Package org.apache.juneau.rest.server.converter

Class Introspectable

java.lang.Object
org.apache.juneau.rest.server.converter.Introspectable
All Implemented Interfaces:
RestConverter
public class Introspectable extends Object implements RestConverter
Converter for enablement of ObjectIntrospector support on response objects returned by a @RestOp-annotated method.

When enabled, public methods can be called on objects returned through the RestResponse.setContent(Object) method.

Note that opening up public methods for calling through a REST interface can be dangerous, and should be done with caution.

Security - deny-by-default: As of Juneau 10.0, ObjectIntrospector is secure-by-default and denies reflective method dispatch unless the caller has explicitly allow-listed the target method(s). This converter is off by default as shipped — with no IntrospectableSettings bean registered, every invokeMethod request is refused with an HTTP 500 (MethodNotAllowlistedException wrapped in InternalServerError). A resource opts specific methods in explicitly by registering an IntrospectableSettings bean in its bean store:

@Rest(converters=Introspectable.class) public class MyResource extends BasicRestServlet { @Bean public IntrospectableSettings introspectableSettings() { return IntrospectableSettings.create() .allow(MyBean.class, "getName", "getAge") .build(); } }

For a trusted resource that needs the pre-10.0 behavior of dispatching to any public, non-deprecated method, call allowAll() instead — but never do this on a resource whose response objects expose methods you wouldn't want an arbitrary caller to invoke, since the method name and arguments always come from untrusted request query parameters. See IntrospectableSettings for the full builder API.

Java methods are invoked by passing in the following URL parameters:

  • &invokeMethod - The Java method name, optionally with arguments if necessary to differentiate between methods.
  • &invokeArgs - The arguments as an array.
See Also: