WW-5720 fix(rest): log any-setter dynamic-key rejections once per request - #1948
Merged
Merged
Conversation
…uest An any-setter's key space is the request body, so a WARN per rejected key let a single body write an unbounded number of log lines. The per-key detail now goes to DEBUG and DynamicKeyRejections tallies the rejections per any-setter and reason, writing one WARN for each when the request state is cleared after the mapper read. Rejection itself is unchanged. The tally lives in its own request-scoped holder rather than inside DynamicKeyAuthorizationContext: that class is the nested-scope depth stack, pushed and popped per accepted key, while the tally is per request and flushed at a different point. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…n the rejection summary AnnotatedParameter.getName() is empty, so the sink for a creator-parameter any-setter read as "Foo#". Label it "Foo#creator[n]" instead, point the WARN at the DEBUG lines that carry the rejected keys, and pin the wording of the two reasons the tests did not yet assert on. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
lukaszlenart
marked this pull request as ready for review
September 15, 2026 17:15
Sonar S6204. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes WW-5720
With
struts.rest.anySetter.requireAnnotationsenabled,AuthorizingSettableAnyPropertywrote one WARN per rejected dynamic key. An any-setter's key space is the request body, so a body with ten thousand unknown keys wrote ten thousand WARN lines.Change
DynamicKeyRejectionstallies rejections per any-setter (Class#member, orClass#creator[n]for a creator parameter) and reason.ParameterAuthorizingModule.clearRequestState()runs — both Jackson handlers already call it in afinally, andContentTypeInterceptoronce more after unbinding, where the second call is a no-op.redactAndSkipstill runs on every path.The tally is its own holder rather than part of
DynamicKeyAuthorizationContext, which is the nested-scope depth stack pushed and popped per accepted key; the tally is per request and flushed at a different point. It is keyed by the class model and a four-value enum, so its size does not depend on the body.Tests
ParameterAuthorizingModuleTestcaptures theDynamicKeyRejectionslogger: zero WARNs during the read and exactly one after the clear with the count and sink; a second clear logs nothing; distinct summaries per reason and per sink; the creator-parameter label.🤖 Generated with Claude Code