[
https://issues.apache.org/jira/browse/WW-3717?focusedWorklogId=1047868&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1047868
]
ASF GitHub Bot logged work on WW-3717:
--------------------------------------
Author: ASF GitHub Bot
Created on: 16/Oct/26 14:44
Start Date: 16/Oct/26 14:44
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #2038:
URL: https://github.com/apache/struts/pull/2038
Fixes [WW-3717](https://issues.apache.org/jira/browse/WW-3717)
## Summary
- New optional `http-method` attribute on `<action>` in `struts-7.5.dtd`,
e.g. `http-method="post"` or `http-method="get,post"` (case-insensitive). An
unknown method name fails configuration loading.
- Enforced by `HttpMethodInterceptor`, which now reads the action config as
well as the existing `@HttpGet`/`@HttpPost`/`@AllowedHttpMethod`… annotations.
When both apply, the request must satisfy both.
- Wildcard / regex actions keep the restriction declared on the pattern
(`ActionConfigMatcher`).
- A rejected request still gets the `bad-request` result when one can be
resolved — exact name, a catch-all `*` result, or an unknown handler such as
the Convention plugin. Otherwise the interceptor answers **405 with an `Allow`
header** and returns `NONE`, instead of failing with "No result defined".
- A warning is logged at startup for an action that declares `http-method`
while its interceptors do not include `httpMethod`.
One action name still maps to one config; routing the same name to different
configs per method is [WW-5785](https://issues.apache.org/jira/browse/WW-5785)
(8.0.0). Convention-plugin coverage via the annotations is verified in
[WW-5786](https://issues.apache.org/jira/browse/WW-5786).
## Behaviour changes worth a migration note
- Annotation-only actions with no resolvable `bad-request` result now get
405 + `Allow` instead of a 500. Request methods outside `HttpMethod` (e.g.
`PROPFIND`) on restricted actions now get 405 instead of an
`IllegalArgumentException`.
- Unit tests that build `HttpMethodInterceptor` by hand must inject it
(`container.inject(...)`, it now needs `UnknownHandlerManager`) and give
`MockActionProxy` an `ActionConfig`, since the config is read on every request.
This is deliberately not null-guarded.
- The existing `testWildcardResolvedExecuteRejectsGetThroughRealProxy` now
asserts 405 + `Allow: POST`: its fixture maps no `bad-request` result.
## Test plan
- [x] New `XmlConfigurationProviderHttpMethodTest` (parsing, list/case
handling, wildcard carry-over, invalid value, startup warning) and new
`HttpMethodInterceptorTest` cases (config only, annotation only, both, mapped /
global / catch-all / unknown-handler results, 405 + `Allow`, unknown request
method) — each watched failing before the implementation
- [x] Mutations checked: dropping the matcher copy, an exact-name-only
result check, and config overriding the annotation each fail their tests
- [x] `./mvnw test -DskipAssembly -pl core` — 3510 tests, 0 failures
- [x] `./mvnw test -DskipAssembly -DskipITs` (full reactor) — BUILD SUCCESS
Docs: struts-site PR follows (new "HTTP Methods" section in Action
Configuration).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1047868)
Remaining Estimate: 0h
Time Spent: 10m
> Allow restricting an action to HTTP methods via an http-method attribute in
> struts.xml
> --------------------------------------------------------------------------------------
>
> Key: WW-3717
> URL: https://issues.apache.org/jira/browse/WW-3717
> Project: Struts 2
> Issue Type: New Feature
> Components: Dispatch Filter, XML Configuration
> Environment: All
> Reporter: Jeremy Norman
> Priority: Major
> Labels: restful
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Allow an action declared in {{struts.xml}} to restrict which HTTP methods it
> accepts, using a new optional {{http-method}} attribute in the 7.5 DTD. This
> is the XML counterpart of the existing {{@HttpGet}} / {{@HttpPost}} /
> {{@AllowedHttpMethod}} annotations.
> {code:xml}<action name="action1" class="org.example.ListAction"
> http-method="get"> ...
> <action name="action2" class="org.example.SaveAction" http-method="post"> ...
> <action name="action3" class="org.example.FormAction" http-method="get,post">
> ...
> {code}
> A request using a method that is not listed is rejected by
> {{HttpMethodInterceptor}} with its configured bad-request result, the same
> way as for the annotations.
> Scope:
> * one action name maps to one action config; declaring the same action name
> twice with different methods is *not* supported here
> * enforced by {{HttpMethodInterceptor}}, which reads the action config in
> addition to the annotations; when both are present the request must satisfy
> both
> * the attribute is carried over to actions resolved from wildcard / regex
> patterns
> * an invalid method name fails configuration loading
> Routing the same action name to different action configs depending on the
> HTTP method is tracked in WW-5785 (8.0.0).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
