Grails Data Binding: Controlling Nested Association Binding per Endpoint

Answer (what you should do now)

For each write‑heavy controller action, bind only the properties you explicitly allow. Use a command object or bindData with an include list that contains only top‑level fields and, for associations, only the id property. Do not rely on a single global toggle; instead, control binding at the endpoint level.

Why this matters

Grails’ default deep binding walks dotted paths (e.g. author.name) and can modify associated domain instances, exposing mass‑assignment risks. The bindable static constraint blocks properties at the root level, but its effect on dotted paths is implementation‑specific and varies between Grails 4.x, 5.x, and newer releases.

Confirmed facts

• Domain classes and command objects share the same binding engine; bindable is an allowlist for top‑level properties only.
• Binding author.id lets Grails resolve the Author instance via its id lookup; nested author.* paths are still processed unless explicitly filtered.
• There is no single configuration flag that globally disables dotted‑path binding across all Grails versions.

Recommended pattern per endpoint

1. Create a dedicated command object for the action:

class UpdateBookCommand implements Validateable {
    Long id
    String title
    Long authorId   // bind only the id

    static constraints = {
        id nullable: false
        title maxSize: 200
        authorId nullable: true, validator: { val, obj ->
            // optional ownership check
            val != null && Author.exists(val)
        }
    }
}

1. In the controller:

def update(UpdateBookCommand cmd) {
    if (cmd.hasErrors()) {
        render view: 'edit', model: [cmd: cmd]
        return
    }
    Book book = Book.get(cmd.id)
    if (!book) {
        response.status = 404
        return
    }
    book.title = cmd.title
    book.author = Author.get(cmd.authorId)
    book.save()
    redirect action: 'show', id: book.id
}

1. Optional: use @BindUsing on the authorId property to enforce id‑only binding if you must keep a single domain class.

Testing the restriction

• Post a request with author.name=Hacked and assert that the Author instance’s name is unchanged.
• Post with author.id=2 and confirm the association is updated correctly.

Missing diagnostic detail

Could you tell me which Grails major version you are using? The interaction between bindable and dotted paths differs between Grails 4.x and Grails 5.x, and the exact code paths for JSON vs. form‑encoded requests may vary.