arturobernalg opened a new pull request, #1158:
URL: https://github.com/apache/tomcat/pull/1158
The var attribute of c:forEach and c:forTokens has nested visibility. The
Jakarta Tags specification says "This scoped variable has nested visibility"
for both tags, so the variable must not be visible once the loop has ended. The
standard tag handlers remove it from the page scope when the loop ends. The tag
plugins set it for each iteration and never remove it. After the loop the last
value stays in the page scope, where it hides an attribute of the same name in
the request, session or application scope.
I found this by deploying the same JSP pages in two web applications on a
current main, one with the default tagPlugins.xml and one without it, using the
Apache Taglibs 1.2.5 jars from the examples web application, and comparing the
responses. With the plugins, reading ${i} after a loop that uses var="i" gave:
| Page | Standard tag handler | Plugin before this change |
|---|---|---|
| ${i} after c:forEach over a list of 1 to 5 | empty | 5 |
| ${i} after c:forEach with begin and end | empty | 3 |
| ${t} after c:forTokens over a,b,c | empty | c |
| request attribute i="orig", ${i} read after the loop | orig | 2 |
The change removes the variable from the page scope in a finally block after
the loop, as the standard tag handlers do, so that it is also removed if the
body throws an exception. It applies to both the numeric range loop and the
loop over items in ForEach, and to the loop in ForTokens.
TestForEach.testVarNotVisibleAfterLoop and
TestForTokens.testVarNotVisibleAfterLoop use two new pages in test/webapp/jstl.
Without the change they fail with afterItems=b, afterRange=2 and afterNone=b.
With the change they pass. With the change, ten pages with a loop variable
(nested loops, a variable that does not exist before the loop, an empty list, a
request attribute with the same name) give the same output as the standard tag
handlers on a running Tomcat. Of the 185 JSTL pages I compared before, the ones
that do not read a loop variable after the loop give the same output as before.
All 55 test classes under org/apache/jasper (489 tests) pass and so do the ten
tag plugin test classes on JDK 21 and on JDK 27. Checkstyle passes.
I did not find an existing pull request or Bugzilla issue for this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
