diff --git a/spring-context/src/main/java/org/springframework/validation/DataBinder.java b/spring-context/src/main/java/org/springframework/validation/DataBinder.java index 1818b94b48f..9ae262ee070 100644 --- a/spring-context/src/main/java/org/springframework/validation/DataBinder.java +++ b/spring-context/src/main/java/org/springframework/validation/DataBinder.java @@ -418,10 +418,11 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { } /** - * Register fields that should be allowed for binding. Default is all - * fields. Restrict this for example to avoid unwanted modifications - * by malicious users when binding HTTP request parameters. - *
Supports "xxx*", "*xxx" and "*xxx*" patterns. More sophisticated matching + * Register fields that should be allowed for binding. Default is all fields. + * Restrict this for example to avoid unwanted modifications by malicious users + * when binding HTTP request parameters. + *
Supports "xxx*", "*xxx", "*xxx*" and "xxx*yyy" matches (with an arbitrary + * number of pattern parts), as well as direct equality. More sophisticated matching * can be implemented by overriding the {@code isAllowed} method. *
Alternatively, specify a list of disallowed fields. * @param allowedFields array of field names @@ -445,7 +446,8 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { * Register fields that should not be allowed for binding. Default is none. * Mark fields as disallowed for example to avoid unwanted modifications * by malicious users when binding HTTP request parameters. - *
Supports "xxx*", "*xxx" and "*xxx*" patterns. More sophisticated matching + *
Supports "xxx*", "*xxx", "*xxx*" and "xxx*yyy" matches (with an arbitrary + * number of pattern parts), as well as direct equality. More sophisticated matching * can be implemented by overriding the {@code isAllowed} method. *
Alternatively, specify a list of allowed fields. * @param disallowedFields array of field names @@ -772,10 +774,11 @@ public class DataBinder implements PropertyEditorRegistry, TypeConverter { /** * Return if the given field is allowed for binding. * Invoked for each passed-in property value. - *
The default implementation checks for "xxx*", "*xxx" and "*xxx*" matches, - * as well as direct equality, in the specified lists of allowed fields and - * disallowed fields. A field matching a disallowed pattern will not be accepted - * even if it also happens to match a pattern in the allowed list. + *
The default implementation checks for "xxx*", "*xxx", "*xxx*" and "xxx*yyy" + * matches (with an arbitrary number of pattern parts), as well as direct equality, + * in the specified lists of allowed fields and disallowed fields. A field matching + * a disallowed pattern will not be accepted even if it also happens to match a + * pattern in the allowed list. *
Can be overridden in subclasses. * @param field the field to check * @return if the field is allowed