WW-4858 Honor parameter filtering during JSON population

[lukaszlenart]

Fixes WW-4858

What & why

JSONInterceptor populates action/model properties from a JSON request body via JSONPopulator (pure Java reflection over bean setters), which historically bypassed most of the name/value acceptability controls that ParametersInterceptor applies to ordinary HTTP parameters. WW-5624 already retrofitted @StrutsParameter authorization onto this path; this change closes the remaining consistency gaps.

Population stays pure-reflection — no OGNL name evaluation is introduced (that is intentionally kept out of the JSON path as a security property). All filtering hooks into the single existing recursive tree-walk, using the same dotted/indexed paths (address.city, items[0].name) that ParametersInterceptor uses, so the shared pattern checkers behave equivalently on JSON and form input.

Controls added to the JSON population path

Always-on (security / app-owned):

• Excluded + accepted name patterns, via the shared ExcludedPatternsChecker / AcceptedPatternsChecker singletons (same instances ParametersInterceptor uses).
• Param-name max length (default 100).
• ParameterNameAware / ParameterValueAware action callbacks.
• @StrutsParameter authorization (unchanged, from WW-5624).

Opt-in (default off — preserves existing behavior for permissive JSON apps):

• Excluded / accepted value patterns (setExcludedValuePatterns / setAcceptedValuePatterns).
• Applying the interceptor's own excludeProperties / includeProperties to input, gated by applyPropertyFiltersToInput.

Scope notes

• The JSON-RPC path (application/json-rpc, SMD method invocation) is out of scope — it binds to method arguments, not stack properties.
• ParametersInterceptor is not modified.

Testing

New tests in JSONInterceptorTest cover each gap plus nested-object and list-element paths. Full JSON plugin suite passes (mvn test -pl plugins/json -am -DskipAssembly).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud