Package org.springframework.validation

Class DataBinder

java.lang.Object
org.springframework.validation.DataBinder
All Implemented Interfaces:
PropertyEditorRegistry, TypeConverter
Direct Known Subclasses:
WebDataBinder
public class DataBinder extends Object implements PropertyEditorRegistry, TypeConverter
Binder that allows applying property values to a target object via constructor and setter injection, and also supports validation and binding result analysis.

The binding process can be customized by specifying allowed field patterns, required fields, custom editors, etc.

WARNING: Data binding can lead to security issues by exposing parts of the object graph that are not meant to be accessed or modified by external clients. Therefore, the design and use of data binding should be considered carefully with regard to security. For more details, please refer to the dedicated sections on data binding for Spring Web MVC and Spring WebFlux in the reference manual.

The binding results can be examined via the BindingResult interface, extending the Errors interface: see the getBindingResult() method. Missing fields and property access exceptions will be converted to FieldErrors, collected in the Errors instance, using the following error codes:

  • Missing field error: "required"
  • Type mismatch error: "typeMismatch"
  • Method invocation error: "methodInvocation"

By default, binding errors get resolved through the BindingErrorProcessor strategy, processing for missing fields and property access exceptions: see the setBindingErrorProcessor(org.springframework.validation.BindingErrorProcessor) method. You can override the default strategy if needed, for example to generate different error codes.

Custom validation errors can be added afterwards. You will typically want to resolve such error codes into proper user-visible error messages; this can be achieved through resolving each error via a MessageSource, which is able to resolve an ObjectError/FieldError through its MessageSource.getMessage(org.springframework.context.MessageSourceResolvable, java.util.Locale) method. The list of message codes can be customized through the MessageCodesResolver strategy: see the setMessageCodesResolver(org.springframework.validation.MessageCodesResolver) method. DefaultMessageCodesResolver's javadoc states details on the default resolution rules.

This generic data binder can be used in any kind of environment.

Author:
Rod Johnson, Juergen Hoeller, Rob Harrop, Stephane Nicoll, Kazuki Shimizu, Sam Brannen
See Also:

  • Field Details

    • DEFAULT_OBJECT_NAME

      public static final String DEFAULT_OBJECT_NAME
      Default object name used for binding: "target".
      See Also:

    • DEFAULT_AUTO_GROW_COLLECTION_LIMIT

      public static final int DEFAULT_AUTO_GROW_COLLECTION_LIMIT
      Default limit for array and collection growing: 256.
      See Also:

    • logger

      protected static final Log logger
      We'll create a lot of DataBinder instances: Let's use a static logger.

  • Constructor Details

    • DataBinder

      public DataBinder(@Nullable Object target)
      Create a new DataBinder instance, with default object name.
      Parameters:
      target - the target object to bind onto (or null if the binder is just used to convert a plain parameter value)
      See Also:

    • DataBinder

      public DataBinder(@Nullable Object target, String objectName)
      Create a new DataBinder instance.
      Parameters:
      target - the target object to bind onto (or null if the binder is just used to convert a plain parameter value)
      objectName - the name of the target object

  • Method Details

    • getTarget

      @Nullable public Object getTarget()
      Return the wrapped target object.

      If the target object is null and getTargetType() is set, then construct(ValueResolver) may be called to create the target.

    • getObjectName

      public String getObjectName()
      Return the name of the bound object.

    • setTargetType

      public void setTargetType(ResolvableType targetType)
      Set the type for the target object. When the target is null, setting the targetType allows using construct(ValueResolver) to create the target.
      Parameters:
      targetType - the type of the target object
      Since:
      6.1

    • getTargetType

      @Nullable public ResolvableType getTargetType()
      Return the configured type for the target object.
      Since:
      6.1

    • setAutoGrowNestedPaths

      public void setAutoGrowNestedPaths(boolean autoGrowNestedPaths)
      Set whether this binder should attempt to "auto-grow" a nested path that contains a null value.

      If "true", a null path location will be populated with a default object value and traversed instead of resulting in an exception. This flag also enables auto-growth of collection elements when accessing an out-of-bounds index.

      Default is "true" on a standard DataBinder. Note that since Spring 4.1 this feature is supported for bean property access (DataBinder's default mode) and field access.

      Used for setter/field injection via bind(PropertyValues), and not applicable to constructor initialization via construct(ValueResolver).

      See Also:

    • isAutoGrowNestedPaths

      public boolean isAutoGrowNestedPaths()
      Return whether "auto-growing" of nested paths has been activated.

    • setAutoGrowCollectionLimit

      public void setAutoGrowCollectionLimit(int autoGrowCollectionLimit)
      Specify the limit for array and collection auto-growing.

      Default is 256, preventing OutOfMemoryErrors in case of large indexes. Raise this limit if your auto-growing needs are unusually high.

      Used for setter/field injection via bind(PropertyValues), and not applicable to constructor initialization via construct(ValueResolver).

      See Also:

    • getAutoGrowCollectionLimit

      public int getAutoGrowCollectionLimit()
      Return the current limit for array and collection auto-growing.

    • initBeanPropertyAccess

      public void initBeanPropertyAccess()
      Initialize standard JavaBean property access for this DataBinder.

      This is the default; an explicit call just leads to eager initialization.

      See Also:

    • createBeanPropertyBindingResult

      protected AbstractPropertyBindingResult createBeanPropertyBindingResult()
      Create the AbstractPropertyBindingResult instance using standard JavaBean property access.
      Since:
      4.2.1

    • initDirectFieldAccess

      public void initDirectFieldAccess()
      Initialize direct field access for this DataBinder, as alternative to the default bean property access.
      See Also:

    • createDirectFieldBindingResult

      protected AbstractPropertyBindingResult createDirectFieldBindingResult()
      Create the AbstractPropertyBindingResult instance using direct field access.
      Since:
      4.2.1

    • getInternalBindingResult

      protected AbstractPropertyBindingResult getInternalBindingResult()
      Return the internal BindingResult held by this DataBinder, as an AbstractPropertyBindingResult.

    • getPropertyAccessor

      protected ConfigurablePropertyAccessor getPropertyAccessor()
      Return the underlying PropertyAccessor of this binder's BindingResult.

    • getSimpleTypeConverter

      protected SimpleTypeConverter getSimpleTypeConverter()
      Return this binder's underlying SimpleTypeConverter.

    • getPropertyEditorRegistry

      protected PropertyEditorRegistry getPropertyEditorRegistry()
      Return the underlying TypeConverter of this binder's BindingResult.

    • getTypeConverter

      protected TypeConverter getTypeConverter()
      Return the underlying TypeConverter of this binder's BindingResult.

    • getBindingResult

      public BindingResult getBindingResult()
      Return the BindingResult instance created by this DataBinder. This allows for convenient access to the binding results after a bind operation.
      Returns:
      the BindingResult instance, to be treated as BindingResult or as Errors instance (Errors is a super-interface of BindingResult)
      See Also:

    • setIgnoreUnknownFields

      public void setIgnoreUnknownFields(boolean ignoreUnknownFields)
      Set whether to ignore unknown fields, that is, whether to ignore bind parameters that do not have corresponding fields in the target object.

      Default is "true". Turn this off to enforce that all bind parameters must have a matching field in the target object.

      Note that this setting only applies to binding operations on this DataBinder, not to retrieving values via its BindingResult.

      Used for setter/field inject via bind(PropertyValues), and not applicable to constructor initialization via construct(ValueResolver), which uses only the values it needs.

      See Also:

    • isIgnoreUnknownFields

      public boolean isIgnoreUnknownFields()
      Return whether to ignore unknown fields when binding.

    • setIgnoreInvalidFields

      public void setIgnoreInvalidFields(boolean ignoreInvalidFields)
      Set whether to ignore invalid fields, that is, whether to ignore bind parameters that have corresponding fields in the target object which are not accessible (for example because of null values in the nested path).

