Lukasz Lenart created WW-5842:
---------------------------------
Summary: Action mapping should rely on the servlet path and path
info reported by the container
Key: WW-5842
URL: https://issues.apache.org/jira/browse/WW-5842
Project: Struts 2
Issue Type: Bug
Components: Core
Reporter: Lukasz Lenart
Fix For: 7.5.0, 6.13.0
RequestUtils.getServletPath derives the path to map from
HttpServletRequest.getRequestURI() in two cases: when the request URI does not
end with the servlet path reported by the container (WW-2268, to keep a
{{;jsessionid=...}} suffix), and when the container reports an empty servlet
path, as it does for a servlet mapped to {{/*}}. In both cases the value comes
from the raw request URI, so it differs from the servlet path and path info the
container has already decoded: it still carries percent-encoding and path
parameters. {{DefaultActionMapper}} then drops everything after the first
{{;}}, and {{RestActionMapper}} keeps a trailing {{;edit}} to select the edit
method (WW-4585 added the same handling to the {{!method}} form).
Every consumer of the helper afterwards works with the container's view of the
request (action name and namespace, the exclusion patterns, the static resource
lookup, {{<s:include>}} and {{ResourceUtil}}), so the reconstruction is a
second interpretation of the same request that can differ from the container's.
h2. Proposed change
* {{RequestUtils.getServletPath}} returns the servlet path followed by the path
info, both as reported by the container; the request URI is no longer
consulted. {{getUri}} keeps its include-attribute handling.
* {{DefaultActionMapper}} and {{RestActionMapper}} no longer treat {{;}} in the
mapped path specially. On a Servlet 3+ container path parameters never reach
the servlet path or the path info, so {{;jsessionid=...}} needs no handling in
Struts.
* The REST plugin's {{;edit}} form ({{GET /movies/Thrillers;edit}}) is removed.
{{GET /movies/Thrillers/edit}} is the documented equivalent and continues to
work; the plugin documentation drops the {{;edit}} example.
* {{ExecuteOperations}} no longer needs its own path-info fallback for an empty
servlet path.
h2. Compatibility
* Applications linking to the REST {{;edit}} form have to switch to {{/edit}}.
* With a servlet mapped to {{/*}} in front of Struts, the action path is now
taken from the decoded path info rather than from the raw request URI.
Same change on the 6.x line.
Reported by Svyatoslav Berestovsky.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
