Secure Data Binding With Grails
Introduction
The Grails Framework provides a lot of tools and techniques to web application developers to simplify solving common application development challenges.Among those are a number of things which simplify the complicated and tedious problems often associated with data binding. In general, data binding is made very simple by Grails as it offers several techniques for binding maps of data to graphs of objects.
It is important that application developers understand the implications of each of those techniques in order to decide which is most appropriate and most secure for any given use case.
Web Application Data Binding Overview
A really common task for many web applications is for the application to accept a set of http request parameters and bind those parameters to an object. The object then might be stored in the database, used to perform some kind of calculation or used carry out some kind of application logic. In a Grails application some of that is often carried out in a controller action and the data is often being bound to a domain object.Consider a domain class which looks something like this:
Code Listing 1
class Employee {
String firstName
String lastName
BigDecimal salary
}
There might be…