      Default is "false". Turn this on to ignore bind parameters for nested objects in non-existing parts of the target object graph.

      Note that this setting only applies to binding operations on this DataBinder, not to retrieving values via its BindingResult.

      Used for setter/field inject via bind(PropertyValues), and not applicable to constructor initialization via construct(ValueResolver), which uses only the values it needs.

      See Also:

    • isIgnoreInvalidFields

      public boolean isIgnoreInvalidFields()
      Return whether to ignore invalid fields when binding.

    • setAllowedFields

      public void setAllowedFields(@Nullable String... allowedFields)
      Register field patterns that should be allowed for binding.

      Default is all fields.

      Restrict this for example to avoid unwanted modifications by malicious users when binding HTTP request parameters.

      Supports "xxx*", "*xxx", "*xxx*", and "xxx*yyy" matches (with an arbitrary number of pattern parts), as well as direct equality.

      The default implementation of this method stores allowed field patterns in canonical form. Subclasses which override this method must therefore take this into account.

      More sophisticated matching can be implemented by overriding the isAllowed(java.lang.String) method.

      Alternatively, specify a list of disallowed field patterns.

      Used for setter/field inject via bind(PropertyValues), and not applicable to constructor initialization via construct(ValueResolver), which uses only the values it needs.

      Parameters:
      allowedFields - array of allowed field patterns
      See Also:

    • getAllowedFields

      @Nullable public String[] getAllowedFields()
      Return the field patterns that should be allowed for binding.
      Returns:
      array of allowed field patterns
      See Also:

    • setDisallowedFields

      public void setDisallowedFields(@Nullable String... disallowedFields)
      Register field patterns that should not be allowed for binding.

      Default is none.

      Mark fields as disallowed, for example to avoid unwanted modifications by malicious users when binding HTTP request parameters.

      Supports "xxx*", "*xxx", "*xxx*", and "xxx*yyy" matches (with an arbitrary number of pattern parts), as well as direct equality.

      The default implementation of this method stores disallowed field patterns in canonical form. As of Spring Framework 5.2.21, the default implementation also transforms disallowed field patterns to lowercase to support case-insensitive pattern matching in isAllowed(java.lang.String). Subclasses which override this method must therefore take both of these transformations into account.

      More sophisticated matching can be implemented by overriding the isAllowed(java.lang.String) method.

      Alternatively, specify a list of allowed field patterns.

      Used for setter/field inject via bind(PropertyValues), and not applicable to constructor initialization via construct(ValueResolver), which uses only the values it needs.

      Parameters:
      disallowedFields - array of disallowed field patterns
      See Also:

    • getDisallowedFields

      @Nullable public String[] getDisallowedFields()
      Return the field patterns that should not be allowed for binding.
      Returns:
      array of disallowed field patterns
      See Also:

    • setRequiredFields

      public void setRequiredFields(@Nullable String... requiredFields)
      Register fields that are required for each binding process.

      If one of the specified fields is not contained in the list of incoming property values, a corresponding "missing field" error will be created, with error code "required" (by the default binding error processor).

      Used for setter/field inject via bind(PropertyValues), and not applicable to constructor initialization via construct(ValueResolver), which uses only the values it needs.

      Parameters:
      requiredFields - array of field names
      See Also:

    • getRequiredFields

      @Nullable public String[] getRequiredFields()
      Return the fields that are required for each binding process.
      Returns:
      array of field names

    • setMessageCodesResolver

      public void setMessageCodesResolver(@Nullable MessageCodesResolver messageCodesResolver)
      Set the strategy to use for resolving errors into message codes. Applies the given strategy to the underlying errors holder.

      Default is a DefaultMessageCodesResolver.

      See Also:

    • setBindingErrorProcessor

      public void setBindingErrorProcessor(BindingErrorProcessor bindingErrorProcessor)
      Set the strategy to use for processing binding errors, that is, required field errors and PropertyAccessExceptions.

      Default is a DefaultBindingErrorProcessor.

