[
https://issues.apache.org/jira/browse/WW-5749?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart resolved WW-5749.
-------------------------------
Resolution: Fixed
> REST XML handlers throw NullPointerException when there is no target to render
> ------------------------------------------------------------------------------
>
> Key: WW-5749
> URL: https://issues.apache.org/jira/browse/WW-5749
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.12.0, 7.4.0
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> {{JacksonXmlHandler.fromObject}} and {{JuneauXmlHandler.fromObject}}
> dereference the object they are asked to render before checking it:
> {code:java}public String fromObject(ActionInvocation invocation, Object obj,
> String resultCode, Writer stream) throws IOException {
> LOG.debug("Converting an object of {} into string",
> obj.getClass().getName());
> ...
> }
> {code}
> {{RestActionInvocation.selectTarget()}} sets the target to {{null}} for a
> POST, PUT or DELETE that produced no errors while {{restrictToGet}} is
> enabled (the default), and since WW-5718 also for a request an interceptor
> short-circuited with a bare HTTP status ({{fetchMetadata}} returning
> {{403}}). {{DefaultContentTypeHandlerManager.handleResult}} then calls
> {{fromObject}} with that {{null}} target.
> For the JSON handler this is harmless (Jackson writes {{null}}). For the two
> XML handlers it throws a {{NullPointerException}}, which
> {{RestActionInvocation.invoke()}} catches: it sets the response status to
> 500, puts the exception on the value stack and re-runs {{processResult()}},
> so the client receives a serialised {{NullPointerException}} (including its
> stack trace) as the XML body of what was a successful write - or, for the
> status case, as the body of the 403.
> {{XStreamHandler.fromObject}} already guards this with {{if (obj != null)}}.
> The two Jackson/Juneau XML handlers should do the same and write nothing (or
> an empty document) for a {{null}} target.
> Reproduction: a {{rest-default}} action answering a POST with the {{xml}}
> extension under the default {{restrictToGet=true}}; the response is a 500
> with an XML-serialised {{NullPointerException}} instead of the intended
> status with an empty body.
> Found while reviewing WW-5718; not caused by it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
