This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch docs/struts-7.3.0-json-param-filtering in repository https://gitbox.apache.org/repos/asf/struts-site.git
commit 9631fa5c9c0663c994e4e4addcd7ca76ddad82ef Author: Lukasz Lenart <[email protected]> AuthorDate: Tue Jul 14 14:43:17 2026 +0200 docs: note @StrutsParameter getter enforcement for JSON/REST scalar collections (7.3.0) Under requireAnnotations, JSON/REST population of a scalar collection now authorizes element paths (list[0]) on the getter at depth=1, matching the Parameters Interceptor. Actions relying on the old container-setter check must annotate the getter (WW-4858, apache/struts#1784). Co-Authored-By: Claude Opus 4.8 <[email protected]> --- source/core-developers/struts-parameter-annotation.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/source/core-developers/struts-parameter-annotation.md b/source/core-developers/struts-parameter-annotation.md index 1c2ac830e..32f19fdd5 100644 --- a/source/core-developers/struts-parameter-annotation.md +++ b/source/core-developers/struts-parameter-annotation.md @@ -125,6 +125,24 @@ public class MyAction { } ``` +{:.alert .alert-warning} +**Struts 7.3.0 behavior change (JSON/REST).** When a JSON or REST payload +populates a collection of *simple* types element by element — e.g. +`{"mySelection":["A","B"]}` binds to `mySelection[0]`, `mySelection[1]` — the +element paths are now authorized on the **getter** at `depth = 1`, matching how +the [Parameters Interceptor](parameters-interceptor.html) gates the flat name +`mySelection[0]`. Previously the JSON path checked only the container setter +(`depth = 0`). If your action populates a scalar collection from a JSON/REST body +under `requireAnnotations`, annotate the getter as well: +```java +@StrutsParameter(depth = 1) +public List<String> getMySelection() { + return mySelection; +} +``` +List-of-objects payloads (`items[0].name`, `depth = 2`) are unaffected — they +already required the annotated getter. + When populating properties of objects that are already in a collection, annotate the getter. Because reaching an element's property requires indexing into the collection *and then* following the property, this needs `depth = 2` (see
