Prevent binding for @ModelAttribute [SPR-13402] #17982
Description
Kazuki Shimizu opened SPR-13402 and commented
Add new attribute(preventBinding) to prevents binding for request parameter at @ModelAttribute.
I want to obtained an read only object (Entity that was fetched from the database, etc) from the Model without binding request values for security countermeasure.
e.g.)
@Controller
@RequestMapping("account/{accountId}")
@SessionAttributes(types = {AccountUpdateForm.class, Account.class})
public class AccountUpdateController {
@ModelAttribute public AccountUpdateForm setUpAccountUpdateForm() { return new AccountUpdateForm(); }
@ModelAttribute public Account findAccount(@PathVariable String accountId) { return accountRepository.findOne(accountId); }
// ...
@RequestMapping(path = "update", method = RequestMethod.POST)
public String update(
@PathVariable String accountId,
@Valid AccountUpdateForm form,
BindingResult result,
// ### new attribute of @ModelAttribute ###
@ModelAttribute(preventBinding = true) Account account,
RedirectAttributes redirectAttributes) {
// ...
return "/account/{accountId}/update?complete";
}
@RequestMapping(path = "update", method = RequestMethod.GET, params = "complete")
public String updateComplete(SessionStatus sessionStatus){
sessionStatus.setComplete();
return "account/complete";
}
}How do think?
I submit PR at later.
Affects: 4.2 GA
Issue Links:
- @ModelAttribute binding defined globally for particular attribute rather than per method invocation [SPR-16083] #20632
@ModelAttributebinding defined globally for particular attribute rather than per method invocation - Introduce @FromModel as substitute to @ModelAttribute(binding=false) [SPR-15267] #19832 Introduce
@FromModelas substitute to@ModelAttribute(binding=false) - Portlet MVC @ModelAttribute interdependency is still not supported [SPR-13694] #18269 Portlet MVC
@ModelAttributeinterdependency is still not supported