Skip binding entirely when field is not allowed

Prior to this commit, fields that are not allowed for binding were
always skipped and would not be bound. But the field and default marker
support (with the "_" and "!" prefixes) would be still considered and
could trigger collection instantiation/autogrow.

While this does not cause unwanted binding, this allocates memory for no
reason. This commit revisits the binding algorithm to only consider
default and field marker support if the regular field is allowed.

Fixes gh-36625

spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java

@@ -227,10 +227,12 @@ public class WebDataBinder extends DataBinder {
 	 */
 	@Override
 	protected void doBind(MutablePropertyValues mpvs) {
+		checkAllowedFields(mpvs);
 		checkFieldDefaults(mpvs);
 		checkFieldMarkers(mpvs);
 		adaptEmptyArrayIndices(mpvs);
-		super.doBind(mpvs);
+		checkRequiredFields(mpvs);
+		applyPropertyValues(mpvs);
 	}
 
 	/**

spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java

@@ -359,6 +359,23 @@ class WebRequestDataBinderTests {
 		assertThat(Arrays.asList(original)).as("Correct values").isEqualTo(Arrays.asList(values));
 	}
 
+	@Test
+	void defaultArgumentShouldNotTriggerAutoGrowWhenDisallowed() {
+		TestBean tb = new TestBean();
+		tb.setSomeMap(null);
+
+		WebRequestDataBinder binder = new WebRequestDataBinder(tb, "person");
+		binder.setAllowedFields("name");
+
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.addParameter("name", "spring");
+		request.addParameter("!someMap[key1]", "test");
+		binder.bind(new ServletWebRequest(request));
+
+		assertThat(tb.getName()).isEqualTo("spring");
+		assertThat(tb.getSomeMap()).isNull();
+	}
+
 
 	public static class EnumHolder {