canonicalPropertyName static method

String canonicalPropertyName(
  1. String name
)

name with quotes and surrounding blanks removed from map keys and indexes: map['key'], map["key"] and map[ key ] all become map[key].

bind compares keys with the field rules in this form, so quoting a key cannot slip past a roles[admin] rule. Spring's PropertyAccessorUtils.canonicalPropertyName.

DataBinder.canonicalPropertyName("roles['admin']"); // roles[admin]

Implementation

static String canonicalPropertyName(String name) =>
    name.replaceAllMapped(RegExp(r'\[([^\]]*)\]'), (match) {
      var key = match.group(1)!.trim();
      if (key.length >= 2 &&
          (key.startsWith("'") && key.endsWith("'") ||
              key.startsWith('"') && key.endsWith('"'))) {
        key = key.substring(1, key.length - 1);
      }
      return '[$key]';
    });