Package org.apache.struts2.interceptor.parameter

Interface ParameterAllowlister

All Known Implementing Classes:
OgnlParameterAllowlister
public interface ParameterAllowlister
Primes channel-specific runtime state required for an already-authorized parameter path to be walked by the value-stack — for example, registering the path's classes into the OGNL ThreadAllowlist so OGNL may traverse them. Separated from ParameterAuthorizer so the authorization decision can remain side-effect-free and reusable from non-OGNL channels (Jackson, Juneau).

Implementations MUST NOT repeat the authorization decision — that is owned by ParameterAuthorizer.isAuthorized(java.lang.String, java.lang.Object, java.lang.Object). A no-op return (e.g. shallow paths, unannotated root) means "no priming needed or possible" and never "rejected": callers must not treat the absence of priming as a negative authorization signal.

Since:
7.2.0

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    primeAllowlistForPath(String parameterName, Object target)
    Primes the channel-specific allowlist for an authorized parameter path.

  • Method Details

    • primeAllowlistForPath

      void primeAllowlistForPath(String parameterName, Object target)
      Primes the channel-specific allowlist for an authorized parameter path. Side-effect-only; no return value because a no-op is a valid outcome (see class-level javadoc).
      Parameters:
      parameterName - the parameter name (e.g. "user.role", "items[0].name")
      target - the object receiving the parameter value (the action, or the model for ModelDriven actions)