[emilhuseyn]

Fixes WW-5761

StrutsParameterAuthorizer.isAuthorized runs before OGNL and has to predict which accessor or field a parameter name will reach. If that prediction and OGNL's own name resolution ever differ, the value goes through a member nobody checked. This adds a second check at the point where OGNL resolves the member, behind a new constant that is off by default:

struts.parameters.requireAnnotations.enforceOnResolvedMember=false

With the flag off nothing changes: ParametersInterceptor sets no guard and binding takes the same path as today.

With the flag on (and struts.parameters.requireAnnotations on), ParametersInterceptor asks the authorizer for a ParameterMemberGuard for each parameter and sets it on the binding stack's SecurityMemberAccess just before stack.setParameter. It is removed when the loop ends. SecurityMemberAccess.isAccessible asks the guard about every member OGNL resolves. As you pointed out, that bean is scope="prototype" and every value stack has its own instance, so the guard is never shared between requests.

What the guard checks:

• Only members used on objects standing in the value stack root. A deeper object is reached through a root member whose depth already covers it.
• The ModelDriven model is exempt by identity, as in the authorizer.
• A nested parameter whose root getter returned null makes the null handler call the setter, which is usually unannotated. The guard allows that setter only after the getter of the same property has passed on the same object.
• A member also passes if a same-named overload or a public field of that property is annotated, which is what isAuthorized accepts today.
• Transition mode keeps depth 0 exempt.

Not changed: Map-backed models and custom PropertyAccessors never reach isAccessible, so the authorizer stays the gate there. ParameterNameAware, the JSON and REST plugins and CookieInterceptor are untouched.

Given orphan-oss/ognl#755, the authorizer side is kept small. StrutsParameterAuthorizer only gains memberGuard(...), a factory, and the depth count moves into a helper both methods use. The guard itself is the package-private StrutsParameterMemberGuard. ParameterAuthorizer.memberGuard is a default method returning PERMIT_ALL, so a custom authorizer compiles and behaves as before.

Tests: ParameterMemberGuardTest binds through a real OGNL value stack with no authorizer pre-check, so it shows the guard holding on its own: annotated and unannotated setters, fluent setters, public fields, overloads, nested depth, the null-handler case, ModelDriven, an object below the action, transition mode, removal after binding, and the interceptor with an authorizer whose prediction has drifted, rejected with the flag on and bound as before with the flag off or without requireAnnotations.

ParameterMemberGuardTest, ParameterAuthorizerTest, ParametersInterceptorTest, StrutsParameterAnnotationTest and SecurityMemberAccessTest pass locally on JDK 21, along with the full core suite. I have not benchmarked the flag-on cost: one annotation lookup per member OGNL resolves on a root object, plus a scan of the public methods and fields when that member itself is unannotated.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[emilhuseyn]

Once this one lands, I'll pick up WW-5787 (execAndWait sandbox) as you suggested, unless someone else is already on it.