From c07da25bdf5387a655259e97de3864282daac692 Mon Sep 17 00:00:00 2001 From: Brian Clozel Date: Wed, 2 Sep 2026 14:43:51 +0200 Subject: [PATCH] Update recommendations for web data binding Most of the documentation updates were already done in gh-36803, this completes the section with some information on the property path syntax supported by allowFields/disallowFields. Closes gh-36789 --- .../web/web-data-binding-model-design.adoc | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc b/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc index 09476b10bb7..48d15ae40f7 100644 --- a/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc +++ b/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc @@ -32,6 +32,21 @@ NOTE: It is also possible to configure `disallowedFields`, but that's fragile, a due to be https://github.com/spring-projects/spring-framework/issues/36802[deprecated] in Spring Framework 7.1. It is easy to overlook fields or introduce additional fields over time that should also be excluded. +The patterns given to `allowedFields` and `disallowedFields` are not limited to top-level +field names. They are property paths, using the same syntax supported for reading and +writing bean properties elsewhere in the Framework. They also support `*` as a +wildcard; this means you can constrain binding more precisely: + +* `"address"` matches the `address` property. +* `"person.address.city"` matches the `city` property of the nested `address` property of `person`. +* `"addresses[0].city"` matches the `city` property of the element at index `0` in the `addresses` array or `List`. +* `"map[key]"` matches the entry associated with `key` in the `map` property. +* `"map*"` matches every entry in the `map` property, such as `"map[key1]"` and `"map[key2]"`. + the same wildcard syntax also applies to indexed elements in an array or `List`. + +See the {spring-framework-api}/validation/DataBinder.html#setAllowedFields(java.lang.String...)[`DataBinder#setAllowedFields`] +javadoc for further details on the supported pattern syntax. + By default, `DataBinder` applies both constructor and setter binding. This is fine with immutable objects and dedicated objects, but for domain objects, you must remember to set `allowedFields`. To ensure data binding is only used in declarative style where