org.apache.struts2.interceptor.parameter

## Class ParametersInterceptor

- java.lang.Object
- - org.apache.struts2.interceptor.AbstractInterceptor
  - - com.opensymphony.xwork2.interceptor.AbstractInterceptor
    - - com.opensymphony.xwork2.interceptor.MethodFilterInterceptor
      - - org.apache.struts2.interceptor.parameter.ParametersInterceptor

- All Implemented Interfaces:
    Serializable, ConditionalInterceptor, Interceptor
  Direct Known Subclasses:
    ActionMappingParametersInterceptor, ParametersInterceptor

      public class ParametersInterceptor
      extends MethodFilterInterceptor

  This interceptor sets all parameters on the value stack.
  See Also:
    Serialized Form

- - ### Nested Class Summary

    - ### Nested classes/interfaces inherited from interface com.opensymphony.xwork2.interceptor.ConditionalInterceptor

      `ConditionalInterceptor.LegacyAdapter`

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `protected boolean` | `ordered`
    `protected static int` | `PARAM_NAME_MAX_LENGTH`
    `protected boolean` | `requireAnnotations`
    `protected boolean` | `requireAnnotationsTransitionMode`
    `protected ThreadAllowlist` | `threadAllowlist`

    - ### Fields inherited from class com.opensymphony.xwork2.interceptor.MethodFilterInterceptor

