Package org.apache.struts2.rest.handler.jackson

Class ParameterAuthorizingModule

java.lang.Object
com.fasterxml.jackson.databind.Module
com.fasterxml.jackson.databind.module.SimpleModule
org.apache.struts2.rest.handler.jackson.ParameterAuthorizingModule
All Implemented Interfaces:
com.fasterxml.jackson.core.Versioned, Serializable
public class ParameterAuthorizingModule extends com.fasterxml.jackson.databind.module.SimpleModule
Jackson SimpleModule that wraps every SettableBeanProperty on every bean type with an AuthorizingSettableBeanProperty, enforcing @StrutsParameter authorization during deserialization via the ParameterAuthorizationContext ThreadLocal. Each wrapper is keyed by the Java member Jackson invokes for the property, not the external name a @JsonProperty or naming strategy puts on the wire, since the authorizer resolves the path against the member.

Register this module once on each handler's mapper (e.g. in the constructor), and before any format module whose deserializer modifier expects Jackson's own bean deserializer: modifiers run in reverse registration order, and this one wraps the bean deserializer it is given. All per-request authorization state is read from the ThreadLocal context, so the module + mapper combination is thread-safe and reusable across requests.

Since:
7.2.0
See Also:

  • Nested Class Summary

    Nested classes/interfaces inherited from class com.fasterxml.jackson.databind.Module

    com.fasterxml.jackson.databind.Module.SetupContext

  • Field Summary

    Fields inherited from class com.fasterxml.jackson.databind.module.SimpleModule

    _abstractTypes, _deserializerModifier, _deserializers, _hasExplicitName, _keyDeserializers, _keySerializers, _mixins, _name, _namingStrategy, _serializerModifier, _serializers, _subtypes, _valueInstantiators, _version

  • Constructor Summary

    Constructors
    Constructor
    Description
    ParameterAuthorizingModule()
     
    ParameterAuthorizingModule(boolean requireAnySetterAnnotations)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    clearAuthorizationContext()
    Clears the request-scoped state this module keeps on the thread — the dynamic-key scopes of any-setters, the verdicts awaiting a forward reference, and the tally of rejected dynamic keys, which is written to the log as one WARN per any-setter and reason — after a mapper read.
    static void
    clearRequestState()
     
    void
    setRequireAnySetterAnnotations(boolean requireAnySetterAnnotations)
    Configures any-setter enforcement.

    Methods inherited from class com.fasterxml.jackson.databind.module.SimpleModule

    _checkNotNull, addAbstractTypeMapping, addDeserializer, addKeyDeserializer, addKeySerializer, addSerializer, addSerializer, addValueInstantiator, getModuleName, getTypeId, registerSubtypes, registerSubtypes, registerSubtypes, setAbstractTypes, setDeserializerModifier, setDeserializers, setKeyDeserializers, setKeySerializers, setMixInAnnotation, setNamingStrategy, setSerializerModifier, setSerializers, setupModule, setValueInstantiators, version

    Methods inherited from class com.fasterxml.jackson.databind.Module

    getDependencies

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • ParameterAuthorizingModule

      public ParameterAuthorizingModule()

    • ParameterAuthorizingModule

      public ParameterAuthorizingModule(boolean requireAnySetterAnnotations)

  • Method Details

    • setRequireAnySetterAnnotations

      public void setRequireAnySetterAnnotations(boolean requireAnySetterAnnotations)
      Configures any-setter enforcement. Set this before the mapper is first used so Jackson has not yet cached deserializers built by this module.

    • clearAuthorizationContext

      public void clearAuthorizationContext()
      Clears the request-scoped state this module keeps on the thread — the dynamic-key scopes of any-setters, the verdicts awaiting a forward reference, and the tally of rejected dynamic keys, which is written to the log as one WARN per any-setter and reason — after a mapper read. A handler that registers this module on its own mapper must call it in a finally around every read; ContentTypeInterceptor clears the same state once more when it unbinds the context.
      Since:
      7.4.0

    • clearRequestState

      public static void clearRequestState()
      Since:
      7.4.0