Lukasz Lenart created WW-5765:
---------------------------------
Summary: ExecuteAndWaitInterceptor re-stores the transaction token
from request parameters instead of the token validated in the request
Key: WW-5765
URL: https://issues.apache.org/jira/browse/WW-5765
Project: Struts 2
Issue Type: Bug
Components: Core Interceptors
Reporter: Lukasz Lenart
Fix For: 7.5.0, 6.13.0
{{ExecuteAndWaitInterceptor}} puts a transaction token back into the session
every time it returns the wait result. It reads the {{token}} request parameter
as the value and the {{struts.token.name}} request parameter as the name, and
passes both to {{TokenHelper.setSessionToken(...)}}.
This was added in WW-1741 so that an action using both {{token}} and
{{execAndWait}} keeps accepting its wait-page refreshes after
{{TokenInterceptor}} has consumed the token. The interceptor does not check
that a token was validated in the current request, though, so it stores
whatever name and value any request supplies, including requests to an
execAndWait action that has no token check at all, such as one using the
shipped {{executeAndWaitStack}}.
The session token store is otherwise written only with server-generated values:
the token tag calls {{TokenHelper.setToken}}, which generates a random GUID. A
later {{TokenHelper.validToken()}} accepts whatever value is in the store, so a
value taken from request parameters is treated the same as one the server
generated.
The value and the name are also read inconsistently: the value always comes
from the default {{token}} parameter, while the name comes from
{{struts.token.name}}.
h2. Change
* {{TokenHelper.validToken()}} records the token name and value it accepted in
the current {{ActionContext}}.
* {{ExecuteAndWaitInterceptor}} re-stores only that recorded pair, and stores
nothing when no token was validated in the current request.
* {{ExecuteAndWaitInterceptor}} no longer reads the token from request
parameters.
h2. Tests
* An execAndWait action without a token interceptor returns the wait result and
leaves the session token store unchanged, for any token name supplied in the
request.
* An action using {{token}} and {{execAndWait}} keeps accepting the wait-page
refresh that carries the validated token.
* The same holds with {{tokenSession}} in place of {{token}}.
Apply the same change on the 6.x line.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
