carrerasdarren-cell opened a new pull request, #1889: URL: https://github.com/apache/struts/pull/1889
# Apache Struts WW-5712 PR ## Title WW-5712 Cover Jackson any-setters in REST parameter authorization ## Body Fixes [WW-5712](https://issues.apache.org/jira/browse/WW-5712). This adds opt-in authorization coverage for Jackson any-setters in the REST plugin: - adds `@StrutsParameter(allowDynamicKeys = true)` for explicit dynamic-key consent; - adds `struts.rest.anySetter.requireAnnotations`, defaulting to `false` for compatibility; - applies the consent and `depth()` limit to method and field any-setters; - rejects creator-parameter any-setters when enforcement is enabled; and - keeps JSON and XML behavior aligned while preserving existing behavior when enforcement is disabled. Verification: - 142 REST plugin tests passed; - 83 focused core parameter-authorization and annotation tests passed; - REST plugin `verify` and Apache RAT passed; and - `git diff --check` passed. ## Commit WW-5712 Cover Jackson any-setters in REST parameter authorization -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
