@MVC should provide a way to invoke custom code at preBind stage [SPR-6472]

[spring-projects-issues]

Xiaohong Zheng opened SPR-6472 and commented

Our security policy requires basic validation to be executed before binding user input. An @PreBind annotation at method level can achieve this. This method should be able to receive same parameters as the handler method.

---

Affects: 3.0 RC2

Issue Links:

• @MVC should provide an "onBind" hook prior to automatic validation [SPR-6437] #11103 @MVC should provide an "onBind" hook prior to automatic validation
• Custom DataBinder Hook [SPR-6534] #11200 Custom DataBinder Hook

2 votes, 4 watchers

[spring-projects-issues]

Xiaohong Zheng commented

Also it'll be more elegant to configure the prebind logic at the WebBinderInitializer level outside of each handler class.

[spring-projects-issues]

Rossen Stoyanchev commented

I am resolving this as complete.

In Spring 3.1 M2 there is a new RequestMappingHandlerMapping and RequestMappingHandlerAdapter for processing requests with annotated controller methods. The former class resolves handler method arguments through implementations of HandlerMethodArgumentResolver. In particular the ModelAttributeMethodProcessor implementation resolves @ModelAttribute method arguments and provides hooks before and after data binding as well as validation.

Since the goal for this ticket is to apply a policy across all controllers, the provided hooks should provide what's needed. To make it work a subclass of ServletModelAttributeMethodProcessor must be created and configured on the RequestMappingHandlerAdapter through the setArgumentResolvers() property.

[lglapinski]

@rstoyanchev You wrote

In particular the ModelAttributeMethodProcessor implementation resolves @ModelAttribute method arguments and provides hooks before and after data binding as well as validation.

Could you point me to those hooks you mentioned? I can't find anything related to that

[rstoyanchev]

Those are in ModelAttributeMethodProcessor, bindRequestParameters and validateIfApplicable respectively.