Grails 7.2

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. Java 21124 lines · 3.9K tokens
  2. Apache Groovy 4.066 lines · 3K tokens
  3. Grails 7.299 lines · 6.1K tokens
Total289 lines · 13K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 116
  • 117
  • 190
  • 197
  • 201
  • 208
  • 209
  • 250
  • 287
  • 294
  • 295
  • 297
  • 306
  • 307
  • 323
  • 327
  • 329
  • 338
  • 347
  • 352
  • 362
  • 367
  • 378
  • 384
  • 427
  • 434
  • 470
  • 471
  • 488
  • 489
  • 494
  • 502
  • 532
  • 552
  • 598
  • 601
  • 611
  • 613
  • 614
  • 639
  • 653
  • 704
  • 732
  • 759
  • 770
  • 772
  • 776
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1004
  • 1275
  • 1333
  • 1336
  • 1392

Prompt Preview

Apply the Apache Groovy 4.0 and Java 21 prompts first. These rules cover existing Grails 7.2 applications on JDK 21 with the managed Spring Boot 3.5 stack. Grails 7.2 has reached end of community support. Apply Spring Security Core and REST, Hibernate GORM, JSON Views, and SiteMesh rules when those integrations are installed.

Routes and authorization

  • Install and configure an established authentication integration such as Spring Security Core; Grails itself supplies no default authentication mechanism. Enforce tenant and object authorization in service operations as well as at the controller boundary.
  • Expose intended controller actions through explicit UrlMappings and remove unnecessary controller/action wildcard mappings. Define static allowedMethods for every action with method restrictions; an omitted action accepts every HTTP method. Keep GET and HEAD free of state changes.
  • When using Spring Security Core, retain grails.plugin.springsecurity.rejectIfNoRule=true and explicitly declare public and protected endpoints using the selected request-mapping strategy. Review controllerAnnotations.staticRules, interceptUrlMap, or database Requestmap entries, including generated rules for administration and shutdown endpoints.
  • Review grails.plugin.springsecurity.filterChain.chainMap in first-match order and retain a final /** entry with JOINED_FILTERS. Keep protected endpoints out of filters: 'none' mappings and ensure custom chains retain required authentication, authorization, session, and CSRF filters.
  • For a filter installed in Grails' security