com.opensymphony.xwork2.ObjectFactory#buildResult(ResultConfig, Map), injects all of the resultConfig parameters into the result after it has been built.
However, I'd like to be able to have my Result implement ParameterNameAware, and then have buildResult obey its acceptableParameterName() result so I can filter out what parameters can be injected.
I'm sorry I don't have a proper patch, but it is a very small change. Only call setProperty on the result if it is not ParameterNameAware, or it is and the parameter name is acceptable.
I have been running a Struts 2 app for 6 years with this change in place. Just getting around to suggesting it as a patch
It does also look like the documentation for ParameterNameAware would need to be updated to reflect that it can also be used for results, not just actions.