WW-5688 Resolve id-bearing REST URIs into the root namespace when declared (6.x backport) - #1863
Open
lukaszlenart wants to merge 1 commit into
Open
WW-5688 Resolve id-bearing REST URIs into the root namespace when declared (6.x backport)#1863lukaszlenart wants to merge 1 commit into
lukaszlenart wants to merge 1 commit into
Conversation
…en declared RestActionMapper mapped a URI carrying an id into the default namespace while mapping the same action without an id into "/". Since the configuration only fails over from "/" to "" and never the other way round, an action declared in a package with namespace="/" resolved for index but 404'd for show, update and destroy. DefaultActionMapper already handles this: WW-2461 added a rootAvailable check in June 2008, three months before WW-2820 reported the REST symptom, but the fix was never ported to the mapper the REST plugin had forked earlier. Port it, keeping the ordering that computes the action name while the namespace is still empty, since the name is relative to it. The promotion only fires when a package explicitly declares namespace="/" and nothing more specific matched. Convention derives "" or "/sub" and never "/", so applications that do not opt in are unaffected, and because a "/" lookup already falls back to "", the set of resolvable actions is a superset of the previous one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of PR #1862 to
support/struts-6-x-x, targeting 6.12.0.Fixes WW-5688, split out of the 2008 umbrella WW-2820 (originally reported by Alvin Singh).
The bug
RestActionMappermapped a URI carrying an id into the default namespace, while mapping the same action without an id into/. BecausegetActionConfig()only fails over from/to""and never the other way round, an action declared in a package withnamespace="/"resolved forindexbut 404'd forshow,updateanddestroy.The fix
DefaultActionMapperhas handled this since WW-2461 (June 2008) via arootAvailablecheck — three months before WW-2820 reported the REST symptom. It was never ported to the copy ofparseNameAndNamespace()the REST plugin forked earlier. This ports it, keeping the ordering that computes the action name while the namespace is still empty, since the name is a substring relative to it.The production change is byte-identical to the one on
main—parseNameAndNamespace()had not diverged between the two branches. The only backport-specific edit is the new test's import (com.opensymphony.xwork2.XWorkTestCaseinstead of theorg.apache.struts2one).Verified against this branch, not assumed from main
Each claim was re-checked here rather than carried over:
show/update/destroyfail whileindexand id-extraction pass — the same 3 failures as onmain. Restoring the fix turns them green.DefaultConfiguration.shouldFallbackToEmptyNamespacehere has the same one-way/→""behaviour (core/.../DefaultConfiguration.java:605), which is what makes the wrong namespace a dead end rather than a soft miss.""or/suband never/, so it cannot trigger the promotion on its own, andapps/rest-showcasedeclares no namespace on its package — unaffected.Blast radius
The promotion fires only when a package explicitly declares
namespace="/"and nothing more specific matched. Because a/lookup already falls back to"", the set of resolvable actions is a strict superset of the previous one — nothing that resolved before stops resolving. No change to core, no new configuration surface.Tests
Full rest plugin suite on this branch: 80 tests, 0 failures.
Not a security fix
This makes actions less reachable rather than more, and aligning
/dog/1with what/dogalready resolves to exposes no surface the/dogpath does not already expose.🤖 Generated with Claude Code