      See Also:

    • getBindingErrorProcessor

      public BindingErrorProcessor getBindingErrorProcessor()
      Return the strategy for processing binding errors.

    • setValidator

      public void setValidator(@Nullable Validator validator)
      Set the Validator to apply after each binding step.
      See Also:

    • setExcludedValidators

      public void setExcludedValidators(Predicate<Validator> predicate)
      Configure a predicate to exclude validators.
      Since:
      6.1

    • addValidators

      public void addValidators(Validator... validators)
      Add Validators to apply after each binding step.
      See Also:

    • replaceValidators

      public void replaceValidators(Validator... validators)
      Replace the Validators to apply after each binding step.
      See Also:

    • getValidator

      @Nullable public Validator getValidator()
      Return the primary Validator to apply after each binding step, if any.

    • getValidators

      public List<Validator> getValidators()
      Return the Validators to apply after data binding.

    • getValidatorsToApply

      public List<Validator> getValidatorsToApply()
      Return the Validators to apply after data binding. This includes the configured validators filtered by the exclude predicate.
      Since:
      6.1

    • setConversionService

      public void setConversionService(@Nullable ConversionService conversionService)
      Specify a ConversionService to use for converting property values, as an alternative to JavaBeans PropertyEditors.

    • getConversionService

      @Nullable public ConversionService getConversionService()
      Return the associated ConversionService, if any.

    • addCustomFormatter

      public void addCustomFormatter(Formatter<?> formatter)
      Add a custom formatter, applying it to all fields matching the Formatter-declared type.

      Registers a corresponding PropertyEditor adapter underneath the covers.

      Parameters:
      formatter - the formatter to add, generically declared for a specific type
      Since:
      4.2
      See Also:

    • addCustomFormatter

      public void addCustomFormatter(Formatter<?> formatter, String... fields)
      Add a custom formatter for the field type specified in Formatter class, applying it to the specified fields only, if any, or otherwise to all fields.

      Registers a corresponding PropertyEditor adapter underneath the covers.

      Parameters:
      formatter - the formatter to add, generically declared for a specific type
      fields - the fields to apply the formatter to, or none if to be applied to all
      Since:
      4.2
      See Also:

    • addCustomFormatter

      public void addCustomFormatter(Formatter<?> formatter, Class<?>... fieldTypes)
      Add a custom formatter, applying it to the specified field types only, if any, or otherwise to all fields matching the Formatter-declared type.

      Registers a corresponding PropertyEditor adapter underneath the covers.

      Parameters:
      formatter - the formatter to add (does not need to generically declare a field type if field types are explicitly specified as parameters)
      fieldTypes - the field types to apply the formatter to, or none if to be derived from the given Formatter implementation class
      Since:
      4.2
      See Also:

    • registerCustomEditor

      public void registerCustomEditor(Class<?> requiredType, PropertyEditor propertyEditor)
      Description copied from interface: PropertyEditorRegistry
      Register the given custom property editor for all properties of the given type.
      Specified by:
      registerCustomEditor in interface PropertyEditorRegistry
      Parameters:
      requiredType - the type of the property
      propertyEditor - the editor to register

    • registerCustomEditor

      public void registerCustomEditor(@Nullable Class<?> requiredType, @Nullable String field, PropertyEditor propertyEditor)
      Description copied from interface: PropertyEditorRegistry
      Register the given custom property editor for the given type and property, or for all properties of the given type.

      If the property path denotes an array or Collection property, the editor will get applied either to the array/Collection itself (the PropertyEditor has to create an array or Collection value) or to each element (the PropertyEditor has to create the element type), depending on the specified required type.

      Note: Only one single registered custom editor per property path is supported. In the case of a Collection/array, do not register an editor for both the Collection/array and each element on the same property.

      For example, if you wanted to register an editor for "items[n].quantity" (for all values n), you would use "items.quantity" as the value of the 'propertyPath' argument to this method.

