From 7e6a99e3bc5e1439c32eebd3820f58e2448a2581 Mon Sep 17 00:00:00 2001 From: Lukasz Lenart Date: Thu, 22 Oct 2026 12:07:38 +0200 Subject: [PATCH] WW-4323 test(core): pin that ParameterNameAware cannot accept an excluded name ParameterNameAware narrows what the interceptor accepts; it never overrides the global name checks. The existing testParameterNameAware does not tell the two semantics apart because its action rejects every extra key itself. Co-Authored-By: Claude Opus 5.5 --- .../parameter/ParametersInterceptorTest.java | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/core/src/test/java/org/apache/struts2/interceptor/parameter/ParametersInterceptorTest.java b/core/src/test/java/org/apache/struts2/interceptor/parameter/ParametersInterceptorTest.java index 232bd0451d..2e13010715 100644 --- a/core/src/test/java/org/apache/struts2/interceptor/parameter/ParametersInterceptorTest.java +++ b/core/src/test/java/org/apache/struts2/interceptor/parameter/ParametersInterceptorTest.java @@ -100,6 +100,21 @@ public void testParameterNameAware() { assertEquals(expected, actual); } + public void testParameterNameAwareCannotAcceptExcludedName() { + ParametersInterceptor pi = createParametersInterceptor(); + pi.setExcludeParams("blockedKey"); + final Map actual = injectValueStackFactory(pi); + ValueStack stack = createStubValueStack(actual); + ParameterNameAware acceptsEverything = name -> true; + final Map parameters = new HashMap<>(); + parameters.put("allowedKey", "allowedValue"); + parameters.put("blockedKey", "blockedValue"); + + pi.applyParameters(acceptsEverything, stack, HttpParameters.create(parameters).build()); + + assertEquals(Map.of("allowedKey", "allowedValue"), actual); + } + public void testInsecureParameters() throws Exception { // given loadConfigurationProviders(new StrutsDefaultConfigurationProvider(), new StrutsXmlConfigurationProvider("xwork-param-test.xml"));