This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 03013f883e Fixed: Do not evaluate the values of the callback token of
forms as expressions (OFBIZ-13642)
03013f883e is described below
commit 03013f883e665d5e65dc82e51b8d4ff2f9b83316
Author: Mridul Pathak <[email protected]>
AuthorDate: Sun Oct 4 10:24:43 2026 +0530
Fixed: Do not evaluate the values of the callback token of forms as
expressions (OFBIZ-13642)
ModelForm.UpdateArea.toJwtToken puts the query string of the current
request in the parameters of the callback token, and UpdateArea.fromJwtToken
turned them into Parameter objects whose values are FlexibleStringExpander, so
that what comes from the request was evaluated as an expression when the
callback was rendered. The area id and the target of the token were evaluated
again as well, although the target was already evaluated when the token was
created.
The area id is now evaluated when the token is created, like the target,
and what comes out of the token is taken literally: UpdateArea.literal creates
an update area whose area id and target are not evaluated again, and
ParameterFactory.create uses Parameter.literal. The update areas defined in the
widgets are evaluated as before.
---
.../ofbiz/widget/model/CommonWidgetModels.java | 7 ++--
.../org/apache/ofbiz/widget/model/ModelForm.java | 46 ++++++++++++++++------
.../widget/renderer/macro/MacroCommonRenderer.java | 6 +--
3 files changed, 40 insertions(+), 19 deletions(-)
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
index 6433e27acf..f47b0e25d1 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
@@ -787,14 +787,15 @@ public final class CommonWidgetModels {
public static class ParameterFactory {
/**
- * For an entry map return a parameter after convert correctly the
value
+ * For an entry map return a parameter after convert correctly the
value. The value is taken literally and is
+ * never evaluated as an expression, as it is not part of a widget
definition.
* @param entry
* @return
*/
public static Parameter create(Map.Entry<String, Object> entry) {
try {
- return new CommonWidgetModels.Parameter(entry.getKey(),
- (String)
ObjectType.simpleTypeOrObjectConvert(entry.getValue(), "String", null, null),
false);
+ return CommonWidgetModels.Parameter.literal(entry.getKey(),
+ (String)
ObjectType.simpleTypeOrObjectConvert(entry.getValue(), "String", null, null));
} catch (GeneralException e) {
throw new RuntimeException(e);
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java
index 57d63144e0..c666de01ec 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelForm.java
@@ -2289,6 +2289,8 @@ public abstract class ModelForm extends ModelWidget {
private final String eventType;
private final String areaId;
private final String areaTarget;
+ // true when the area id and the target are already evaluated values,
which must not be evaluated again
+ private final boolean literal;
private final String defaultServiceName;
private final String defaultEntityName;
private final CommonWidgetModels.AutoEntityParameters
autoEntityParameters;
@@ -2307,6 +2309,7 @@ public abstract class ModelForm extends ModelWidget {
this.eventType = updateAreaElement.getAttribute("event-type");
this.areaId = updateAreaElement.getAttribute("area-id");
this.areaTarget = updateAreaElement.getAttribute("area-target");
+ this.literal = false;
this.defaultServiceName = defaultServiceName;
this.defaultEntityName = defaultEntityName;
List<? extends Element> parameterElementList =
UtilXml.childElementList(updateAreaElement, "parameter");
@@ -2352,14 +2355,7 @@ public abstract class ModelForm extends ModelWidget {
* @param areaTarget The target URL called to update the area
*/
public UpdateArea(String eventType, String areaId, String areaTarget) {
- this.eventType = eventType;
- this.areaId = areaId;
- this.areaTarget = areaTarget;
- this.defaultServiceName = null;
- this.defaultEntityName = null;
- this.parameterList = Collections.emptyList();
- this.autoServiceParameters = null;
- this.autoEntityParameters = null;
+ this(eventType, areaId, areaTarget, Collections.emptyList(),
false);
}
/** String constructor.
@@ -2369,9 +2365,15 @@ public abstract class ModelForm extends ModelWidget {
*/
public UpdateArea(String eventType, String areaId, String areaTarget,
List<CommonWidgetModels.Parameter> parameterList) {
+ this(eventType, areaId, areaTarget, parameterList, false);
+ }
+
+ private UpdateArea(String eventType, String areaId, String areaTarget,
+ List<CommonWidgetModels.Parameter> parameterList,
boolean literal) {
this.eventType = eventType;
this.areaId = areaId;
this.areaTarget = areaTarget;
+ this.literal = literal;
this.defaultServiceName = null;
this.defaultEntityName = null;
this.parameterList = parameterList;
@@ -2379,6 +2381,18 @@ public abstract class ModelForm extends ModelWidget {
this.autoEntityParameters = null;
}
+ /** Creates an update area whose area id and target are already
evaluated values, such as the ones of a callback
+ * token, so that they are taken literally and never evaluated as an
expression.