      Specified by:
      registerCustomEditor in interface PropertyEditorRegistry
      Parameters:
      requiredType - the type of the property. This may be null if a property is given but should be specified in any case, in particular in case of a Collection - making clear whether the editor is supposed to apply to the entire Collection itself or to each of its entries. So as a general rule: Do not specify null here in case of a Collection/array!
      field - the path of the property (name or nested path), or null if registering an editor for all properties of the given type
      propertyEditor - editor to register

    • findCustomEditor

      @Nullable public PropertyEditor findCustomEditor(@Nullable Class<?> requiredType, @Nullable String propertyPath)
      Description copied from interface: PropertyEditorRegistry
      Find a custom property editor for the given type and property.
      Specified by:
      findCustomEditor in interface PropertyEditorRegistry
      Parameters:
      requiredType - the type of the property (can be null if a property is given but should be specified in any case for consistency checking)
      propertyPath - the path of the property (name or nested path), or null if looking for an editor for all properties of the given type
      Returns:
      the registered editor, or null if none

    • convertIfNecessary

      @Nullable public <T> T convertIfNecessary(@Nullable Object value, @Nullable Class<T> requiredType) throws TypeMismatchException
      Description copied from interface: TypeConverter
      Convert the value to the required type (if necessary from a String).

      Conversions from String to any type will typically use the setAsText method of the PropertyEditor class, or a Spring Converter in a ConversionService.

      Specified by:
      convertIfNecessary in interface TypeConverter
      Parameters:
      value - the value to convert
      requiredType - the type we must convert to (or null if not known, for example in case of a collection element)
      Returns:
      the new value, possibly the result of type conversion
      Throws:
      TypeMismatchException - if type conversion failed
      See Also:

    • convertIfNecessary

      @Nullable public <T> T convertIfNecessary(@Nullable Object value, @Nullable Class<T> requiredType, @Nullable MethodParameter methodParam) throws TypeMismatchException
      Description copied from interface: TypeConverter
      Convert the value to the required type (if necessary from a String).

      Conversions from String to any type will typically use the setAsText method of the PropertyEditor class, or a Spring Converter in a ConversionService.

      Specified by:
      convertIfNecessary in interface TypeConverter
      Parameters:
      value - the value to convert
      requiredType - the type we must convert to (or null if not known, for example in case of a collection element)
      methodParam - the method parameter that is the target of the conversion (for analysis of generic types; may be null)
      Returns:
      the new value, possibly the result of type conversion
      Throws:
      TypeMismatchException - if type conversion failed
      See Also:

    • convertIfNecessary

      @Nullable public <T> T convertIfNecessary(@Nullable Object value, @Nullable Class<T> requiredType, @Nullable Field field) throws TypeMismatchException
      Description copied from interface: TypeConverter
      Convert the value to the required type (if necessary from a String).

      Conversions from String to any type will typically use the setAsText method of the PropertyEditor class, or a Spring Converter in a ConversionService.

      Specified by:
      convertIfNecessary in interface TypeConverter
      Parameters:
      value - the value to convert
      requiredType - the type we must convert to (or null if not known, for example in case of a collection element)
      field - the reflective field that is the target of the conversion (for analysis of generic types; may be null)
      Returns:
      the new value, possibly the result of type conversion
      Throws:
      TypeMismatchException - if type conversion failed
      See Also:

    • convertIfNecessary

      @Nullable public <T> T convertIfNecessary(@Nullable Object value, @Nullable Class<T> requiredType, @Nullable TypeDescriptor typeDescriptor) throws TypeMismatchException
      Description copied from interface: TypeConverter
      Convert the value to the required type (if necessary from a String).

      Conversions from String to any type will typically use the setAsText method of the PropertyEditor class, or a Spring Converter in a ConversionService.

      Specified by:
      convertIfNecessary in interface TypeConverter
      Parameters:
      value - the value to convert
      requiredType - the type we must convert to (or null if not known, for example in case of a collection element)
      typeDescriptor - the type descriptor to use (may be null))
      Returns:
      the new value, possibly the result of type conversion
      Throws:
      TypeMismatchException - if type conversion failed
      See Also:

    • construct

      public final void construct(DataBinder.ValueResolver valueResolver)
      Create the target with constructor injection of values. It is expected that setTargetType(ResolvableType) was previously called and that getTarget() is null.

