Lukasz Lenart created WW-5787:
---------------------------------
Summary: Run execAndWait background processes in an isolated
sandbox
Key: WW-5787
URL: https://issues.apache.org/jira/browse/WW-5787
Project: Struts 2
Issue Type: Improvement
Components: Core Interceptors
Reporter: Lukasz Lenart
Fix For: 8.0.0
Follow-up to WW-3576.
In 7.5.0, WW-3576 gives the {{execAndWait}} background process a sandboxed
session: a snapshot taken when the process starts, whose writes are reconciled
into the real session by the polling request that sees the process finish
(dropped if the session id changed; conflicts resolved per action through an
Aware interface).
The sandbox is not enforced. The background thread still binds the original
request's {{ActionContext}}, and its value stack's OGNL context is that same
map. So OGNL {{#session}} and
{{invocation.getInvocationContext().getSession()}} reach the request's session
map and write to the live session immediately. In 7.5.0 these escapes only log
a warning.
h2. Proposal
Rewrite the {{execAndWait}} mechanism so a background process runs in a real
sandbox:
* its own {{ActionContext}} and value stack, not shared with the request thread
that started it
* every session access path sees only the sandboxed session
* writes that bypass the sandbox fail instead of warning
* no reference to the original request or response from the background thread
This is a behaviour change for applications that rely on writing through
{{#session}} from background code, hence 8.0.0.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
