[
https://issues.apache.org/jira/browse/WW-5641?focusedWorklogId=1028307&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1028307
]
ASF GitHub Bot logged work on WW-5641:
--------------------------------------
Author: ASF GitHub Bot
Created on: 06/Jul/26 18:10
Start Date: 06/Jul/26 18:10
Worklog Time Spent: 10m
Work Description: sonarqubecloud[bot] commented on PR #1766:
URL: https://github.com/apache/struts/pull/1766#issuecomment-4896125266
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1766)
**Quality Gate passed**
Issues
 [9 New
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1766&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1766&issueStatuses=ACCEPTED)
Measures
 [0 Security
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=1766&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1766&metric=new_coverage&view=list)
 [0.0% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1766&metric=new_duplicated_lines_density&view=list)
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1028307)
Time Spent: 20m (was: 10m)
> JSON plugin ignores struts.json.writer / struts.json.reader override
> (regression since 7.2.x)
> ---------------------------------------------------------------------------------------------
>
> Key: WW-5641
> URL: https://issues.apache.org/jira/browse/WW-5641
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - JSON
> Affects Versions: 7.2.1
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.3.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h2. Summary
> A custom JSON writer/reader configured the documented way via the
> {{struts.json.writer}} /
> {{struts.json.reader}} constants is silently ignored. The framework always
> uses the default
> {{StrutsJSONWriter}} / {{StrutsJSONReader}}. This worked in the 7.1.x line
> and regressed in
> 7.2.x as a side effect of the JSON hardening rework that introduced
> {{<bean-selection>}} for
> the JSON plugin.
> The extension point is still documented at
> [https://struts.apache.org/plugins/json/], so this
> is a regression, not an intended API change.
> h2. How to reproduce
> In an application {{struts.xml}}:
> {code:xml}
> <bean type="org.apache.struts2.json.JSONWriter" name="flexJSONWriter"
> class="org.demo.FlexJSONWriter" scope="prototype"/>
> <constant name="struts.json.writer" value="flexJSONWriter"/>
> {code}
> *Expected:* JSON is serialized by {{FlexJSONWriter}}.
> *Actual:* JSON is serialized by the default {{StrutsJSONWriter}}; the
> override is never used.
> Confirmed via the {{json-customize}} module reproduction in
> apache/struts-examples PR #535
> ({{ProduceActionTest}}): passes on 7.1.x, fails on 7.2.x.
> h2. Root cause
> Writer/reader selection moved from a *runtime, by-name lookup* to a
> *container-build-time alias*.
> * In 7.1.x, {{JSONUtil}} injected the {{Container}} and resolved the
> writer/reader at use time
> from the constant value — this ran after the full container (including the
> app {{struts.xml}})
> was built, so overrides applied.
> * In 7.2.x, {{JSONUtil}} injects the default {{JSONWriter}} / {{JSONReader}}
> binding, which is
> chosen once by the new {{JSONBeanSelectionProvider}} (wired via
> {{<bean-selection>}} in the
> plugin's {{struts-plugin.xml}}).
> {{XmlDocConfigurationProvider.registerBeanSelection()}} invokes the
> bean-selection provider
> *inline, the moment the {{<bean-selection>}} element is parsed* in the
> plugin's
> {{struts-plugin.xml}}. At that instant the shared {{props}} hold only the
> plugin's own
> {{struts.json.writer=struts}}; the application {{struts.xml}} is a later
> {{ContainerProvider}}
> whose override bean/constant have not been folded in yet. So
> {{AbstractBeanSelectionProvider.alias()}} takes the "found by default name"
> branch and locks
> {{JSONWriter/DEFAULT_NAME -> StrutsJSONWriter}}. Nothing re-runs the
> selection once the app
> config loads, so the override is dropped. The 7.1.x deferred runtime lookup
> was immune to this
> ordering.
> h2. Proposed fix
> Restore deferred, runtime by-name resolution in {{JSONUtil}} (mirrors 7.1.x):
> inject the
> {{Container}} and resolve the writer/reader from the *effective*
> {{struts.json.writer}} /
> {{struts.json.reader}} constant values at injection time, instead of relying
> on the
> build-time default alias.
> * Change is localized to {{JSONUtil}}; {{JSONUtil}} is the only consumer of
> {{JSONWriter}} /
> {{JSONReader}}.
> * Preserves the 7.2.x hardening: {{StrutsJSONWriter}} / {{StrutsJSONReader}}
> remain the shipped
> defaults, and the DoS limits ({{struts.json.maxDepth}}, {{maxElements}},
> {{maxLength}},
> {{maxStringLength}}, {{maxKeyLength}}) are unchanged.
> * Preserves {{prototype}} scope and per-instance resolution — no
> thread-safety regression for
> the stateful bean-info caching.
> h2. Regression test
> Add a test exercising the full bootstrap ({{struts-default.xml}} + the JSON
> plugin's
> {{struts-plugin.xml}} + a user override config, in that order) and assert the
> *effective*
> writer and reader used by {{JSONUtil}} are the overrides — covering both
> {{struts.json.writer}}
> and {{struts.json.reader}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