      Uses a public, no-arg constructor if available in the target object type, also supporting a "primary constructor" approach for data classes as follows: It understands the JavaBeans ConstructorProperties annotation as well as runtime-retained parameter names in the bytecode, associating input values with constructor arguments by name. If no such constructor is found, the default constructor will be used (even if not public), assuming subsequent bean property bindings through setter methods.

      After the call, use getBindingResult() to check for failures to bind to, and/or validate constructor arguments. If there are no errors, the target is set, and doBind(MutablePropertyValues) can be used for further initialization via setters.

      Parameters:
      valueResolver - to resolve constructor argument values with
      Throws:
      BeanInstantiationException - in case of constructor failure
      Since:
      6.1

    • bind

      public void bind(PropertyValues pvs)
      Bind the given property values to this binder's target.

      This call can create field errors, representing basic binding errors like a required field (code "required"), or type mismatch between value and bean property (code "typeMismatch").

      Note that the given PropertyValues should be a throwaway instance: For efficiency, it will be modified to just contain allowed fields if it implements the MutablePropertyValues interface; else, an internal mutable copy will be created for this purpose. Pass in a copy of the PropertyValues if you want your original instance to stay unmodified in any case.

      Parameters:
      pvs - property values to bind
      See Also:

    • doBind

      protected void doBind(MutablePropertyValues mpvs)
      Actual implementation of the binding process, working with the passed-in MutablePropertyValues instance.
      Parameters:
      mpvs - the property values to bind, as MutablePropertyValues instance
      See Also:

    • checkAllowedFields

      protected void checkAllowedFields(MutablePropertyValues mpvs)
      Check the given property values against the allowed fields, removing values for fields that are not allowed.
      Parameters:
      mpvs - the property values to be bound (can be modified)
      See Also:

    • isAllowed

      protected boolean isAllowed(String field)
      Determine if the given field is allowed for binding.

      Invoked for each passed-in property value.

      Checks for "xxx*", "*xxx", "*xxx*", and "xxx*yyy" matches (with an arbitrary number of pattern parts), as well as direct equality, in the configured lists of allowed field patterns and disallowed field patterns.

      Matching against allowed field patterns is case-sensitive; whereas, matching against disallowed field patterns is case-insensitive.

      A field matching a disallowed pattern will not be accepted even if it also happens to match a pattern in the allowed list.

      Can be overridden in subclasses, but care must be taken to honor the aforementioned contract.

      Parameters:
      field - the field to check
      Returns:
      true if the field is allowed
      See Also:

    • checkRequiredFields

      protected void checkRequiredFields(MutablePropertyValues mpvs)
      Check the given property values against the required fields, generating missing field errors where appropriate.
      Parameters:
      mpvs - the property values to be bound (can be modified)
      See Also:

    • applyPropertyValues

      protected void applyPropertyValues(MutablePropertyValues mpvs)
      Apply given property values to the target object.

      Default implementation applies all the supplied property values as bean property values. By default, unknown fields will be ignored.

      Parameters:
      mpvs - the property values to be bound (can be modified)
      See Also:

    • validate

      public void validate()
      Invoke the specified Validators, if any.
      See Also:

    • validate

      public void validate(Object... validationHints)
      Invoke the specified Validators, if any, with the given validation hints.

      Note: Validation hints may get ignored by the actual target Validator.

      Parameters:
      validationHints - one or more hint objects to be passed to a SmartValidator
      Since:
      3.1
      See Also:

    • close

      public Map<?,?> close() throws BindException
      Close this DataBinder, which may result in throwing a BindException if it encountered any errors.
      Returns:
      the model Map, containing target object and Errors instance
      Throws:
      BindException - if there were any errors in the bind operation
      See Also: