[
https://issues.apache.org/jira/browse/WW-5842?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5842:
------------------------------
Description:
RequestUtils.getServletPath derives the path to map from
HttpServletRequest.getRequestURI() in two cases: when the request URI does not
end with the servlet path reported by the container (WW-2268, to keep a
{{;jsessionid=...}} suffix), and when the container reports an empty servlet
path, as it does for a servlet mapped to {{/*}}. In both cases the value comes
from the raw request URI, so it differs from the servlet path and path info the
container has already decoded: it still carries percent-encoding and path
parameters. {{DefaultActionMapper}} then drops everything after the first
{{;}}, and {{RestActionMapper}} keeps a trailing {{;edit}} to select the edit
method (WW-4585 added the same handling to the {{!method}} form).
Every consumer of the helper afterwards works with the container's view of the
request (action name and namespace, the exclusion patterns, the static resource
lookup, {{<s:include>}} and {{ResourceUtil}}), so the reconstruction is a
second interpretation of the same request that can differ from the container's.
h2. Proposed change
* {{RequestUtils.getServletPath}} returns the servlet path followed by the path
info, both as reported by the container; the request URI is no longer
consulted. {{getUri}} keeps its include-attribute handling.
* {{DefaultActionMapper}} and {{RestActionMapper}} no longer treat {{;}} in the
mapped path specially. On a Servlet 3+ container path parameters never reach
the servlet path or the path info, so {{;jsessionid=...}} needs no handling in
Struts.
* The REST plugin's {{;edit}} form ({{GET /movies/Thrillers;edit}}) is removed.
{{GET /movies/Thrillers/edit}} is the documented equivalent and continues to
work; the plugin documentation drops the {{;edit}} example.
{{RestActionMapper.setEditMethodName}} becomes a deprecated no-op (removal:
WW-5843); {{RestWorkflowInterceptor}} keeps reading
{{struts.mapper.editMethodName}}.
* {{ExecuteOperations}} no longer needs its own path-info fallback for an empty
servlet path.
* The JUnit plugin's {{executeAction}}, {{getActionProxy}} and
{{getActionMapping}} helpers set the servlet path on the mock request as well
as the request URI.
h2. Compatibility
* Applications linking to the REST {{;edit}} form have to switch to {{/edit}}.
* With a servlet mapped to {{/*}} in front of Struts, the action path is now
taken from the decoded path info rather than from the raw request URI.
* Tests that drive Struts with a mock request (for example Spring's
{{MockHttpServletRequest}}) must set the servlet path, not only the request
URI, as a container would; the JUnit plugin helpers do this already.
Same change on the 6.x line.
Reported by Svyatoslav Berestovsky.
was:
RequestUtils.getServletPath derives the path to map from
HttpServletRequest.getRequestURI() in two cases: when the request URI does not
end with the servlet path reported by the container (WW-2268, to keep a
{{;jsessionid=...}} suffix), and when the container reports an empty servlet
path, as it does for a servlet mapped to {{/*}}. In both cases the value comes
from the raw request URI, so it differs from the servlet path and path info the
container has already decoded: it still carries percent-encoding and path
parameters. {{DefaultActionMapper}} then drops everything after the first
{{;}}, and {{RestActionMapper}} keeps a trailing {{;edit}} to select the edit
method (WW-4585 added the same handling to the {{!method}} form).
Every consumer of the helper afterwards works with the container's view of the
request (action name and namespace, the exclusion patterns, the static resource
lookup, {{<s:include>}} and {{ResourceUtil}}), so the reconstruction is a
second interpretation of the same request that can differ from the container's.
h2. Proposed change
* {{RequestUtils.getServletPath}} returns the servlet path followed by the path
info, both as reported by the container; the request URI is no longer
consulted. {{getUri}} keeps its include-attribute handling.
* {{DefaultActionMapper}} and {{RestActionMapper}} no longer treat {{;}} in the
mapped path specially. On a Servlet 3+ container path parameters never reach
the servlet path or the path info, so {{;jsessionid=...}} needs no handling in
Struts.
* The REST plugin's {{;edit}} form ({{GET /movies/Thrillers;edit}}) is removed.
{{GET /movies/Thrillers/edit}} is the documented equivalent and continues to
work; the plugin documentation drops the {{;edit}} example.
* {{ExecuteOperations}} no longer needs its own path-info fallback for an empty
servlet path.
h2. Compatibility
* Applications linking to the REST {{;edit}} form have to switch to {{/edit}}.
* With a servlet mapped to {{/*}} in front of Struts, the action path is now
taken from the decoded path info rather than from the raw request URI.
Same change on the 6.x line.
Reported by Svyatoslav Berestovsky.
> Action mapping should rely on the servlet path and path info reported by the
> container
> --------------------------------------------------------------------------------------
>
> Key: WW-5842
> URL: https://issues.apache.org/jira/browse/WW-5842
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.13.0, 7.5.0
>
>
> RequestUtils.getServletPath derives the path to map from
> HttpServletRequest.getRequestURI() in two cases: when the request URI does
> not end with the servlet path reported by the container (WW-2268, to keep a
> {{;jsessionid=...}} suffix), and when the container reports an empty servlet
> path, as it does for a servlet mapped to {{/*}}. In both cases the value
> comes from the raw request URI, so it differs from the servlet path and path
> info the container has already decoded: it still carries percent-encoding and
> path parameters. {{DefaultActionMapper}} then drops everything after the
> first {{;}}, and {{RestActionMapper}} keeps a trailing {{;edit}} to select
> the edit method (WW-4585 added the same handling to the {{!method}} form).
> Every consumer of the helper afterwards works with the container's view of
> the request (action name and namespace, the exclusion patterns, the static
> resource lookup, {{<s:include>}} and {{ResourceUtil}}), so the reconstruction
> is a second interpretation of the same request that can differ from the
> container's.
> h2. Proposed change
> * {{RequestUtils.getServletPath}} returns the servlet path followed by the
> path info, both as reported by the container; the request URI is no longer
> consulted. {{getUri}} keeps its include-attribute handling.
> * {{DefaultActionMapper}} and {{RestActionMapper}} no longer treat {{;}} in
> the mapped path specially. On a Servlet 3+ container path parameters never
> reach the servlet path or the path info, so {{;jsessionid=...}} needs no
> handling in Struts.
> * The REST plugin's {{;edit}} form ({{GET /movies/Thrillers;edit}}) is
> removed. {{GET /movies/Thrillers/edit}} is the documented equivalent and
> continues to work; the plugin documentation drops the {{;edit}} example.
> {{RestActionMapper.setEditMethodName}} becomes a deprecated no-op (removal:
> WW-5843); {{RestWorkflowInterceptor}} keeps reading
> {{struts.mapper.editMethodName}}.
> * {{ExecuteOperations}} no longer needs its own path-info fallback for an
> empty servlet path.
> * The JUnit plugin's {{executeAction}}, {{getActionProxy}} and
> {{getActionMapping}} helpers set the servlet path on the mock request as well
> as the request URI.
> h2. Compatibility
> * Applications linking to the REST {{;edit}} form have to switch to {{/edit}}.
> * With a servlet mapped to {{/*}} in front of Struts, the action path is now
> taken from the decoded path info rather than from the raw request URI.
> * Tests that drive Struts with a mock request (for example Spring's
> {{MockHttpServletRequest}}) must set the servlet path, not only the request
> URI, as a container would; the JUnit plugin helpers do this already.
> Same change on the 6.x line.
> Reported by Svyatoslav Berestovsky.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
