Lukasz Lenart created WW-5683:
---------------------------------
Summary: Migrate tests off the deprecated SecurityMemberAccess
configuration setters
Key: WW-5683
URL: https://issues.apache.org/jira/browse/WW-5683
Project: Struts 2
Issue Type: Improvement
Reporter: Lukasz Lenart
WW-5675 moved OGNL security configuration parsing into a container-singleton
bean, {{SecurityMemberAccessConfig}}, and deprecated the eleven configuration
setters left on {{SecurityMemberAccess}} with {{@Deprecated(since = "7.4.0",
forRemoval = true)}}.
Roughly 110 call sites across {{core}} and the {{spring}} and {{cdi}} plugins
still call those setters directly — almost all in tests, to construct a
{{SecurityMemberAccess}} in a particular configuration without going through a
container. Because the annotation carries {{forRemoval = true}}, every one of
them now trips SonarCloud rule {{java:S5738}} ("Remove this call to a
deprecated method, it has been marked for removal").
On the WW-5675 pull request that is _69 new Sonar issues_, 67 of them in
{{SecurityMemberAccessTest}} alone. The quality gate still passes, but the
noise is real and it will persist on every subsequent PR that touches these
files.
h2. Scope
Migrate the call sites to configure a {{SecurityMemberAccessConfig}} and inject
it via {{useConfig}}, rather than calling the deprecated setters on the
instance.
Affected files, by issue count on the WW-5675 PR:
* {{core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessTest.java}}
— 67
*
{{core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigSharingTest.java}}
— 1
*
{{core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessPackageMatchingTest.java}}
— 1
Plus the direct {{new SecurityMemberAccess(null, null)}} constructions in
{{plugins/spring}} and {{plugins/cdi}} proxy tests, which do not currently trip
the rule but follow the same pattern.
h2. Notes
Two behaviours must survive the migration:
* {{useAllowStaticFieldAccess(false)}} has a side effect — it also adds
{{java.lang.Class}} to the excluded classes.
* The excluded-set setters accumulate onto the current value rather than
assigning. That commutativity is what makes them safe against the container's
unspecified {{getDeclaredMethods()}} injection order, and
{{SecurityMemberAccessConfigTest.setterOrderDoesNotAffectExcludedClasses}} pins
it.
At least one test must keep exercising the deprecated setters themselves while
they still exist, so that their retained per-instance semantics stay covered —
that is what
{{SecurityMemberAccessConfigSharingTest.testDeprecatedSetterDoesNotLeakToSiblings}}
does today.
This is a test-only refactor with no production impact, so it can land in any
7.x release. It is prerequisite work for WW-5682, which deletes the setters in
8.0.0.
h2. Related
* WW-5675 — deprecated the setters
* WW-5682 — removes them in 8.0.0
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
