This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 19ae2dd2a5 Fixed: Do not evaluate the expand/collapse link of tree
widgets as an expression (OFBIZ-13639)
19ae2dd2a5 is described below
commit 19ae2dd2a5db7d17910cd8d4e231ea4d68365ce9
Author: Mridul Pathak <[email protected]>
AuthorDate: Sat Oct 3 22:36:54 2026 +0530
Fixed: Do not evaluate the expand/collapse link of tree widgets as an
expression (OFBIZ-13639)
When a tree widget has no expand-collapse-request,
ModelTree.getExpandCollapseRequest builds the link target from the request URI,
and the tree renderers hand it to the ModelTree.ModelNode.Link constructor,
which parsed it again as a FlexibleStringExpander, so that request data was
evaluated as an expression. The trail parameter that MacroTreeRenderer adds to
the link, which also comes from the request, was parsed the same way.
FlexibleStringExpander.getLiteral returns an instance that never parses its
text. The Link constructors that take plain strings, used only by the tree
renderers, now use it for the style, target and text, and the new
CommonWidgetModels.Parameter.literal does the same for the trail parameter. The
Link constructor that reads the XML element still evaluates expressions.
---
.../ofbiz/base/util/string/FlexibleStringExpander.java | 15 +++++++++++++++
.../org/apache/ofbiz/widget/model/CommonWidgetModels.java | 13 +++++++++++++
.../java/org/apache/ofbiz/widget/model/ModelTree.java | 8 +++++---
.../ofbiz/widget/renderer/macro/MacroTreeRenderer.java | 4 ++--
4 files changed, 35 insertions(+), 5 deletions(-)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
index 559d4d60ed..a306fa8285 100644
---
a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
+++
b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
@@ -172,6 +172,21 @@ public abstract class FlexibleStringExpander implements
Serializable, IsEmpty {
return fse.expandString(context, timeZone, locale);
}
+ /** Returns a <code>FlexibleStringExpander</code> object that always
evaluates to the given text, which is never
+ * parsed: <code>${...}</code> in it is not an expression. Use this for
values that were computed or come from a request,
+ * and so must not be evaluated as an expression. A null or empty argument
will return an object that represents an
+ * empty expression.
+ *
+ * @param text The text the returned object evaluates to
+ * @return A <code>FlexibleStringExpander</code> instance
+ */
+ public static FlexibleStringExpander getLiteral(String text) {
+ if (UtilValidate.isEmpty(text)) {
+ return NULL_EXPR;
+ }
+ return new ConstSimpleElem(text.toCharArray());
+ }
+
/** Returns a <code>FlexibleStringExpander</code> object. <p>A null or
* empty argument will return a <code>FlexibleStringExpander</code>
* object that represents an empty expression. That object is a shared
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
index 7c1177438d..6433e27acf 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
@@ -696,6 +696,19 @@ public final class CommonWidgetModels {
}
}
+ /**
+ * Creates a parameter whose value is taken literally and never
evaluated as an expression, for values that were
+ * computed or come from a request.
+ * @param paramName the name of the parameter
+ * @param paramValue the value of the parameter
+ * @return the parameter
+ */
+ public static Parameter literal(String paramName, String paramValue) {
+ Parameter parameter = new Parameter(paramName, "", false);
+ parameter.value = FlexibleStringExpander.getLiteral(paramValue);
+ return parameter;
+ }
+
/**
* Gets from field.
* @return the from field
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
index d3a2d26a9f..c0acbfcff6 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
@@ -1087,6 +1087,8 @@ public class ModelTree extends ModelWidget {
// FIXME: Something to be replaced by a builder class, but allows
us to quickly
// build Links to represent nodes with parameters in a tree,
rather that trying
// to encode the parameters early in the link's target.
+ // The style, target and text are computed by the renderer, and
the target comes from the request,
+ // so they are taken literally and never evaluated as an
expression.
public Link(String style, String target, String text,
List<Parameter> parameterList) {
this.encode = false;
this.fullPath = false;
@@ -1097,10 +1099,10 @@ public class ModelTree extends ModelWidget {
this.parameterList = parameterList != null ?
Collections.unmodifiableList(parameterList) : Collections.emptyList();
this.prefixExdr = FlexibleStringExpander.getInstance("");
this.secure = false;
- this.styleExdr = FlexibleStringExpander.getInstance(style);
- this.targetExdr = FlexibleStringExpander.getInstance(target);
+ this.styleExdr = FlexibleStringExpander.getLiteral(style);
+ this.targetExdr = FlexibleStringExpander.getLiteral(target);
this.targetWindowExdr = FlexibleStringExpander.getInstance("");
- this.textExdr = FlexibleStringExpander.getInstance(text);
+ this.textExdr = FlexibleStringExpander.getLiteral(text);
this.titleExdr = FlexibleStringExpander.getInstance("");
this.urlMode = "intra-app";
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
index bed80e2e17..43d4815a8f 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
@@ -171,7 +171,7 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
StringBuilder target = new
StringBuilder(node.getModelTree().getExpandCollapseRequest(context));
String trailName =
node.getModelTree().getTrailName(context);
expandCollapseLink = new
ModelTree.ModelNode.Link("collapsed", target.toString(), " ",
- ImmutableList.of(new
CommonWidgetModels.Parameter(trailName, currentNodeTrailPiped, false)));
+
ImmutableList.of(CommonWidgetModels.Parameter.literal(trailName,
currentNodeTrailPiped)));
}
} else {
context.put("processChildren", Boolean.TRUE);
@@ -183,7 +183,7 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
StringBuilder target = new
StringBuilder(node.getModelTree().getExpandCollapseRequest(context));
String trailName = node.getModelTree().getTrailName(context);
expandCollapseLink = new ModelTree.ModelNode.Link("expanded",
target.toString(), " ",
- ImmutableList.of(new
CommonWidgetModels.Parameter(trailName, currentNodeTrailPiped, false)));
+
ImmutableList.of(CommonWidgetModels.Parameter.literal(trailName,
currentNodeTrailPiped)));
// add it so it can be remove in renderNodeEnd
currentNodeTrail.add(lastContentId);
}
