WW-5641 Restore struts.json.writer / struts.json.reader override in JSON plugin

[lukaszlenart]

Fixes WW-5641

Problem

A custom JSON writer/reader configured the documented way is silently ignored on the 7.2.x line — the framework always uses the default StrutsJSONWriter / StrutsJSONReader:

<bean type="org.apache.struts2.json.JSONWriter" name="flexJSONWriter"
      class="org.demo.FlexJSONWriter" scope="prototype"/>
<constant name="struts.json.writer" value="flexJSONWriter"/>

This worked on 7.1.x and regressed in 7.2.x. The extension point is still documented at https://struts.apache.org/plugins/json/, so this is a regression, not an intended API change.

Root cause

The 7.2.x JSON hardening rework added a <bean-selection name="jsonBeans" .../> element to the plugin's struts-plugin.xml. XmlDocConfigurationProvider.registerBeanSelection() runs that element inline, at plugin-parse time — before the application's struts.xml folds its override bean and struts.json.writer constant into the shared props. AbstractBeanSelectionProvider.alias() binds the default name only once (guarded), so it locks JSONWriter/JSONReader DEFAULT_NAME → StrutsJSONWriter/StrutsJSONReader and never re-selects when the app config loads afterward.

Fix

Move the <bean-selection> from struts-plugin.xml into a new struts-deferred.xml. Dispatcher.init() loads struts-deferred.xml last — after the application config and after core's StrutsBeanSelectionProvider — precisely because it is "sensitive to loading order such as 'bean-selection' elements" (per the framework's own comment). Running late, alias() reads the effective struts.json.writer / struts.json.reader value and aliases the default binding to the application's override.

This is the established in-tree convention: the velocity plugin already keeps its <bean> definitions in struts-plugin.xml and its <bean-selection> in struts-deferred.xml; core's own StrutsBeanSelectionProvider is likewise registered to run after all XML config. The JSON plugin was the outlier.

• No Java changes — JSONUtil is unchanged from main.
• StrutsJSONWriter / StrutsJSONReader remain the shipped defaults when no override is configured; DoS limits untouched.
• Fixes the container binding itself, so container.getInstance(JSONWriter.class) resolves to the override for any consumer.

Test

JSONWriterOverrideTest boots the real Dispatcher chain (struts-deferred.xml is loaded last by the framework, so it is intentionally omitted from the explicit config) and asserts, for both writer and reader, at both levels: the default container binding (container.getInstance(...)) and the effective use (JSONUtil.serialize(...) sentinel / getReader().getClass()). Verified failing before the element is moved, passing after. Full struts2-json-plugin suite: 129/129 green; apache-rat:check clean.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud