lukaszlenart commented on PR #1774: URL: https://github.com/apache/struts/pull/1774#issuecomment-4992448633
Thanks for this — the analysis is correct and the fix is well-targeted. To frame it for anyone reading: the per-property `@StrutsParameter` enforcement introduced in 7.2.0 covered Jackson's setter/field path but not the creator-bound path (records, `@JsonCreator`, `@ConstructorProperties`), which Jackson populates through the value deserializer. This PR **completes that enforcement** rather than fixing a regression — before 7.2.0 REST bodies had no per-property control at all, so nothing that was previously protected was exposed. The approach (wrapping the creator-property value deserializer, plus fail-closing construction that fails after a redaction) is sound, and the record / static-factory / `@ConstructorProperties` / nested / collection test matrix is exactly what I'd want to see. I'll take it through review and merge once CI is green. Appreciate you also checking on the disclosure process up front — for this one, completing a brand-new control in the open is fine. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