      `excludeMethods, includeMethods`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `ParametersInterceptor()`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods Deprecated Methods
    Modifier and Type | Method and Description
    --- | ---
    `protected boolean` | `acceptableName(String name)` Deprecated. since 6.4.0, use `isAcceptableName(java.lang.String)`
    `protected boolean` | `acceptableValue(String name, String value)` Deprecated. since 6.4.0, use `isAcceptableValue(java.lang.String, java.lang.String)`
    `protected void` | `addParametersToContext(ActionContext ac, Map<String,?> newParams)` Adds the parameters into context's ParameterMap
    `protected void` | `allowlistClass(Class<?> clazz)`
    `protected void` | `allowlistFieldIfParameterized(Field field)`
    `protected void` | `allowlistParameterizedTypeArg(Type genericType)`
    `protected void` | `allowlistParamType(Type paramType)`
    `protected void` | `allowlistReturnTypeIfParameterized(Method method)`
    `protected void` | `applyMemberAccessProperties(ValueStack stack)`
    `protected void` | `applyParameters(Object action, ValueStack stack, HttpParameters parameters)`
    `protected void` | `applyParametersOnStack(ValueStack stack, Map<String,Parameter> parameters, Object action)`
    `protected void` | `batchApplyReflectionContextState(Map<String,Object> context, boolean value)`
    `String` | `doIntercept(ActionInvocation invocation)` Subclasses must override to implement the interceptor logic.
    `protected BeanInfo` | `getBeanInfo(Object action)`
    `protected Comparator<String>` | `getOrderedComparator()` Gets an instance of the comparator to use for the ordered sorting.
    `protected StrutsParameter` | `getParameterAnnotation(AnnotatedElement element)` Annotation retrieval logic.
    `protected String` | `getParameterLogMap(HttpParameters parameters)`
    `protected int` | `getPermittedInjectionDepth(AnnotatedElement element)`
    `protected boolean` | `hasValidAnnotatedField(Object action, String fieldName, long paramDepth)`
    `protected boolean` | `hasValidAnnotatedMember(String rootProperty, Object action, long paramDepth)` Note that we check for a public field last or only if there is no valid, annotated property descriptor.
    `protected boolean` | `hasValidAnnotatedPropertyDescriptor(Object action, PropertyDescriptor propDesc, long paramDepth)`
    `protected boolean` | `hasValidAnnotatedPropertyDescriptor(PropertyDescriptor propDesc, long paramDepth)` Deprecated. since 6.5.0, use `hasValidAnnotatedPropertyDescriptor(Object, PropertyDescriptor, long)` instead.
    `protected HttpParameters` | `initNewHttpParameters(HttpParameters parameters)`
    `protected Map<String,Parameter>` | `initParameterMap()`
    `protected boolean` | `isAcceptableName(String name)` Validates the name passed is: * Within the max length of a parameter name * Is not excluded * Is accepted
    `protected boolean` | `isAcceptableParameter(String name, Object action)` Checks if name of parameter can be accepted or thrown away
    `protected boolean` | `isAcceptableParameterNameAware(String name, Object action)`
    `protected boolean` | `isAcceptableParameterValue(Parameter param, Object action)` Checks if parameter value can be accepted or thrown away
    `protected boolean` | `isAcceptableParameterValueAware(Parameter param, Object action)`
    `protected boolean` | `isAcceptableValue(String name, String value)` Validates: * Value is null/blank * Value is not excluded * Value is accepted
    `protected boolean` | `isAccepted(String paramName)`
    `protected boolean` | `isExcluded(String paramName)`
    `boolean` | `isOrdered()` Whether to order the parameters or not
    `protected boolean` | `isParameterAnnotatedAndAllowlist(String name, Object action)` Checks if the Action class member corresponding to a parameter is appropriately annotated with `StrutsParameter` and OGNL allowlists any necessary classes.
    `protected boolean` | `isParamValueAccepted(String value)`
    `protected boolean` | `isParamValueExcluded(String value)`
    `protected boolean` | `isWithinLengthLimit(String name)`
    `protected void` | `notifyDeveloperParameterException(Object action, String property, String message)`
    `protected HttpParameters` | `retrieveParameters(ActionContext actionContext)` Gets the parameter map to apply from wherever appropriate
    `void` | `setAcceptedPatterns(AcceptedPatternsChecker acceptedPatterns)`
    `void` | `setAcceptedValuePatterns(String commaDelimitedPatterns)` Sets a comma-delimited list of regular expressions to match values of parameters that should be accepted and included in the parameter map.
    `void` | `setAcceptParamNames(String commaDelim)` Sets a comma-delimited list of regular expressions to match parameters that are allowed in the parameter map (aka whitelist).
    `void` | `setDevMode(String mode)`
    `protected void` | `setDynamicMethodInvocation(String dmiEnabled)`
    `void` | `setExcludedPatterns(ExcludedPatternsChecker excludedPatterns)`
    `void` | `setExcludedValuePatterns(String commaDelimitedPatterns)` Sets a comma-delimited list of regular expressions to match values of parameters that should be removed from the parameter map.
    `void` | `setExcludeParams(String commaDelim)` Sets a comma-delimited list of regular expressions to match parameters that should be removed from the parameter map.
    `void` | `setOrdered(boolean ordered)` Set whether to order the parameters by object depth or not
    `protected void` | `setParameters(Object action, ValueStack stack, HttpParameters parameters)` Deprecated. since 6.4.0, use `applyParameters(java.lang.Object, com.opensymphony.xwork2.util.ValueStack, org.apache.struts2.dispatcher.HttpParameters)`
    `void` | `setParamNameMaxLength(int paramNameMaxLength)` If the param name exceeds the configured maximum length it will not be accepted.
    `void` | `setRequireAnnotations(String requireAnnotations)`
    `void` | `setRequireAnnotationsTransitionMode(String transitionMode)` When 'Transition Mode' is enabled, parameters that are not 'nested' will be accepted without annotations.
    `void` | `setThreadAllowlist(ThreadAllowlist threadAllowlist)`
    `void` | `setValueStackFactory(ValueStackFactory valueStackFactory)`
    `protected Map<String,Parameter>` | `toAcceptableParameters(HttpParameters parameters, Object action)`
    `protected ValueStack` | `toNewStack(ValueStack stack)`

    - ### Methods inherited from class com.opensymphony.xwork2.interceptor.MethodFilterInterceptor

