diff --git a/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-initbinder.adoc b/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-initbinder.adoc index 5b1371a6e43..1ebd01d1255 100644 --- a/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-initbinder.adoc +++ b/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-initbinder.adoc @@ -107,4 +107,6 @@ Kotlin:: [[webflux-ann-initbinder-model-design]] -NOTE: For more guidance on model design, please see xref:web/webflux/data-binding.adoc[Data Binding]. +== Model Design + +Please see xref:web/webflux/data-binding.adoc[Data Binding] for more guidance on model object design. diff --git a/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-methods/modelattrib-method-args.adoc b/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-methods/modelattrib-method-args.adoc index 1f26694ac54..b13d6ca63cc 100644 --- a/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-methods/modelattrib-method-args.adoc +++ b/framework-docs/modules/ROOT/pages/web/webflux/controller/ann-methods/modelattrib-method-args.adoc @@ -49,7 +49,7 @@ recommended either to use an object tailored specifically for web binding, or to constructor binding only. If property binding must still be used, then _allowedFields_ patterns should be set to limit which properties can be set. For further details on this and example configuration, see -xref:web/webflux/controller/ann-initbinder.adoc#webflux-ann-initbinder-model-design[model design]. +xref:web/webflux/data-binding.adoc#webflux-data-binding-design[model design]. When using constructor binding, you can customize request parameter names through an `@BindParam` annotation. For example: diff --git a/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-initbinder.adoc b/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-initbinder.adoc index 86a65b471d1..23283241cfb 100644 --- a/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-initbinder.adoc +++ b/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-initbinder.adoc @@ -107,4 +107,6 @@ Kotlin:: [[mvc-ann-initbinder-model-design]] -NOTE: For more guidance on model design, please see xref:web/webmvc/mvc-data-binding.adoc[Data Binding]. \ No newline at end of file +== Model Design + +Please see xref:web/webmvc/mvc-data-binding.adoc[Data Binding] for guidance on safe model object design. \ No newline at end of file diff --git a/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-methods/modelattrib-method-args.adoc b/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-methods/modelattrib-method-args.adoc index 52ee83c4f0e..0cffc3515ba 100644 --- a/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-methods/modelattrib-method-args.adoc +++ b/framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-methods/modelattrib-method-args.adoc @@ -84,7 +84,7 @@ recommended either to use an object tailored specifically for web binding, or to constructor binding only. If property binding must still be used, then _allowedFields_ patterns should be set to limit which properties can be set. For further details on this and example configuration, see -xref:web/webmvc/mvc-controller/ann-initbinder.adoc#mvc-ann-initbinder-model-design[model design]. +xref:web/webmvc/mvc-data-binding.adoc#mvc-data-binding-design[model design]. When using constructor binding, you can customize request parameter names through an `@BindParam` annotation. For example: diff --git a/spring-context/src/main/java/org/springframework/validation/DataBinder.java b/spring-context/src/main/java/org/springframework/validation/DataBinder.java index 5a453b28545..52b653bc9fb 100644 --- a/spring-context/src/main/java/org/springframework/validation/DataBinder.java +++ b/spring-context/src/main/java/org/springframework/validation/DataBinder.java @@ -78,8 +78,8 @@ import org.springframework.validation.annotation.ValidationAnnotationUtils; * external clients. Therefore, the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * *

The binding results can be examined via the {@link BindingResult} interface, diff --git a/spring-web/src/main/java/org/springframework/web/bind/ServletRequestDataBinder.java b/spring-web/src/main/java/org/springframework/web/bind/ServletRequestDataBinder.java index 553e20b9aa4..a031bac183b 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/ServletRequestDataBinder.java +++ b/spring-web/src/main/java/org/springframework/web/bind/ServletRequestDataBinder.java @@ -48,8 +48,8 @@ import org.springframework.web.util.WebUtils; * external clients. Therefore the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * *

See the DataBinder/WebDataBinder superclasses for customization options, diff --git a/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java b/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java index 092b451281c..8d62e8aa032 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java +++ b/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java @@ -41,8 +41,8 @@ import org.springframework.web.multipart.MultipartFile; * external clients. Therefore, the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * *

Includes support for field markers which address a common problem with diff --git a/spring-web/src/main/java/org/springframework/web/bind/annotation/InitBinder.java b/spring-web/src/main/java/org/springframework/web/bind/annotation/InitBinder.java index 6263204db3e..c5bb711e574 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/annotation/InitBinder.java +++ b/spring-web/src/main/java/org/springframework/web/bind/annotation/InitBinder.java @@ -35,8 +35,8 @@ import org.springframework.aot.hint.annotation.Reflective; * external clients. Therefore the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * *

{@code @InitBinder} methods support all arguments that diff --git a/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java b/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java index 58cde851f5b..23114c8d12f 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java +++ b/spring-web/src/main/java/org/springframework/web/bind/annotation/ModelAttribute.java @@ -37,8 +37,8 @@ import org.springframework.ui.Model; * external clients. Therefore the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * *

