From 830cc3450fac3332be54865c53f448091f72748b Mon Sep 17 00:00:00 2001 From: Marco Krikke Date: Fri, 21 Nov 2014 17:32:42 +0100 Subject: [PATCH] Improved DataBinder Javadoc for xxx*yyy pattern matching The default documentation does not mention xxx*yyy pattern matching, which is, however, supported by PatternMatchUtils. Such a pattern can be useful for matching nested properties in all elements of a collection, e.g. property[*].nestedProperty. See gh-699 --- .../validation/DataBinder.java | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/spring-context/src/main/java/org/springframework/validation/DataBinder.java b/spring-context/src/main/java/org/springframework/validation/DataBinder.java index 1818b94b48f..9ae262ee070 100644 --- a/spring-context/src/main/java/org/springframework/validation/DataBinder.java +++ b/spring-context/src/main/java/org/springframework/validation/DataBinder.java @@ -418,10 +418,11 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { } /** - * Register fields that should be allowed for binding. Default is all - * fields. Restrict this for example to avoid unwanted modifications - * by malicious users when binding HTTP request parameters. - *

Supports "xxx*", "*xxx" and "*xxx*" patterns. More sophisticated matching + * Register fields that should be allowed for binding. Default is all fields. + * Restrict this for example to avoid unwanted modifications by malicious users + * when binding HTTP request parameters. + *

Supports "xxx*", "*xxx", "*xxx*" and "xxx*yyy" matches (with an arbitrary + * number of pattern parts), as well as direct equality. More sophisticated matching * can be implemented by overriding the {@code isAllowed} method. *

Alternatively, specify a list of disallowed fields. * @param allowedFields array of field names @@ -445,7 +446,8 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { * Register fields that should not be allowed for binding. Default is none. * Mark fields as disallowed for example to avoid unwanted modifications * by malicious users when binding HTTP request parameters. - *

Supports "xxx*", "*xxx" and "*xxx*" patterns. More sophisticated matching + *

Supports "xxx*", "*xxx", "*xxx*" and "xxx*yyy" matches (with an arbitrary + * number of pattern parts), as well as direct equality. More sophisticated matching * can be implemented by overriding the {@code isAllowed} method. *

Alternatively, specify a list of allowed fields. * @param disallowedFields array of field names @@ -772,10 +774,11 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { /** * Return if the given field is allowed for binding. * Invoked for each passed-in property value. - *

The default implementation checks for "xxx*", "*xxx" and "*xxx*" matches, - * as well as direct equality, in the specified lists of allowed fields and - * disallowed fields. A field matching a disallowed pattern will not be accepted - * even if it also happens to match a pattern in the allowed list. + *

The default implementation checks for "xxx*", "*xxx", "*xxx*" and "xxx*yyy" + * matches (with an arbitrary number of pattern parts), as well as direct equality, + * in the specified lists of allowed fields and disallowed fields. A field matching + * a disallowed pattern will not be accepted even if it also happens to match a + * pattern in the allowed list. *

Can be overridden in subclasses. * @param field the field to check * @return if the field is allowed