Return-Path: X-Original-To: apmail-struts-issues-archive@minotaur.apache.org Delivered-To: apmail-struts-issues-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 091CD10FA0 for ; Tue, 25 Feb 2014 09:02:37 +0000 (UTC) Received: (qmail 15099 invoked by uid 500); 25 Feb 2014 09:02:36 -0000 Delivered-To: apmail-struts-issues-archive@struts.apache.org Received: (qmail 14683 invoked by uid 500); 25 Feb 2014 09:02:26 -0000 Mailing-List: contact issues-help@struts.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@struts.apache.org Delivered-To: mailing list issues@struts.apache.org Received: (qmail 14498 invoked by uid 99); 25 Feb 2014 09:02:24 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 25 Feb 2014 09:02:23 +0000 Date: Tue, 25 Feb 2014 09:02:23 +0000 (UTC) From: "Christoph Lenggenhager (JIRA)" To: issues@struts.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (WW-4257) ParametersInterceptor uses same method on ParameterNameAware interface to validate parameters and properties MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/WW-4257?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13911406#comment-13911406 ] Christoph Lenggenhager commented on WW-4257: -------------------------------------------- Have you had time to consider my suggested patch? This is a blocker for us to update to 2.3.16... > ParametersInterceptor uses same method on ParameterNameAware interface to validate parameters and properties > ------------------------------------------------------------------------------------------------------------ > > Key: WW-4257 > URL: https://issues.apache.org/jira/browse/WW-4257 > Project: Struts 2 > Issue Type: Bug > Affects Versions: 2.3.16 > Reporter: Christoph Lenggenhager > Fix For: 2.3.17 > > Attachments: ww-4257.patch > > > With version 2.3.16, the {{ParametersInterceptor}} uses the same method to validate parameter names and property names. > As we use the {{ParameterNameAware}} interface to implement parameter whitelisting on action level, this breaks our case. > It might not be how it is intended, but validating a property independent of the actual bean breaks our current implementation. > Possible fixes would be: > - alter {{ParameterNameAware}} to have an additional separate method to validate properties > - introduce a new {{PropertyNameAware}} interface > - introduce a new {{ParameterAndPropertyNameAware}} interface > One could also consider to ignore the {{ParameterNameAware}} interface when validating properties, as for a parameter {{foo.bar}}, the values {{foo.bar}}, {{foo}}, and {{bar}} are passed to the ParameterNameAware interface, which one could see as a bit redundant. Especially given the fact that a context in the case of property validation is not provided. Therefore, it is impossible for the implementation to distinguish between a parameter and a property. -- This message was sent by Atlassian JIRA (v6.1.5#6160)