rootvector2 commented on PR #3670: URL: https://github.com/apache/cxf/pull/3670#issuecomment-6626490596
Pushed a rework that takes `hasEntity()` out of the decision entirely. 1. The filters no longer consult the headers: they read the stream and return on the existing empty-content check, so a `Content-Length: 0` plus chunked body is verified like any other. `JwsContainerRequestFilterTest.testZeroContentLengthDoesNotSkipVerification` covers that case. The opt-in `checkEmptyStream` path still calls `hasEntity()` as before; it's off by default and predates this change, so I left it alone. 2. `isMethodWithNoContent` keeps its old meaning for subclasses that override it (the method is skipped entirely). It just returns false by default now, so existing overrides aren't reinterpreted. 3. The hook lives in the four abstract base classes and the per-filter copies plus the new condition are gone, so the filter diffs are now pure deletions. The default method skip was redundant with the empty-content return, as you said. 4. The client tests build the real `ClientRequestContextImpl` and `ClientResponseContextImpl` (`cxf-rt-rs-client` added as a test dependency), and all eight filters have tests; 12 of the 24 fail on main. 5. A bodyless GET now costs one `read()` returning -1 instead of returning immediately. I don't see a way around that: knowing whether a body is there means touching the stream, since the headers can't be trusted per point 1. The `hasEntity()` probe it replaces did the same read plus buffering. The JOSE systests in `systests/rs-security` still pass (118 tests). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
