[
https://issues.apache.org/jira/browse/WW-5821?focusedWorklogId=1051155&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051155
]
ASF GitHub Bot logged work on WW-5821:
--------------------------------------
Author: ASF GitHub Bot
Created on: 29/Oct/26 10:24
Start Date: 29/Oct/26 10:24
Worklog Time Spent: 10m
Work Description: M0nd0R commented on PR #2043:
URL: https://github.com/apache/struts/pull/2043#issuecomment-6494141016
Thanks for filing WW-5821 and for running the tests. Done: the PR is
retitled, both commit messages are prefixed with `WW-5821` (branch
force-pushed; the code is unchanged), and the description now has the `Fixes`
line and describes the final behaviour.
Issue Time Tracking
-------------------
Worklog Id: (was: 1051155)
Remaining Estimate: 0h
Time Spent: 10m
> HttpMethodInterceptor raises IllegalArgumentException for an unknown HTTP
> method on an HttpMethodAware action
> -------------------------------------------------------------------------------------------------------------
>
> Key: WW-5821
> URL: https://issues.apache.org/jira/browse/WW-5821
> Project: Struts 2
> Issue Type: Bug
> Components: Core Interceptors
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> When an action implements {{HttpMethodAware}}, {{HttpMethodInterceptor}}
> converts the request method with {{HttpMethod.parse()}}, which calls
> {{valueOf()}} with no fallback. A request method outside the enum constants,
> such as {{PROPFIND}}, {{MKCOL}} or {{REPORT}}, raises
> {{IllegalArgumentException}} before the allowed-method checks run, so the
> client gets a 500 instead of the configured rejection.
> h2. Steps to reproduce
> # Define an action that implements {{HttpMethodAware}} and restricts methods,
> for example with {{@AllowedHttpMethod(POST)}} or {{http-method="POST"}}.
> # Send {{PROPFIND}} to that action.
> h2. Expected
> The request is rejected like any other disallowed method: the bad-request
> result, or {{405 Method Not Allowed}} with an {{Allow}} header when no such
> result is mapped.
> h2. Actual
> {code}java.lang.IllegalArgumentException: No enum constant
> org.apache.struts2.interceptor.httpmethod.HttpMethod.PROPFIND
> at java.base/java.lang.Enum.valueOf(Enum.java:273)
> at
> org.apache.struts2.interceptor.httpmethod.HttpMethod.parse(HttpMethod.java:40)
> {code}
> h2. Proposed change
> Add {{HttpMethod.parseOrNull()}}, a case-insensitive lookup that returns
> {{null}} for an unknown method. The interceptor passes that value to
> {{HttpMethodAware.setMethod()}}, documented as {{null}} for an unknown
> method, and falls through to the existing allowed-method check. {{parse()}}
> switches to {{Locale.ROOT}}, and {{XmlDocConfigurationProvider}} uses it for
> the {{http-method}} attribute.
> Pull request: [apache/struts#2043|https://github.com/apache/struts/pull/2043]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
