Package org.apache.juneau.rest.server.converter

Class IntrospectableSettings

java.lang.Object
org.apache.juneau.rest.server.converter.IntrospectableSettings
public class IntrospectableSettings extends Object
Deny-by-default allow-list settings for the Introspectable converter.

Reflective method dispatch via Introspectable is off by default on security grounds — unless explicitly allow-listed, invoking arbitrary public methods on a response object via a URL query parameter is a dangerous capability to expose over the wire. A consumer opts in explicitly by registering an IntrospectableSettings bean (built with allow(...) or IntrospectableSettings.Builder.allowAll()) in the resource's bean store. When no such bean is present, Introspectable resolves the default (deny-all) and every invokeMethod request is refused with an HTTP 500 (MethodNotAllowlistedException).

Example - allow-listing specific methods:

@Rest(converters=Introspectable.class) public class MyResource extends BasicRestServlet { @Bean public IntrospectableSettings introspectableSettings() { return IntrospectableSettings.create() .allow(MyBean.class, "getName", "getAge") .build(); } }

Example - trusted resource, pre-10.0 behavior:

@Bean public IntrospectableSettings introspectableSettings() { return IntrospectableSettings.create().allowAll().build(); }

Never call allowAll() on a resource whose response objects expose methods you wouldn't want an arbitrary caller to invoke — allow-list the specific methods instead.

See Also:
Since:
10.0.0

  • Field Details

  • Method Details

    • create

      public static IntrospectableSettings.Builder create()
      Builder creator.
      Returns:
      A new builder (deny-all).

    • asFilter

      public Predicate<Method> asFilter()
      Returns the effective allow-list filter for these settings.
      Returns:
      A filter that returns true for methods that may be invoked. Never null — returns false for every method when nothing has been allow-listed (the default).