lukaszlenart commented on PR #1774:
URL: https://github.com/apache/struts/pull/1774#issuecomment-4992448633

   Thanks for this — the analysis is correct and the fix is well-targeted. To 
frame it for anyone reading: the per-property `@StrutsParameter` enforcement 
introduced in 7.2.0 covered Jackson's setter/field path but not the 
creator-bound path (records, `@JsonCreator`, `@ConstructorProperties`), which 
Jackson populates through the value deserializer. This PR **completes that 
enforcement** rather than fixing a regression — before 7.2.0 REST bodies had no 
per-property control at all, so nothing that was previously protected was 
exposed.
   
   The approach (wrapping the creator-property value deserializer, plus 
fail-closing construction that fails after a redaction) is sound, and the 
record / static-factory / `@ConstructorProperties` / nested / collection test 
matrix is exactly what I'd want to see. I'll take it through review and merge 
once CI is green. Appreciate you also checking on the disclosure process up 
front — for this one, completing a brand-new control in the open is fine.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to