Lukasz Lenart created WW-5749:
---------------------------------
Summary: REST XML handlers throw NullPointerException when there
is no target to render
Key: WW-5749
URL: https://issues.apache.org/jira/browse/WW-5749
Project: Struts 2
Issue Type: Bug
Components: Plugin - REST
Reporter: Lukasz Lenart
{{JacksonXmlHandler.fromObject}} and {{JuneauXmlHandler.fromObject}}
dereference the object they are asked to render before checking it:
{code:java}public String fromObject(ActionInvocation invocation, Object obj,
String resultCode, Writer stream) throws IOException {
LOG.debug("Converting an object of {} into string",
obj.getClass().getName());
...
}
{code}
{{RestActionInvocation.selectTarget()}} sets the target to {{null}} for a POST,
PUT or DELETE that produced no errors while {{restrictToGet}} is enabled (the
default), and since WW-5718 also for a request an interceptor short-circuited
with a bare HTTP status ({{fetchMetadata}} returning {{403}}).
{{DefaultContentTypeHandlerManager.handleResult}} then calls {{fromObject}}
with that {{null}} target.
For the JSON handler this is harmless (Jackson writes {{null}}). For the two
XML handlers it throws a {{NullPointerException}}, which
{{RestActionInvocation.invoke()}} catches: it sets the response status to 500,
puts the exception on the value stack and re-runs {{processResult()}}, so the
client receives a serialised {{NullPointerException}} (including its stack
trace) as the XML body of what was a successful write - or, for the status
case, as the body of the 403.
{{XStreamHandler.fromObject}} already guards this with {{if (obj != null)}}.
The two Jackson/Juneau XML handlers should do the same and write nothing (or an
empty document) for a {{null}} target.
Reproduction: a {{rest-default}} action answering a POST with the {{xml}}
extension under the default {{restrictToGet=true}}; the response is a 500 with
an XML-serialised {{NullPointerException}} instead of the intended status with
an empty body.
Found while reviewing WW-5718; not caused by it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
