lukaszlenart opened a new pull request, #328: URL: https://github.com/apache/struts-site/pull/328
The `@StrutsParameter` page told readers that JSON and REST deserialization means "unauthorized fields are never set". That holds for properties the deserializer binds **by name**, but a Jackson any-setter is a separate sink that the REST plugin's authorization wrapper never wraps — unknown keys routed to it are bound with no `@StrutsParameter` check, even with `struts.parameters.requireAnnotations` enabled and in the same request in which an ordinary unannotated setter on the same class is correctly rejected. That sentence is what made the behaviour look like a broken promise when it was reported. This qualifies the bullet and documents the gap in its own section, next to the existing creator-bound-properties note covering the same class of problem. Also documented, because both are easy to assume wrongly: - an any-setter beneath an **unauthorized parent** is still unreachable — the parent is rejected first and its subtree skipped; - `@JsonUnwrapped` is a named property and is unaffected. The JSON plugin is **not** affected — it uses no Jackson, so `source/plugins/json/index.md` keeps its identical wording unchanged. Describes current behaviour only. The framework-side control is tracked as [WW-5712](https://issues.apache.org/jira/browse/WW-5712), which is not yet merged, so no configuration flag is documented here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012HF8BGrYmCVnqUdQJJ1XPM -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
