From e4d03f66257cb22c00abdbcef9e5085b7e24ba73 Mon Sep 17 00:00:00 2001
From: Brian Clozel <brian.clozel@broadcom.com>
Date: Thu, 9 Apr 2026 10:58:57 +0200
Subject: [PATCH] Skip binding entirely when field is not allowed

Prior to this commit, fields that are not allowed for binding were
always skipped and would not be bound. But the field and default marker
support (with the "_" and "!" prefixes) would be still considered and
could trigger collection instantiation/autogrow.

While this does not cause unwanted binding, this allocates memory for no
reason. This commit revisits the binding algorithm to only consider
default and field marker support if the regular field is allowed.

Fixes gh-36625
---
 .../springframework/web/bind/WebDataBinder.java |  4 +++-
 .../bind/support/WebRequestDataBinderTests.java | 17 +++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java b/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java
index 7f1710cfe87..52abea7e40d 100644
--- a/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java
+++ b/spring-web/src/main/java/org/springframework/web/bind/WebDataBinder.java
@@ -227,10 +227,12 @@ public class WebDataBinder extends DataBinder {
 	 */
 	@Override
 	protected void doBind(MutablePropertyValues mpvs) {
+		checkAllowedFields(mpvs);
 		checkFieldDefaults(mpvs);
 		checkFieldMarkers(mpvs);
 		adaptEmptyArrayIndices(mpvs);
-		super.doBind(mpvs);
+		checkRequiredFields(mpvs);
+		applyPropertyValues(mpvs);
 	}
 
 	/**
diff --git a/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java b/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java
index 13eab71b896..2a7c4b826cb 100644
--- a/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java
+++ b/spring-web/src/test/java/org/springframework/web/bind/support/WebRequestDataBinderTests.java
@@ -359,6 +359,23 @@ class WebRequestDataBinderTests {
 		assertThat(Arrays.asList(original)).as("Correct values").isEqualTo(Arrays.asList(values));
 	}
 
+	@Test
+	void defaultArgumentShouldNotTriggerAutoGrowWhenDisallowed() {
+		TestBean tb = new TestBean();
+		tb.setSomeMap(null);
+
+		WebRequestDataBinder binder = new WebRequestDataBinder(tb, "person");
+		binder.setAllowedFields("name");
+
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.addParameter("name", "spring");
+		request.addParameter("!someMap[key1]", "test");
+		binder.bind(new ServletWebRequest(request));
+
+		assertThat(tb.getName()).isEqualTo("spring");
+		assertThat(tb.getSomeMap()).isNull();
+	}
+
 
 	public static class EnumHolder {