[
https://issues.apache.org/jira/browse/WW-5749?focusedWorklogId=1042063&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042063
]
ASF GitHub Bot logged work on WW-5749:
--------------------------------------
Author: ASF GitHub Bot
Created on: 16/Sep/26 17:51
Start Date: 16/Sep/26 17:51
Worklog Time Spent: 10m
Work Description: sonarqubecloud[bot] commented on PR #1959:
URL: https://github.com/apache/struts/pull/1959#issuecomment-5702024656
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1959)
**Quality Gate passed**
Issues
 [0 New
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1959&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1959&issueStatuses=ACCEPTED)
Measures
 [0 Security
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=1959&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [100.0% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1959&metric=new_coverage&view=list)
 [0.0% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1959&metric=new_duplicated_lines_density&view=list)
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1042063)
Time Spent: 0.5h (was: 20m)
> REST XML handlers throw NullPointerException when there is no target to render
> ------------------------------------------------------------------------------
>
> Key: WW-5749
> URL: https://issues.apache.org/jira/browse/WW-5749
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.12.0, 7.4.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> {{JacksonXmlHandler.fromObject}} and {{JuneauXmlHandler.fromObject}}
> dereference the object they are asked to render before checking it:
> {code:java}public String fromObject(ActionInvocation invocation, Object obj,
> String resultCode, Writer stream) throws IOException {
> LOG.debug("Converting an object of {} into string",
> obj.getClass().getName());
> ...
> }
> {code}
> {{RestActionInvocation.selectTarget()}} sets the target to {{null}} for a
> POST, PUT or DELETE that produced no errors while {{restrictToGet}} is
> enabled (the default), and since WW-5718 also for a request an interceptor
> short-circuited with a bare HTTP status ({{fetchMetadata}} returning
> {{403}}). {{DefaultContentTypeHandlerManager.handleResult}} then calls
> {{fromObject}} with that {{null}} target.
> For the JSON handler this is harmless (Jackson writes {{null}}). For the two
> XML handlers it throws a {{NullPointerException}}, which
> {{RestActionInvocation.invoke()}} catches: it sets the response status to
> 500, puts the exception on the value stack and re-runs {{processResult()}},
> so the client receives a serialised {{NullPointerException}} (including its
> stack trace) as the XML body of what was a successful write - or, for the
> status case, as the body of the 403.
> {{XStreamHandler.fromObject}} already guards this with {{if (obj != null)}}.
> The two Jackson/Juneau XML handlers should do the same and write nothing (or
> an empty document) for a {{null}} target.
> Reproduction: a {{rest-default}} action answering a POST with the {{xml}}
> extension under the default {{restrictToGet=true}}; the response is a 500
> with an XML-serialised {{NullPointerException}} instead of the intended
> status with an empty body.
> Found while reviewing WW-5718; not caused by it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
