From 4e3f264f34ebea631c9ca51905e0695dc944cd45 Mon Sep 17 00:00:00 2001
From: Sam Brannen <104798+sbrannen@users.noreply.github.com>
Date: Thu, 16 Apr 2026 16:33:43 +0200
Subject: [PATCH] Add missing tests for WebRequestDataBinder

See gh-36625

(cherry picked from commit 63817ce2021172338ce7900703678bfaee186a0a)
---
 .../support/WebRequestDataBinderTests.java    | 42 +++++++++++++++++--
 1 file changed, 39 insertions(+), 3 deletions(-)

diff --git a/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java b/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java
index d34c66f5ce2..fb3a6ef3c3d 100644
--- a/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java
+++ b/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java
@@ -344,6 +344,41 @@ class WebRequestDataBinderTests {
 			assertThat(tb.getCountry()).isNull();
 		}
 
+		@Test
+		void shouldNotTriggerBindingWhenFieldIsNotAllowedWithEmptyArrayIndex() {
+			TestBean tb = new TestBean();
+
+			WebRequestDataBinder binder = new WebRequestDataBinder(tb);
+			binder.setAllowedFields("name");
+
+			MockHttpServletRequest request = new MockHttpServletRequest();
+			request.addParameter("name", "spring");
+			request.addParameter(prefix + "stringArray[]", "ONE");
+			request.addParameter(prefix + "stringArray[]", "TWO");
+			binder.bind(new ServletWebRequest(request));
+
+			assertThat(tb.getName()).isEqualTo("spring");
+			assertThat(tb.getStringArray()).isNull();
+		}
+
+		@ParameterizedTest
+		@ValueSource(strings = { "stringArray*", "stringArray[]" })
+		void shouldNotTriggerBindingWhenFieldIsDisallowedWithEmptyArrayIndex(String disallowedField) {
+			TestBean tb = new TestBean();
+
+			WebRequestDataBinder binder = new WebRequestDataBinder(tb);
+			binder.setDisallowedFields(disallowedField);
+
+			MockHttpServletRequest request = new MockHttpServletRequest();
+			request.addParameter("name", "spring");
+			request.addParameter(prefix + "stringArray[]", "ONE");
+			request.addParameter(prefix + "stringArray[]", "TWO");
+			binder.bind(new ServletWebRequest(request));
+
+			assertThat(tb.getName()).isEqualTo("spring");
+			assertThat(tb.getStringArray()).isNull();
+		}
+
 		@Test
 		void shouldNotTriggerAutoGrowWhenFieldIsNotAllowed() {
 			TestBean tb = new TestBean();
@@ -361,13 +396,14 @@ class WebRequestDataBinderTests {
 			assertThat(tb.getSomeMap()).isNull();
 		}
 
-		@Test
-		void shouldNotTriggerAutoGrowWhenFieldIsDisallowed() {
+		@ParameterizedTest
+		@ValueSource(strings = { "someMap*", "someMap[*]", "someMap[key1]" })
+		void shouldNotTriggerAutoGrowWhenFieldIsDisallowed(String disallowedField) {
 			TestBean tb = new TestBean();
 			tb.setSomeMap(null);
 
 			WebRequestDataBinder binder = new WebRequestDataBinder(tb);
-			binder.setDisallowedFields("someMap[key1]");
+			binder.setDisallowedFields(disallowedField);
 
 			MockHttpServletRequest request = new MockHttpServletRequest();
 			request.addParameter("name", "spring");