      `applyInterceptor, applyInterceptor, doIntercept, getExcludeMethodsSet, getIncludeMethodsSet, intercept, setExcludeMethods, setIncludeMethods`

    - ### Methods inherited from class com.opensymphony.xwork2.interceptor.AbstractInterceptor

      `intercept, shouldIntercept, shouldIntercept`

    - ### Methods inherited from class org.apache.struts2.interceptor.AbstractInterceptor

      `destroy, init, setDisabled`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface com.opensymphony.xwork2.interceptor.ConditionalInterceptor

      `adapt`

    - ### Methods inherited from interface com.opensymphony.xwork2.interceptor.Interceptor

      `adapt`

    - ### Methods inherited from interface org.apache.struts2.interceptor.Interceptor

      `destroy, init`

- - ### Field Detail

    - #### PARAM_NAME_MAX_LENGTH

          protected static final int PARAM_NAME_MAX_LENGTH

      See Also:
        Constant Field Values

    - #### ordered

          protected boolean ordered

    - #### requireAnnotations

          protected boolean requireAnnotations

    - #### requireAnnotationsTransitionMode

          protected boolean requireAnnotationsTransitionMode

    - #### threadAllowlist

          protected ThreadAllowlist threadAllowlist

  - ### Constructor Detail

    - #### ParametersInterceptor

          public ParametersInterceptor()

  - ### Method Detail

    - #### setValueStackFactory

          public void setValueStackFactory(ValueStackFactory valueStackFactory)

    - #### setThreadAllowlist

          public void setThreadAllowlist(ThreadAllowlist threadAllowlist)

    - #### setDevMode

          public void setDevMode(String mode)

    - #### setRequireAnnotations

          public void setRequireAnnotations(String requireAnnotations)

    - #### setRequireAnnotationsTransitionMode

          public void setRequireAnnotationsTransitionMode(String transitionMode)

      When 'Transition Mode' is enabled, parameters that are not 'nested' will be accepted without annotations. What this means in practice is that all public setters on an Action will be exposed for parameter injection again, and only 'nested' parameters, i.e. public getters on an Action, will require annotations.

      In this mode, the OGNL auto-allowlisting capability is not degraded in any way, and as such, it offers a convenient option for applications to enable the OGNL allowlist capability whilst they work through the process of annotating all their Action parameters.

    - #### setExcludedPatterns

          public void setExcludedPatterns(ExcludedPatternsChecker excludedPatterns)

    - #### setAcceptedPatterns

          public void setAcceptedPatterns(AcceptedPatternsChecker acceptedPatterns)

    - #### setDynamicMethodInvocation

          protected void setDynamicMethodInvocation(String dmiEnabled)

    - #### setParamNameMaxLength

          public void setParamNameMaxLength(int paramNameMaxLength)

      If the param name exceeds the configured maximum length it will not be accepted.
      Parameters:
        `paramNameMaxLength` - Maximum length of param names

    - #### doIntercept

          public String doIntercept(ActionInvocation invocation)
                             throws Exception

      Description copied from class: `MethodFilterInterceptor`
      Subclasses must override to implement the interceptor logic.
      Specified by:
        `doIntercept` in class `MethodFilterInterceptor`
      Parameters:
        `invocation` - the action invocation
      Returns:
        the result of invocation
      Throws:
        `Exception` - in case of any errors

    - #### retrieveParameters

          protected HttpParameters retrieveParameters(ActionContext actionContext)

      Gets the parameter map to apply from wherever appropriate
      Parameters:
        `actionContext` - The action context
      Returns:
        The parameter map to apply

    - #### addParametersToContext

          protected void addParametersToContext(ActionContext ac,
                                                Map<String,?> newParams)

      Adds the parameters into context's ParameterMap

      In this class this is a no-op, since the parameters were fetched from the same location. In subclasses both this and `retrieveParameters(com.opensymphony.xwork2.ActionContext)` should be overridden.

