From 57be7e66935908d1d905c577b61f7c676d7f909e Mon Sep 17 00:00:00 2001 From: Marco Krikke Date: Fri, 21 Nov 2014 17:32:42 +0100 Subject: [PATCH] Improved DataBinder Javadoc for xxx*yyy pattern matching. The default documentation does not mention xxx*yyy pattern matching, which is, however, supported by PatternMatchUtils. Such a pattern can be useful for matching nested properties in all elements of a collection (e.g. property[*].nestedProperty). --- .../validation/DataBinder.java | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/spring-context/src/main/java/org/springframework/validation/DataBinder.java b/spring-context/src/main/java/org/springframework/validation/DataBinder.java index 6c19ce712f40..76d1ce355715 100644 --- a/spring-context/src/main/java/org/springframework/validation/DataBinder.java +++ b/spring-context/src/main/java/org/springframework/validation/DataBinder.java @@ -386,10 +386,11 @@ public boolean isIgnoreInvalidFields() { } /** - * Register fields that should be allowed for binding. Default is all - * fields. Restrict this for example to avoid unwanted modifications - * by malicious users when binding HTTP request parameters. - *

Supports "xxx*", "*xxx" and "*xxx*" patterns. More sophisticated matching + * Register fields that should be allowed for binding. Default is all fields. + * Restrict this for example to avoid unwanted modifications by malicious users + * when binding HTTP request parameters. + *

Supports "xxx*", "*xxx", "*xxx*" and "xxx*yyy" matches (with an arbitrary + * number of pattern parts), as well as direct equality. More sophisticated matching * can be implemented by overriding the {@code isAllowed} method. *

Alternatively, specify a list of disallowed fields. * @param allowedFields array of field names @@ -413,7 +414,8 @@ public String[] getAllowedFields() { * Register fields that should not be allowed for binding. Default is none. * Mark fields as disallowed for example to avoid unwanted modifications * by malicious users when binding HTTP request parameters. - *

Supports "xxx*", "*xxx" and "*xxx*" patterns. More sophisticated matching + *

Supports "xxx*", "*xxx", "*xxx*" and "xxx*yyy" matches (with an arbitrary + * number of pattern parts), as well as direct equality. More sophisticated matching * can be implemented by overriding the {@code isAllowed} method. *

Alternatively, specify a list of allowed fields. * @param disallowedFields array of field names @@ -670,10 +672,11 @@ protected void checkAllowedFields(MutablePropertyValues mpvs) { /** * Return if the given field is allowed for binding. * Invoked for each passed-in property value. - *

The default implementation checks for "xxx*", "*xxx" and "*xxx*" matches, - * as well as direct equality, in the specified lists of allowed fields and - * disallowed fields. A field matching a disallowed pattern will not be accepted - * even if it also happens to match a pattern in the allowed list. + *

The default implementation checks for "xxx*", "*xxx", "*xxx*" and "xxx*yyy" + * matches (with an arbitrary number of pattern parts), as well as direct equality, + * in the specified lists of allowed fields and disallowed fields. A field matching + * a disallowed pattern will not be accepted even if it also happens to match a + * pattern in the allowed list. *

Can be overridden in subclasses. * @param field the field to check * @return if the field is allowed