disallowedFields property

List<String> disallowedFields
getter/setter pair

Fields that are never bound, as patterns with * wildcards, such as id or *.admin; they win over allowedFields. Matching ignores case and also catches the bracket form of a dotted path (roles[admin] for roles.admin), as Spring does since CVE-2022-22968. Empty by default.

Implementation

List<String> disallowedFields = const [];