{@code @ModelAttribute} can be used to expose command objects to a web view, diff --git a/spring-web/src/main/java/org/springframework/web/bind/support/WebExchangeDataBinder.java b/spring-web/src/main/java/org/springframework/web/bind/support/WebExchangeDataBinder.java index 8f71b1053df..ef6bfebea75 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/support/WebExchangeDataBinder.java +++ b/spring-web/src/main/java/org/springframework/web/bind/support/WebExchangeDataBinder.java @@ -42,8 +42,8 @@ import org.springframework.web.server.ServerWebExchange; * external clients. Therefore the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * * @author Rossen Stoyanchev diff --git a/spring-web/src/main/java/org/springframework/web/bind/support/WebRequestDataBinder.java b/spring-web/src/main/java/org/springframework/web/bind/support/WebRequestDataBinder.java index 2829c1cf067..f1a4f6178f7 100644 --- a/spring-web/src/main/java/org/springframework/web/bind/support/WebRequestDataBinder.java +++ b/spring-web/src/main/java/org/springframework/web/bind/support/WebRequestDataBinder.java @@ -45,8 +45,8 @@ import org.springframework.web.multipart.support.StandardServletPartUtils; * external clients. Therefore the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * *

See the DataBinder/WebDataBinder superclasses for customization options, diff --git a/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/ServerRequest.java b/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/ServerRequest.java index d6b581c24cb..bafb2f16d1a 100644 --- a/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/ServerRequest.java +++ b/spring-webflux/src/main/java/org/springframework/web/reactive/function/server/ServerRequest.java @@ -190,6 +190,10 @@ public interface ServerRequest { /** * Bind to this request and return an instance of the given type. + *

Please read the security warning om + * {@link org.springframework.validation.DataBinder} and review the guidance + * on model object design in the Data Binding section for Spring WebFlux in + * the reference documentation. * @param bindType the type of class to bind this request to * @param the type to bind to * @return a mono containing either a constructed and bound instance of @@ -202,9 +206,13 @@ public interface ServerRequest { /** * Bind to this request and return an instance of the given type. + *

Please read the security warning om + * {@link org.springframework.validation.DataBinder} and review the guidance + * on model object design in the Data Binding section for Spring WebFlux in + * the reference documentation. * @param bindType the type of class to bind this request to - * @param dataBinderCustomizer used to customize the data binder, for example, set - * (dis)allowed fields + * @param dataBinderCustomizer used to customize the data binder, for example, + * set allowed fields if using property (instead of constructor) binding. * @param the type to bind to * @return a mono containing either a constructed and bound instance of * {@code bindType}, or a {@link BindException} in case of binding errors diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/function/ServerRequest.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/function/ServerRequest.java index fc91ee457e6..744eb0eb1c5 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/function/ServerRequest.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/function/ServerRequest.java @@ -142,6 +142,10 @@ public interface ServerRequest { /** * Bind to this request and return an instance of the given type. + *

Please read the security warning om + * {@link org.springframework.validation.DataBinder} and review the guidance + * on model object design in the Data Binding section for Spring MVC in + * the reference documentation. * @param bindType the type of class to bind this request to * @param the type to bind to * @return a constructed and bound instance of {@code bindType} @@ -154,9 +158,13 @@ public interface ServerRequest { /** * Bind to this request and return an instance of the given type. + *

Please read the security warning om + * {@link org.springframework.validation.DataBinder} and review the guidance + * on model object design in the Data Binding section for Spring MVC in + * the reference documentation. * @param bindType the type of class to bind this request to - * @param dataBinderCustomizer used to customize the data binder, for example, set - * (dis)allowed fields + * @param dataBinderCustomizer used to customize the data binder, for example, + * set allowed fields if using property (instead of constructor) binding. * @param the type to bind to * @return a constructed and bound instance of {@code bindType} * @throws BindException in case of binding errors diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/ExtendedServletRequestDataBinder.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/ExtendedServletRequestDataBinder.java index 336372a58be..efae30b1a03 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/ExtendedServletRequestDataBinder.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/ExtendedServletRequestDataBinder.java @@ -30,8 +30,8 @@ import org.springframework.web.servlet.HandlerMapping; * external clients. Therefore, the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * * @author Rossen Stoyanchev diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ExtendedServletRequestDataBinder.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ExtendedServletRequestDataBinder.java index dc7ef312660..2841bfe445c 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ExtendedServletRequestDataBinder.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ExtendedServletRequestDataBinder.java @@ -43,8 +43,8 @@ import org.springframework.web.servlet.HandlerMapping; * external clients. Therefore, the design and use of data binding should be considered * carefully with regard to security. For more details, please refer to the dedicated * sections on data binding for - * Spring Web MVC and - * Spring WebFlux + * Spring Web MVC and + * Spring WebFlux * in the reference manual. * * @author Rossen Stoyanchev