lukaszlenart commented on PR #1890: URL: https://github.com/apache/struts/pull/1890#issuecomment-5630574434
Sorry for the delay — yes, that direction addresses all of it. Please go ahead. Resolving the Dispatcher from the current request's `ServletContext` is the right key: `Dispatcher.getInstance(ServletContext)` (`Dispatcher.java:280`) reads the `SERVLET_DISPATCHER` attribute, which is per-webapp and cleared on cleanup, so no static state is involved and a neighbouring application can't opt this one in. Constructing the raw evaluator lazily and only after that check keeps the `OgnlRuntime.setPropertyAccessor(Request.class, ...)` mutation off the default path, which was the main thing. Public constructors for the explicit opt-in cover the custom-initializer case. Two small things while you're in there: - Resolve the flag once per evaluator instance and hold the result, rather than looking it up from the container on every evaluation. The constant can't change at runtime, and there is one evaluator per Tiles container, so caching the decision is safe and avoids a container lookup per rendered attribute. - `ServletUtil.getServletRequest(request)` throws `NotAServletEnvironmentException` for a non-servlet `Request`. Treat that the same as "no Dispatcher": fail closed with the migration message, not a stack trace from the lookup. A separate PR for `support/struts-6-x-x` afterwards is fine — plain `@Deprecated` there, as discussed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
