parameters and properties
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/WW-4257?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13848873#comment-13848873 ] 

Lukasz Lenart commented on WW-4257:
-----------------------------------

WW-4154 supposed restore the old behaviour so I'm bit confuse :(

What you mean is that the logic in {{SecurityMemberAccess}} should also be reverted, right? I mean I can recall that I made some changes in that area to match logic in {{ParametersInterceptor}} when used with {{ParameterNameAware}}.

> ParametersInterceptor uses same method on ParameterNameAware interface to validate parameters and properties
> ------------------------------------------------------------------------------------------------------------
>
>                 Key: WW-4257
>                 URL: https://issues.apache.org/jira/browse/WW-4257
>             Project: Struts 2
>          Issue Type: Bug
>    Affects Versions: 2.3.16
>            Reporter: Christoph Lenggenhager
>             Fix For: 2.3.17
>
>
> With version 2.3.16, the {{ParametersInterceptor}} uses the same method to validate parameter names and property names.
> As we use the {{ParameterNameAware}} interface to implement parameter whitelisting on action level, this breaks our case.
> It might not be how it is intended, but validating a property independent of the actual bean breaks our current implementation.
> Possible fixes would be:
> - alter {{ParameterNameAware}} to have an additional separate method to validate properties
> - introduce a new {{PropertyNameAware}} interface
> - introduce a new {{ParameterAndPropertyNameAware}} interface
> One could also consider to ignore the {{ParameterNameAware}} interface when validating properties, as for a parameter {{foo.bar}}, the values {{foo.bar}}, {{foo}}, and {{bar}} are passed to the ParameterNameAware interface, which one could see as a bit redundant. Especially given the fact that a context in the case of property validation is not provided. Therefore, it is impossible for the implementation to distinguish between a parameter and a property.


--
This message was sent by Atlassian JIRA
(v6.1.4#6159)