[
https://issues.apache.org/jira/browse/WW-5683?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5683:
------------------------------
Fix Version/s: 7.4.0
> Migrate tests off the deprecated SecurityMemberAccess configuration setters
> ---------------------------------------------------------------------------
>
> Key: WW-5683
> URL: https://issues.apache.org/jira/browse/WW-5683
> Project: Struts 2
> Issue Type: Improvement
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.4.0
>
>
> WW-5675 moved OGNL security configuration parsing into a container-singleton
> bean, {{SecurityMemberAccessConfig}}, and deprecated the eleven configuration
> setters left on {{SecurityMemberAccess}} with {{@Deprecated(since = "7.4.0",
> forRemoval = true)}}.
> Roughly 110 call sites across {{core}} and the {{spring}} and {{cdi}} plugins
> still call those setters directly — almost all in tests, to construct a
> {{SecurityMemberAccess}} in a particular configuration without going through
> a container. Because the annotation carries {{forRemoval = true}}, every one
> of them now trips SonarCloud rule {{java:S5738}} ("Remove this call to a
> deprecated method, it has been marked for removal").
> On the WW-5675 pull request that is _69 new Sonar issues_, 67 of them in
> {{SecurityMemberAccessTest}} alone. The quality gate still passes, but the
> noise is real and it will persist on every subsequent PR that touches these
> files.
> h2. Scope
> Migrate the call sites to configure a {{SecurityMemberAccessConfig}} and
> inject it via {{useConfig}}, rather than calling the deprecated setters on
> the instance.
> Affected files, by issue count on the WW-5675 PR:
> *
> {{core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessTest.java}}
> — 67
> *
> {{core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigSharingTest.java}}
> — 1
> *
> {{core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessPackageMatchingTest.java}}
> — 1
> Plus the direct {{new SecurityMemberAccess(null, null)}} constructions in
> {{plugins/spring}} and {{plugins/cdi}} proxy tests, which do not currently
> trip the rule but follow the same pattern.
> h2. Notes
> Two behaviours must survive the migration:
> * {{useAllowStaticFieldAccess(false)}} has a side effect — it also adds
> {{java.lang.Class}} to the excluded classes.
> * The excluded-set setters accumulate onto the current value rather than
> assigning. That commutativity is what makes them safe against the container's
> unspecified {{getDeclaredMethods()}} injection order, and
> {{SecurityMemberAccessConfigTest.setterOrderDoesNotAffectExcludedClasses}}
> pins it.
> At least one test must keep exercising the deprecated setters themselves
> while they still exist, so that their retained per-instance semantics stay
> covered — that is what
> {{SecurityMemberAccessConfigSharingTest.testDeprecatedSetterDoesNotLeakToSiblings}}
> does today.
> This is a test-only refactor with no production impact, so it can land in any
> 7.x release. It is prerequisite work for WW-5682, which deletes the setters
> in 8.0.0.
> h2. Related
> * WW-5675 — deprecated the setters
> * WW-5682 — removes them in 8.0.0
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