+ * @param areaId The evaluated id of the widget element to be updated
+ * @param areaTarget The evaluated target URL called to update the area
+ * @param parameterList The list of parameters, whose values are taken
as they are by the caller
+ * @return the update area
+ */
+ public static UpdateArea literal(String eventType, String areaId,
String areaTarget,
+ List<CommonWidgetModels.Parameter>
parameterList) {
+ return new UpdateArea(eventType, areaId, areaTarget,
parameterList, true);
+ }
+
@Override
public boolean equals(Object obj) {
return obj instanceof UpdateArea && obj.hashCode() ==
this.hashCode();
@@ -2392,13 +2406,22 @@ public abstract class ModelForm extends ModelWidget {
return areaId;
}
+ /**
+ * Gets area id, evaluated.
+ * @param context the context
+ * @return the area id
+ */
+ public String getAreaId(Map<String, ? extends Object> context) {
+ return literal ? areaId :
FlexibleStringExpander.expandString(areaId, context);
+ }
+
/**
* Gets area target.
* @param context the context
* @return the area target
*/
public String getAreaTarget(Map<String, ? extends Object> context) {
- return FlexibleStringExpander.expandString(areaTarget, context);
+ return literal ? areaTarget :
FlexibleStringExpander.expandString(areaTarget, context);
}
/**
@@ -2490,7 +2513,7 @@ public abstract class ModelForm extends ModelWidget {
Delegator delegator = (Delegator) context.get("delegator");
Map<String, String> claims = UtilMisc.toMap(
- "areaId",
WidgetWorker.getScreenStack(context).resolveScreenAreaId(getAreaId()),
+ "areaId",
WidgetWorker.getScreenStack(context).resolveScreenAreaId(getAreaId(context)),
"areaTarget", getAreaTarget(context));
// Propagate on the callback parameters use by pagination list
@@ -2538,7 +2561,8 @@ public abstract class ModelForm extends ModelWidget {
Debug.logWarning("Failed to convert JSON to with " +
claims.get("parameters"), MODULE);
}
}
- return new UpdateArea("", areaId, areaTarget,
+ // what is in the token was evaluated when the token was created,
so it is taken literally
+ return UpdateArea.literal("", areaId, areaTarget,
parameters != null
? parameters.entrySet()
.stream()
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
index 0c45ce82d3..994cd7b2ae 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
@@ -21,7 +21,6 @@ package org.apache.ofbiz.widget.renderer.macro;
import java.net.URI;
import java.util.Iterator;
import java.util.List;
-import java.util.Locale;
import java.util.Map;
import java.util.stream.Collectors;
@@ -32,7 +31,6 @@ import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilValidate;
-import org.apache.ofbiz.base.util.string.FlexibleStringExpander;
import org.apache.ofbiz.webapp.control.RequestHandler;
import org.apache.ofbiz.widget.WidgetWorker;
import org.apache.ofbiz.widget.model.CommonWidgetModels;
@@ -57,7 +55,6 @@ public class MacroCommonRenderer {
Map<String, Object> ctx = UtilGenerics.cast(context);
RequestHandler rh = RequestHandler.from(request);
- Locale locale = UtilMisc.ensureLocale(context.get("locale"));
StringBuilder sb = new StringBuilder();
Iterator<ModelForm.UpdateArea> updateAreaIter = updateAreas.iterator();
while (updateAreaIter.hasNext()) {
@@ -70,8 +67,7 @@ public class MacroCommonRenderer {
// 1. areaId to update, use the screen stack with the potential
area given by the update area element.
// It is the only part that is an expression; the target and
the parameters are expanded below.
- areaIdToUpdate =
WidgetWorker.getScreenStack(ctx).resolveScreenAreaId(
-
FlexibleStringExpander.expandString(updateArea.getAreaId(), ctx, locale));
+ areaIdToUpdate =
WidgetWorker.getScreenStack(ctx).resolveScreenAreaId(updateArea.getAreaId(ctx));
// 2. the target, if the updateArea haven't the information and we
are on event link to the pagination,
// will ask to the parent model the pagination target
