WW-5698 Scope the ModelDriven exemption in StrutsParameterAuthorizer to the model object - #1872

isAuthorized returned true for every parameter name once the action implemented
ModelDriven. OGNL then resolves that name against the whole CompoundRoot, which
holds the model on top of the action, so authorization was decided about the
model while the write could land on the action. In effect the @StrutsParameter
requirement did not apply to a ModelDriven action's own members: an unannotated
setter declared on the action was bound, where the identical setter on a plain
action is rejected.

The exemption now covers what it was meant to cover. A property declared by the
model is exempt, since returning an object from getModel() declares it request
surface. A property declared by the action is subject to the annotation
requirement as usual. A property declared by neither is still allowed, because
it cannot be reaching a member of the action - that case is typically a model
bound through a custom OGNL property accessor, such as a Map-backed model, and
rejecting it would break those applications.

The model is checked first so that a model property shadowing an action property
still binds without an annotation, matching OGNL's own resolution against the
stack top.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…not by name

Copilot's review of #1872 found three ways the scoped exemption still let a
parameter through to the action's own members. All three reproduce.

Keying the exemption on the property name alone is not enough, because OGNL
walks the stack until an object actually accepts the assignment:

 - a getter-only property on the model cannot take a depth-0 parameter, so
   OGNL moves on and the action's unannotated setter takes it. Verified on a
   real value stack: the action's field ends up holding the value.
 - an inherited public field on the action was invisible to getDeclaredField,
   so the parameter counted as declared on neither model nor action and took
   the exemption meant for Map-backed models. OGNL sets inherited public
   fields as readily as declared ones.
 - a public static final namesake on the model cannot absorb a parameter
   either, and would have stood in for a real field.

declaresProperty therefore now asks what the object can bind at this depth -
the setter for a depth-0 parameter, the getter for a nested one, or a public
instance field - rather than whether the name appears anywhere.

Also rejects a parameter name that begins with a nesting character. It names
no root property, and computing one ran charAt(0) on an empty string.

Both changed methods are new in this PR, so their signatures are not yet API.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P9Pjt4rvb1ASASjSTHsUhL

…y fallback

The remaining half of Copilot's first review comment on #1872: "class" was
exempted for a ModelDriven action, where the ordinary path rejects it.

Not for the reason the comment gives, though. OgnlUtil introspects with Object
as the stop class, so "class" never appears among the property descriptors at
all; it was not being matched as a read-only descriptor but taking the fallback
for a property declared on neither model nor action, which exists to let a
Map-backed model bind through its own OGNL accessor. That fallback is the wrong
home for it: "class" is not an unknown name, it is Object.getClass() on every
object alike, and the non-ModelDriven path rejects it for want of an annotation.

Rejected there rather than earlier, so a model or action that really does
declare a "class" property is still decided on its own terms.

This is defence in depth, not a live bypass. Navigating a class path is already
inert: java.lang.Class and java.lang.ClassLoader are both in the default
struts.excludedClasses, and SecurityMemberAccess refuses their members - checked
on a real value stack, where every class.* read returns null and every set has
no effect. Worth closing anyway, because the two paths disagreeing is the very
thing this ticket is about.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P9Pjt4rvb1ASASjSTHsUhL