lukaszlenart opened a new pull request, #1945: URL: https://github.com/apache/struts/pull/1945
Fixes [WW-5746](https://issues.apache.org/jira/browse/WW-5746) ## Problem The `ObjectIdReader` reads a property-based `@JsonIdentityInfo` id through its own deserializer (resolved by `BeanDeserializerFactory` for the id type), not through the id property's value deserializer, so nothing pushed a path prefix for it. When the id type is a bean, its members were authorized at the enclosing bean's level — `k` instead of `id.k` — and a grant on a same-named member of the enclosing bean authorized the write into the id. The `id` property itself has been gated since WW-5727; this is the path its members are checked under. ## Change - New `ObjectIdPathDeserializer`: pushes the id property's path around the reader's deserializer. It authorizes and redacts nothing — the `id` property is checked when it is assigned, and Jackson cannot bind or resolve a `null` id. A scalar id sees no difference. - `ParameterAuthorizingModule.authorizedObjectIdReader` now rebuilds the reader around both the wrapped id property (WW-5727) and this deserializer, and the rebuild is shared with a new `RedactionAwareDeserializer.createContextual` override: a `@JsonIdentityInfo` placed on the *referring property* makes Jackson build a fresh reader there, after the modifier ran, so the class-level rebuild alone left that path open (review-found, probe-verified, now tested). Not covered, documented in Javadoc: a `@JsonFormat(shape = ARRAY)` bean with a property-level identity keeps its ordered-property array across `withObjectIdReader`, which this wrapper cannot reach — identical to `main`. Not testable: a creator-bound bean with a bean-typed id — Jackson reads such an id twice and the creator parameter ends up empty regardless of authorization. Jackson's property-based generator never parses an object token as a reference, so a reference by id structure is not a reachable shape; a custom generator that allowed it would see the reference under the referring property's `id`, where it sits in the body. ## Related The reviews surfaced a pre-existing defect in `RedactionAwareDeserializer` — it does not resync the parser after dropping an object mid-read, so a dropped object's remaining fields are consumed by the parent — filed as [WW-5747](https://issues.apache.org/jira/browse/WW-5747). ## Tests `ParameterAuthorizingModuleTest`: bean-typed id members rejected under `id.k` despite a top-level `k` grant, bound when `id.k` is granted, and the same for a `@JsonIdentityInfo` declared on the referring property. `mvn test -DskipAssembly -pl plugins/rest`: 202 tests, 0 failures. Two code-review and two security-review passes; nothing newly introduced. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
