Melloware created MYFACES-4779:
----------------------------------
Summary: Quarkus: Register SecurityPrincipal and Collections for
reflection
Key: MYFACES-4779
URL: https://issues.apache.org/jira/browse/MYFACES-4779
Project: MyFaces Core
Issue Type: Bug
Affects Versions: 4.1.4, 5.0.0
Reporter: Melloware
1. Principal (#{request.userPrincipal.name})
- The extension already registers Undertow's HttpServletRequestImpl for
#{request}. So request.userPrincipal and request.isUserInRole(...) should
resolve, and the likely failure is the last step: .name on the Principal class.
That class is QuarkusPrincipal for form login, and a JWT principal class such
as OidcJwtCallerPrincipal for OIDC.
- Suggested upstream fix: add
classNames.addAll(collectImplementors(combinedIndex,
java.security.Principal.class.getName())). This uses the same helper they
already use for Converter, Validator and others. Quarkus extension JARs are
indexed, so this picks up the Quarkus principal classes automatically.
- Caveat: I didn't isolate this in a native run. I changed all three servlet
expressions together, so ".name is what fails" is inferred from what the
extension registers, not observed.
2. JDK immutable collections (#{demoUsers.users.size()})
- This one is confirmed: the stack trace said MethodNotFoundException:
ImmutableCollections$List12.size().
- The extension does try to cover collections with
collectImplementors(combinedIndex, Collection). But the Jandex index doesn't
contain JDK classes, so the private classes behind List.of(), Set.of(),
Map.of() and stream().toList() are never found. Every Quarkus app that hands a
List.of(...) to EL and calls a method on it will hit this.
- Suggested upstream fix: register those classes by name. There's already a
precedent in that method: classNames.add("java.util.Collections$EmptySet"). The
list would be java.util.ImmutableCollections$List12, $ListN, $SubList, $Set12,
$SetN, $Map1 and $MapN, plus probably java.util.Arrays$ArrayList and the
Collections$Unmodifiable* wrappers.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
