Lukasz Lenart created WW-5786:
---------------------------------
Summary: Verify HTTP method restrictions for Convention plugin
actions
Key: WW-5786
URL: https://issues.apache.org/jira/browse/WW-5786
Project: Struts 2
Issue Type: Task
Components: Plugin - Convention
Reporter: Lukasz Lenart
Fix For: 7.5.0
Follow-up to WW-3717, which adds an {{http-method}} attribute to {{<action>}}
in {{struts.xml}}, enforced by {{HttpMethodInterceptor}}, with a 405 response
(and an {{Allow}} header) when no {{bad-request}} result is mapped.
Actions discovered by the Convention plugin have no XML declaration, so they
cannot use the new attribute. The expectation is that they are already covered
by the existing annotations ({{@HttpGet}}, {{@HttpPost}}, {{@HttpPut}},
{{@HttpDelete}}, {{@HttpGetOrPost}}, {{@AllowedHttpMethod}}) on the action
class or method.
Verify this and pick one outcome:
* *Covered:* add tests in the Convention plugin that pin it: an annotated
Convention action (class-level and method-level, including an
{{@Action}}-mapped method) rejects a disallowed method with the mapped
{{bad-request}} result, or with 405 + {{Allow}} when none is mapped, and
accepts an allowed one.
* *Gap confirmed:* document what is missing (for example, a case the
annotations cannot express for Convention actions) and open a New Feature
ticket at 8.0.0 for an {{@Action(httpMethod = ...)}} style attribute, linking
it here.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
