This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new c1fdc50916 Fixed: Do not evaluate the expand/collapse link of tree
widgets as an expression (OFBIZ-13639)
c1fdc50916 is described below
commit c1fdc509164a3c4755ec74d3f7d25f1fa577b8d2
Author: Mridul Pathak <[email protected]>
AuthorDate: Sat Oct 3 22:36:54 2026 +0530
Fixed: Do not evaluate the expand/collapse link of tree widgets as an
expression (OFBIZ-13639)
When a tree widget has no expand-collapse-request,
ModelTree.getExpandCollapseRequest builds the link target from the request URI,
and the tree renderers hand it to the ModelTree.ModelNode.Link constructor,
which parsed it again as a FlexibleStringExpander, so that request data was
evaluated as an expression. The trail parameter that MacroTreeRenderer adds to
the link, which also comes from the request, was parsed the same way.
FlexibleStringExpander.getLiteral returns an instance that never parses its
text. The Link constructors that take plain strings, used only by the tree
renderers, now use it for the style, target and text, and the new
CommonWidgetModels.Parameter.literal does the same for the trail parameter. The
Link constructor that reads the XML element still evaluates expressions.
(cherry picked from commit d6639a8d6fafc3e1face406c8e39e01ac7a870b2)
---
.../ofbiz/base/util/string/FlexibleStringExpander.java | 15 +++++++++++++++
.../org/apache/ofbiz/widget/model/CommonWidgetModels.java | 13 +++++++++++++
.../java/org/apache/ofbiz/widget/model/ModelTree.java | 8 +++++---
.../ofbiz/widget/renderer/macro/MacroTreeRenderer.java | 4 ++--
4 files changed, 35 insertions(+), 5 deletions(-)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
index dc4166806f..c041a619a9 100644
---
a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
+++
b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/FlexibleStringExpander.java
@@ -169,6 +169,21 @@ public abstract class FlexibleStringExpander implements
Serializable, IsEmpty {
return fse.expandString(context, timeZone, locale);
}
+ /** Returns a <code>FlexibleStringExpander</code> object that always
evaluates to the given text, which is never
+ * parsed: <code>${...}</code> in it is not an expression. Use this for
values that were computed or come from a request,
+ * and so must not be evaluated as an expression. A null or empty argument
will return an object that represents an
+ * empty expression.
+ *
+ * @param text The text the returned object evaluates to
+ * @return A <code>FlexibleStringExpander</code> instance
+ */
+ public static FlexibleStringExpander getLiteral(String text) {
+ if (UtilValidate.isEmpty(text)) {
+ return NULL_EXPR;
+ }
+ return new ConstSimpleElem(text.toCharArray());
+ }
+
/** Returns a <code>FlexibleStringExpander</code> object. <p>A null or
* empty argument will return a <code>FlexibleStringExpander</code>
* object that represents an empty expression. That object is a shared
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
index 698434ce1e..bcee048d79 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/CommonWidgetModels.java
@@ -696,6 +696,19 @@ public final class CommonWidgetModels {
}
}
+ /**
+ * Creates a parameter whose value is taken literally and never
evaluated as an expression, for values that were
+ * computed or come from a request.
+ * @param paramName the name of the parameter
+ * @param paramValue the value of the parameter
+ * @return the parameter
+ */
+ public static Parameter literal(String paramName, String paramValue) {
+ Parameter parameter = new Parameter(paramName, "", false);
+ parameter.value = FlexibleStringExpander.getLiteral(paramValue);
+ return parameter;
+ }
+
/**
* Gets from field.
* @return the from field
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
index be72c0ad9d..b67188930c 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ModelTree.java
@@ -1087,6 +1087,8 @@ public class ModelTree extends ModelWidget {
// FIXME: Something to be replaced by a builder class, but allows
us to quickly
// build Links to represent nodes with parameters in a tree,
rather that trying
// to encode the parameters early in the link's target.
+ // The style, target and text are computed by the renderer, and
the target comes from the request,
+ // so they are taken literally and never evaluated as an
expression.
public Link(String style, String target, String text,
List<Parameter> parameterList) {
this.encode = false;
this.fullPath = false;
@@ -1097,10 +1099,10 @@ public class ModelTree extends ModelWidget {
this.parameterList = parameterList != null ?
Collections.unmodifiableList(parameterList) : Collections.emptyList();
this.prefixExdr = FlexibleStringExpander.getInstance("");
this.secure = false;
- this.styleExdr = FlexibleStringExpander.getInstance(style);
- this.targetExdr = FlexibleStringExpander.getInstance(target);
+ this.styleExdr = FlexibleStringExpander.getLiteral(style);
+ this.targetExdr = FlexibleStringExpander.getLiteral(target);
this.targetWindowExdr = FlexibleStringExpander.getInstance("");
- this.textExdr = FlexibleStringExpander.getInstance(text);
+ this.textExdr = FlexibleStringExpander.getLiteral(text);
this.titleExdr = FlexibleStringExpander.getInstance("");
this.urlMode = "intra-app";
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
index 49edbc32b4..0a6c002000 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
@@ -171,7 +171,7 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
StringBuilder target = new
StringBuilder(node.getModelTree().getExpandCollapseRequest(context));
String trailName =
node.getModelTree().getTrailName(context);
expandCollapseLink = new
ModelTree.ModelNode.Link("collapsed", target.toString(), " ",
- ImmutableList.of(new
CommonWidgetModels.Parameter(trailName, currentNodeTrailPiped, false)));
+
ImmutableList.of(CommonWidgetModels.Parameter.literal(trailName,
currentNodeTrailPiped)));
}
} else {
context.put("processChildren", Boolean.TRUE);
@@ -183,7 +183,7 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
StringBuilder target = new
StringBuilder(node.getModelTree().getExpandCollapseRequest(context));
String trailName = node.getModelTree().getTrailName(context);
expandCollapseLink = new ModelTree.ModelNode.Link("expanded",
target.toString(), " ",
- ImmutableList.of(new
CommonWidgetModels.Parameter(trailName, currentNodeTrailPiped, false)));
+
ImmutableList.of(CommonWidgetModels.Parameter.literal(trailName,
currentNodeTrailPiped)));
// add it so it can be remove in renderNodeEnd
currentNodeTrail.add(lastContentId);
}