      Parameters:
        `ac` - The action context
        `newParams` - The parameter map to apply

    - #### setParameters

          @Deprecated
          protected void setParameters(Object action,
                                                   ValueStack stack,
                                                   HttpParameters parameters)

      Deprecated. since 6.4.0, use `applyParameters(java.lang.Object, com.opensymphony.xwork2.util.ValueStack, org.apache.struts2.dispatcher.HttpParameters)`

    - #### applyParameters

          protected void applyParameters(Object action,
                                         ValueStack stack,
                                         HttpParameters parameters)

    - #### batchApplyReflectionContextState

          protected void batchApplyReflectionContextState(Map<String,Object> context,
                                                          boolean value)

    - #### toNewStack

          protected ValueStack toNewStack(ValueStack stack)

    - #### applyMemberAccessProperties

          protected void applyMemberAccessProperties(ValueStack stack)

    - #### toAcceptableParameters

          protected Map<String,Parameter> toAcceptableParameters(HttpParameters parameters,
                                                                 Object action)

    - #### initParameterMap

          protected Map<String,Parameter> initParameterMap()

    - #### initNewHttpParameters

          protected HttpParameters initNewHttpParameters(HttpParameters parameters)

    - #### applyParametersOnStack

          protected void applyParametersOnStack(ValueStack stack,
                                                Map<String,Parameter> parameters,
                                                Object action)

    - #### notifyDeveloperParameterException

          protected void notifyDeveloperParameterException(Object action,
                                                           String property,
                                                           String message)

    - #### isAcceptableParameter

          protected boolean isAcceptableParameter(String name,
                                                  Object action)

      Checks if name of parameter can be accepted or thrown away
      Parameters:
        `name` - parameter name
        `action` - current action
      Returns:
        true if parameter is accepted

    - #### isAcceptableParameterNameAware

          protected boolean isAcceptableParameterNameAware(String name,
                                                           Object action)

    - #### isParameterAnnotatedAndAllowlist

          protected boolean isParameterAnnotatedAndAllowlist(String name,
                                                             Object action)

      Checks if the Action class member corresponding to a parameter is appropriately annotated with `StrutsParameter` and OGNL allowlists any necessary classes.

      Note that this logic relies on the use of `DefaultAcceptedPatternsChecker.NESTING_CHARS` and may also be adversely impacted by the use of custom OGNL property accessors.

    - #### hasValidAnnotatedMember

          protected boolean hasValidAnnotatedMember(String rootProperty,
                                                    Object action,
                                                    long paramDepth)

      Note that we check for a public field last or only if there is no valid, annotated property descriptor. This is because this check is likely to fail more often than not, as the relative use of public fields is low - so we save computation by checking this last.

    - #### hasValidAnnotatedPropertyDescriptor

          @Deprecated
          protected boolean hasValidAnnotatedPropertyDescriptor(PropertyDescriptor propDesc,
                                                                            long paramDepth)

      Deprecated. since 6.5.0, use `hasValidAnnotatedPropertyDescriptor(Object, PropertyDescriptor, long)` instead.

    - #### hasValidAnnotatedPropertyDescriptor

          protected boolean hasValidAnnotatedPropertyDescriptor(Object action,
                                                                PropertyDescriptor propDesc,
                                                                long paramDepth)

    - #### allowlistReturnTypeIfParameterized

          protected void allowlistReturnTypeIfParameterized(Method method)

    - #### allowlistParameterizedTypeArg

          protected void allowlistParameterizedTypeArg(Type genericType)

    - #### allowlistParamType

          protected void allowlistParamType(Type paramType)

    - #### allowlistClass

          protected void allowlistClass(Class<?> clazz)

    - #### hasValidAnnotatedField

          protected boolean hasValidAnnotatedField(Object action,
                                                   String fieldName,
                                                   long paramDepth)

    - #### allowlistFieldIfParameterized

          protected void allowlistFieldIfParameterized(Field field)

    - #### getPermittedInjectionDepth

          protected int getPermittedInjectionDepth(AnnotatedElement element)

      Returns:
        permitted injection depth where -1 indicates not permitted

    - #### getParameterAnnotation

          protected StrutsParameter getParameterAnnotation(AnnotatedElement element)

      Annotation retrieval logic. Can be overridden to support extending annotations or some other form of annotation inheritance.

