[BEANUTILS-68] [beanutils] Writing to a mapped property requires a setter for a map, but never uses it

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6
• Fix Version/s: 1.8.0

Environment

Operating System: All
Platform: PC

• Bugzilla Id: 27965
• Assignee: Unassigned
• Reporter: Dmitry Platonoff
• Created: 26/Mar/04 06:40
• Updated: 25/Mar/08 08:07
• Resolved: 25/Mar/08 08:07

Description

Encountered while using struts 1.1 with beautils 1.6.1.

When you attempt to set the value of a mapped property, BeanUtils.setProperty()
checks if the bean has a write method for a map and fails with a "Skipping read-
only property" message, even though it would never actually use or need this
method.

The following sample illustrates the problem:

public class MyBean {
private Map myMap;
public Map getMyMap()

{ return myMap; }

/* ... */
}

If you invoke BeanUtils.setProperty( myBean, "myMap(myKey)", value ) on an
instance of MyBean, the invocation fails, as there's no write method for the
myMap property (it doesn't throw an exception, it just doesn't do anything,
leaving the map unchanged).

However, if you add setMyMap() to the bean, the setProperty call succedes, even
though it never actually calls setMyMap(), using the getMyMap().put( "myKey",
value ) chain instead.

This looks like an unnecessary requirement with negative security implications.