fix(json-plugin): enforce @StrutsParameter in JSONPopulator.populateObject()

plugins/json/src/main/java/org/apache/struts2/json/JSONInterceptor.java

@@ -378,6 +378,12 @@ public void setDefaultEncoding(String val) {
         this.defaultEncoding = val;
     }
 
+    @Inject(value = StrutsConstants.STRUTS_PARAMETERS_REQUIRE_ANNOTATIONS, required = false)
+    public void setRequireAnnotations(String requireAnnotations) {
+        boolean required = BooleanUtils.toBoolean(requireAnnotations);
+        this.populator.setRequireAnnotations(required);
+    }
+
     /**
      * @param ignoreHierarchy Ignore properties defined on base classes of the root object.
      */

plugins/json/src/main/java/org/apache/struts2/json/JSONPopulator.java

@@ -20,6 +20,7 @@
 
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.apache.struts2.interceptor.parameter.StrutsParameter;
 import org.apache.struts2.json.annotations.JSON;
 
 import java.beans.BeanInfo;
@@ -52,6 +53,7 @@ public class JSONPopulator {
     private static final Logger LOG = LogManager.getLogger(JSONPopulator.class);
 
     private String dateFormat = JSONUtil.RFC3339_FORMAT;
+    private boolean requireAnnotations = false;
 
     public JSONPopulator() {
     }
@@ -60,6 +62,18 @@ public JSONPopulator(String dateFormat) {
         this.dateFormat = dateFormat;
     }
 
+    /**
+     * Sets whether @StrutsParameter annotations are required on setter methods
+     * for JSON deserialization. When enabled, only setters annotated with
+     * @StrutsParameter will be populated from JSON input, consistent with
+     * ParametersInterceptor behavior.
+     *
+     * @param requireAnnotations true to enforce annotation requirement
+     */
+    public void setRequireAnnotations(boolean requireAnnotations) {
+        this.requireAnnotations = requireAnnotations;
+    }
+
     public String getDateFormat() {
         return dateFormat;
     }
@@ -90,6 +104,14 @@ public void populateObject(Object object, final Map elements) throws IllegalAcce
                         continue;
                     }
 
+                    // Enforce @StrutsParameter annotation if required, consistent
+                    // with ParametersInterceptor behavior for URL parameters
+                    if (requireAnnotations && method.getAnnotation(StrutsParameter.class) == null) {
+                        LOG.debug("JSON property '{}' rejected: setter [{}] missing @StrutsParameter annotation",
+                                name, method.getName());
+                        continue;
+                    }
+
                     // use only public setters
                     if (Modifier.isPublic(method.getModifiers())) {
                         Class<?>[] paramTypes = method.getParameterTypes();