diff --git a/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc b/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc index 059126a3691..007fdcf69bb 100644 --- a/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc +++ b/framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc @@ -28,9 +28,9 @@ For example: } ---- -NOTE: It is also possible to configure `disallowedFields`, but that's fragile and -https://github.com/spring-projects/spring-framework/issues/36802[deprecated as of Spring Framework 7.1]. -It is easy to overlook fields or introduce additional fields over time that should also be excluded. +NOTE: The `disallowedFields` property has been +https://github.com/spring-projects/spring-framework/issues/36802[deprecated in Spring Framework 7.1] +because it is fragile and easy to get out of sync with the actual properties over time. By default, `DataBinder` applies both constructor and setter binding. This is fine with immutable objects and dedicated objects, but for domain objects, you must diff --git a/spring-context/src/main/java/org/springframework/validation/DataBinder.java b/spring-context/src/main/java/org/springframework/validation/DataBinder.java index 80b9a6e8bfe..414bfeb0285 100644 --- a/spring-context/src/main/java/org/springframework/validation/DataBinder.java +++ b/spring-context/src/main/java/org/springframework/validation/DataBinder.java @@ -515,7 +515,6 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { * applicable to constructor binding via {@link #construct}, * which uses only the values it needs. * @param allowedFields array of allowed field patterns - * @see #setDisallowedFields * @see #isAllowed(String) */ public void setAllowedFields(String @Nullable ... allowedFields) { @@ -553,7 +552,9 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { * @param disallowedFields array of disallowed field patterns * @see #setAllowedFields * @see #isAllowed(String) - * @deprecated as of 7.1, in favor of {@link #setAllowedFields}. + * @deprecated as of 7.1 as it is fragile and easy to get out of sync with the + * actual properties over time. Please use constructor binding, a model object + * designed for the expected inputs, or {@link #setAllowedFields} instead. */ @Deprecated(since = "7.1", forRemoval = true) public void setDisallowedFields(String @Nullable ... disallowedFields) { @@ -572,8 +573,7 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { /** * Return the field patterns that should not be allowed for binding. * @return array of disallowed field patterns - * @see #setDisallowedFields(String...) - * @deprecated as of 7.1, in favor of {@link #getAllowedFields()}. + * @deprecated as of 7.1 together with {@link #setDisallowedFields(String...)} */ @Deprecated(since = "7.1", forRemoval = true) public String @Nullable [] getDisallowedFields() { @@ -1285,7 +1285,6 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { * @param field the field to check * @return {@code true} if the field is allowed * @see #setAllowedFields - * @see #setDisallowedFields * @see org.springframework.util.PatternMatchUtils#simpleMatch(String, String) */ protected boolean isAllowed(String field) {