Lukasz Lenart created WW-5718:
---------------------------------
Summary: Plugin-provided default interceptor stacks omit the
resource-isolation interceptors
Key: WW-5718
URL: https://issues.apache.org/jira/browse/WW-5718
Project: Struts 2
Issue Type: Improvement
Reporter: Lukasz Lenart
Fix For: 7.4.0, 6.12.0
{{WW-5083}} added the Fetch Metadata resource-isolation interceptor to core's
{{defaultStack}} in 6.0.0, alongside {{coop}} and {{coep}}. All three are
declared enabled in {{core/src/main/resources/struts-default.xml}}:
{code}<interceptor-ref name="coep">
<param name="disabled">false</param>
...
<interceptor-ref name="coop">
<param name="disabled">false</param>
...
<interceptor-ref name="fetchMetadata">
<param name="disabled">false</param>
</interceptor-ref>
{code}
Two bundled plugins replace {{defaultStack}} wholesale with their own stack and
set it as the package default. Both stacks were forked from {{defaultStack}}
before {{WW-5083}} and were never updated, so neither carries any of the three
interceptors:
* {{plugins/rest/src/main/resources/struts-plugin.xml}} — {{restDefaultStack}},
installed via {{<default-interceptor-ref name="restDefaultStack"/>}}
* {{plugins/bean-validation/src/main/resources/struts-plugin.xml}} —
{{beanValidationDefaultStack}}, installed via {{<default-interceptor-ref
name="beanValidationDefaultStack"/>}}
The result is that an action package extending {{rest-default}} or
{{bean-validation-default}} silently loses the cross-origin request filtering
and the COOP/COEP response headers that an otherwise identical
{{struts-default}} package gets by default. Nothing in the configuration
signals the difference, and the omission is not the outcome of a decision
recorded anywhere — the interceptors simply post-date the forks.
{{config-browser}}'s {{configBrowserDefault}} delegates to
{{validationWorkflowStack}}, which derives from {{defaultStack}}, so it is
unaffected.
h3. Proposed change
Add {{coep}}, {{coop}} and {{fetchMetadata}} to {{restDefaultStack}} and
{{beanValidationDefaultStack}}, with the same parameters {{defaultStack}} uses,
positioned as they are in {{defaultStack}}.
h3. Notes
* Affects 6.x and 7.x alike: {{WW-5083}} shipped in 6.0.0, and both plugin
stacks lack the interceptors on {{main}} and on {{support/struts-6-x-x}}.
* This is a behaviour change for existing REST and Bean Validation deployments:
{{fetchMetadata}} rejects requests whose {{Sec-Fetch-Site}} marks them
cross-site, so a REST API deliberately serving cross-origin browser clients
will start seeing 403s unless it configures {{exemptedPaths}} or disables the
interceptor. It should be called out in the migration notes.
* The wider point is structural: a plugin that replaces {{defaultStack}}
inherits nothing from it afterwards, so every future addition to
{{defaultStack}} has to be mirrored by hand into each fork. Worth considering
whether these stacks can extend the core stack rather than restate it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
