lukaszlenart opened a new pull request, #1932: URL: https://github.com/apache/struts/pull/1932
Fixes [WW-5710](https://issues.apache.org/jira/browse/WW-5710) Both OGNL channels (`ParametersInterceptor`, `CookieInterceptor`) resolve the binding target once and use it for the authorization check and the allowlist priming alike. For a `ModelDriven` action that target is the model — but since WW-5698 the authorizer may grant a parameter on a member declared on the **action** itself. `OgnlParameterAllowlister` was still handed the model only, found no annotation there and primed nothing. With `struts.allowlist.enable=true` (the default) a correctly annotated nested property on the action's own class — `@StrutsParameter(depth = 1) getAddress()` — was authorized and then refused by `SecurityMemberAccess`, with nothing in the logs pointing at the allowlist. ### Change - `ParameterAllowlister` gains a `default primeAllowlistForPath(name, target, action)` that primes the resolved target and, when it differs, the action too. The interface stays a SAM; custom implementations inherit it. Each priming is a no-op unless *that* object annotates the root property at sufficient depth, so the second priming cannot allowlist anything the developer did not declare — a ModelDriven action now gets exactly what a plain action always got. - Both call sites use the three-argument form. - The allowlister's debug line no longer claims "nested traversal may be blocked" for one object when another may still prime the path; it names the object that primed nothing. ### Tests - `StrutsParameterAnnotationTest.modelDrivenAction_annotatedNestedPropertyOnAction_allowlisted` — parameter accepted **and** the nested type lands in `ThreadAllowlist` (RED on `main`: accepted, allowlist empty). - `ParametersInterceptorTest.testModelDrivenAnnotatedNestedPropertyOnActionIsAllowlisted` — end-to-end through the real OGNL stack with the allowlist enabled; the action class and model class are seeded the way configuration loading and `ModelDrivenInterceptor` do, so the nested type is allowlisted by nothing but the priming under test. RED on `main` with `SecurityMemberAccess` refusing `Address.setCity` while the model property binds. - `CookieInterceptorTest.testNestedCookieOnModelDrivenActionMemberPrimesAllowlist` — same through the cookie channel, with the real authorizer and allowlister from the container (RED with the cookie-channel change reverted). Full `core` suite passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
