Lukasz Lenart created WW-5703:
---------------------------------
Summary: HTML5 pattern false-rejects whitespace-only input that
the regex validator accepts
Key: WW-5703
URL: https://issues.apache.org/jira/browse/WW-5703
Project: Struts 2
Issue Type: Bug
Reporter: Lukasz Lenart
Fix For: 7.4.0
Found reviewing WW-5695 (PR #1865). Violates that feature's governing rule:
emit a constraint only when the browser cannot reject input the server would
accept.
h3. What happens
{{StrutsHtmlConstraintProvider.addPattern}} refuses to emit {{pattern}} when
the regex validator has {{trim=true}}, because the server would then match the
trimmed value while the browser matches the raw one. That guard is correct as
far as it goes, but it is not the only trim in {{RegexFieldValidator}}.
{{validateFieldValue}} opens with a blank check that runs _unconditionally_,
regardless of the {{trim}} param:
{code:java}
protected void validateFieldValue(Object object, String value, String
regexToUse) {
// string must not be empty
String str = value.trim();
if (str.isEmpty()) {
LOG.debug("Value is empty, please use a required validator");
return;
}
...
{code}
So the exact configuration in which {{pattern}} _is_ emitted - {{trim=false}},
case-sensitive, portable regex - is also the configuration in which the server
silently accepts a whitespace-only value.
h3. Reproduction
A regex field-validator with {{regex}} of {{^\d{5}$}} and {{trim}} of
{{false}}, on an {{s:textfield}} named {{zip}}, html5 theme,
{{struts.ui.html5.constraints=true}}.
The user types a single space.
* Server: {{" ".trim().isEmpty()}} is true, the validator returns early, no
field error is added, the action executes.
* Browser: the value is non-empty so {{pattern}} applies, the match fails, and
the submit is blocked with "Please match the requested format."
The user cannot get past a field the server would have let through. HTML skips
{{pattern}} for the empty string, but not for whitespace-only input, so there
is no browser-side escape.
h3. Possible closures
* emit {{pattern}} only when the field also carries a {{requiredstring}}
validator, which does reject blank server-side, so the two sides agree again; or
* refuse to emit when the regex cannot itself match a whitespace-only string.
h3. Test gap
{{StrutsHtmlConstraintProviderTest.regexEmitsPatternWhenPortableAndCaseSensitive}}
asserts only that the attribute is produced, so nothing currently catches
this. A case pinning server-side acceptance of a whitespace-only value should
land with the fix.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