    - #### getBeanInfo

          protected BeanInfo getBeanInfo(Object action)

    - #### isAcceptableParameterValue

          protected boolean isAcceptableParameterValue(Parameter param,
                                                       Object action)

      Checks if parameter value can be accepted or thrown away
      Parameters:
        `param` - the parameter
        `action` - current action
      Returns:
        true if parameter is accepted

    - #### isAcceptableParameterValueAware

          protected boolean isAcceptableParameterValueAware(Parameter param,
                                                            Object action)

    - #### getOrderedComparator

          protected Comparator<String> getOrderedComparator()

      Gets an instance of the comparator to use for the ordered sorting. Override this method to customize the ordering of the parameters as they are set to the action.
      Returns:
        A comparator to sort the parameters

    - #### getParameterLogMap

          protected String getParameterLogMap(HttpParameters parameters)

    - #### acceptableName

          protected boolean acceptableName(String name)

      Deprecated. since 6.4.0, use `isAcceptableName(java.lang.String)`

    - #### isAcceptableName

          protected boolean isAcceptableName(String name)

      Validates the name passed is: * Within the max length of a parameter name * Is not excluded * Is accepted
      Parameters:
        `name` - - Name to check
      Returns:
        true if accepted

    - #### acceptableValue

          protected boolean acceptableValue(String name,
                                            String value)

      Deprecated. since 6.4.0, use `isAcceptableValue(java.lang.String, java.lang.String)`

    - #### isAcceptableValue

          protected boolean isAcceptableValue(String name,
                                              String value)

      Validates: * Value is null/blank * Value is not excluded * Value is accepted
      Parameters:
        `name` - - Param name (for logging)
        `value` - - value to check
      Returns:
        true if accepted

    - #### isWithinLengthLimit

          protected boolean isWithinLengthLimit(String name)

    - #### isAccepted

          protected boolean isAccepted(String paramName)

    - #### isExcluded

          protected boolean isExcluded(String paramName)

    - #### isParamValueExcluded

          protected boolean isParamValueExcluded(String value)

    - #### isParamValueAccepted

          protected boolean isParamValueAccepted(String value)

    - #### isOrdered

          public boolean isOrdered()

      Whether to order the parameters or not
      Returns:
        True to order

    - #### setOrdered

          public void setOrdered(boolean ordered)

      Set whether to order the parameters by object depth or not
      Parameters:
        `ordered` - True to order them

    - #### setAcceptParamNames

          public void setAcceptParamNames(String commaDelim)

      Sets a comma-delimited list of regular expressions to match parameters that are allowed in the parameter map (aka whitelist).

      Don't change the default unless you know what you are doing in terms of security implications.

      Parameters:
        `commaDelim` - A comma-delimited list of regular expressions

    - #### setExcludeParams

          public void setExcludeParams(String commaDelim)

      Sets a comma-delimited list of regular expressions to match parameters that should be removed from the parameter map.
      Parameters:
        `commaDelim` - A comma-delimited list of regular expressions

    - #### setAcceptedValuePatterns

          public void setAcceptedValuePatterns(String commaDelimitedPatterns)

      Sets a comma-delimited list of regular expressions to match values of parameters that should be accepted and included in the parameter map.
      Parameters:
        `commaDelimitedPatterns` - A comma-delimited set of regular expressions

    - #### setExcludedValuePatterns

          public void setExcludedValuePatterns(String commaDelimitedPatterns)

      Sets a comma-delimited list of regular expressions to match values of parameters that should be removed from the parameter map.
      Parameters:
        `commaDelimitedPatterns` - A comma-delimited set of regular expressions

Copyright © 2000–2026 Apache Software Foundation. All rights reserved.