spring/spring-framework
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-framework.git synced 2026-09-17 16:39:29 +00:00
Code Issues Projects Releases Wiki Activity

Update recommendations for web data binding

Browse Source 
Most of the documentation updates were already done in gh-36803, this
completes the section with some information on the property path syntax
supported by allowFields/disallowFields.

Closes gh-36789
This commit is contained in:
Brian Clozel
2026-09-02 14:43:51 +02:00
parent 7da197de66
commit c07da25bdf
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc
+15
View File
@@ -32,6 +32,21 @@ NOTE: It is also possible to configure `disallowedFields`, but that's fragile, a
due to be https://github.com/spring-projects/spring-framework/issues/36802[deprecated] in Spring Framework 7.1.
It is easy to overlook fields or introduce additional fields over time that should also be excluded.
The patterns given to `allowedFields` and `disallowedFields` are not limited to top-level
field names. They are property paths, using the same syntax supported for reading and
writing bean properties elsewhere in the Framework. They also support `*` as a
wildcard; this means you can constrain binding more precisely:
* `"address"` matches the `address` property.
* `"person.address.city"` matches the `city` property of the nested `address` property of `person`.
* `"addresses[0].city"` matches the `city` property of the element at index `0` in the `addresses` array or `List`.
* `"map[key]"` matches the entry associated with `key` in the `map` property.
* `"map*"` matches every entry in the `map` property, such as `"map[key1]"` and `"map[key2]"`.
the same wildcard syntax also applies to indexed elements in an array or `List`.
See the {spring-framework-api}/validation/DataBinder.html#setAllowedFields(java.lang.String...)[`DataBinder#setAllowedFields`]
javadoc for further details on the supported pattern syntax.
By default, `DataBinder` applies both constructor and setter binding.
This is fine with immutable objects and dedicated objects, but for domain objects, you must
remember to set `allowedFields`. To ensure data binding is only used in declarative style where