lukaszlenart commented on PR #1657: URL: https://github.com/apache/struts/pull/1657#issuecomment-4226192630
Thanks, this is clearly closer to the intended direction and it addresses several of the earlier concerns. I still see one blocking parity gap with `ParametersInterceptor`: collection/indexed paths. In core, authorization depth is based on the full parameter path, e.g. `publicPojoListDepthOne[0].key` must be rejected while `publicPojoListDepthTwo[0].key` is accepted. The updated JSON list recursion appears to reuse the same prefix for list items instead of synthesizing an indexed path, which undercounts nesting and can make list element binding more permissive than `ParametersInterceptor`. I also still have the same concern for the REST side where `Collection` / `Map` / arrays are copied as-is, and for the fallback path that does direct deserialization followed by top-level scrubbing only. Those paths still do not look fully equivalent to the core nested authorization model. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
