[
https://issues.apache.org/jira/browse/WW-5688?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107173#comment-18107173
]
Lukasz Lenart commented on WW-5688:
-----------------------------------
PR: https://github.com/apache/struts/pull/1862
Root cause turned out to be narrower than the description suggested.
{{DefaultActionMapper}} has handled this case since WW-2461 (June 2008) via a
{{rootAvailable}} check - three months _before_ WW-2820 reported the REST
symptom. The fix was simply never ported to the copy of
{{parseNameAndNamespace()}} that the REST plugin forked earlier, so the PR
ports it verbatim, keeping the ordering that computes the action name while the
namespace is still empty.
Blast radius is narrow: the promotion fires only when a package explicitly
declares namespace {{/}} and nothing more specific matched. The Convention
plugin derives the empty namespace or {{/sub}} and never {{/}}, so it cannot
trigger this on its own and the bundled rest-showcase is unaffected. Since a
{{/}} lookup already falls back to the empty namespace, the set of resolvable
actions is a strict superset of the previous one.
Backporting to {{support/struts-6-x-x}} is left as a separate decision, since
it is a behaviour change on a maintenance line.
> RestActionMapper maps URIs with an id into the empty namespace, so actions
> declared at namespace "/" 404
> --------------------------------------------------------------------------------------------------------
>
> Key: WW-5688
> URL: https://issues.apache.org/jira/browse/WW-5688
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Affects Versions: 2.1.2
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.4.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Split out of [WW-2820|https://issues.apache.org/jira/browse/WW-2820], a 2008
> umbrella of five unrelated REST plugin claims. This is the only one of the
> five that still reproduces on {{main}}. Originally reported by Alvin Singh.
> h3. Symptom
> When a package is declared at namespace {{/}}, REST URIs that carry an id are
> mapped into a _different_ namespace than those that do not. The result is
> that {{index}} works while {{show}} / {{update}} / {{destroy}} return 404 for
> the very same action.
> Given a single package whose namespace attribute is {{/}}, extending
> {{rest-default}}, holding one action named {{dog}}:
> ||Request||namespace from RestActionMapper||action resolves?||
> |{{GET /dog}}|{{/}}|yes|
> |{{GET /dog/1}}|(empty)|_no - 404_|
> The reporter's original phrasing was "if you want a blank namespace, do not
> use / as your namespace ... inconsistent behavior starts to occur", which is
> accurate.
> h3. Root cause
> {{RestActionMapper.parseNameAndNamespace()}} has two disjoint paths:
> * {{lastSlash == 0}} hardcodes {{namespace = "/"}} (the WW-1046 root case).
> * Any deeper URI instead runs the longest-matching-namespace loop. That
> loop's guard, {{prefix.charAt(ns.length()) == '/'}}, can never select {{"/"}}
> - it would require a {{//}} prefix - so it falls through to its default of
> the empty string.
> {{RuntimeConfiguration.getActionConfig()}} then only fails over {{"/"}} to
> the empty namespace, never the empty namespace to {{"/"}} (see
> {{DefaultConfiguration.shouldFallbackToEmptyNamespace}}). So the
> empty-namespace branch is a dead end for an action declared at {{"/"}}.
> Note that the loop computes {{name = uri.substring(namespace.length() + 1)}},
> which assumes a non-root namespace. Simply allowing {{"/"}} to match in the
> loop is therefore not sufficient on its own.
> h3. Reproduction
> Against a configuration holding only the package above:
> {noformat}
> PROBE index -> ns='/' name='dog'
> PROBE show -> ns='' name='dog'
> junit.framework.AssertionFailedError:
> GET /dog/1 must resolve to the action declared in namespace "/"
> {noformat}
> The companion assertion for {{GET /dog}} passes against the same
> configuration, so the failure is specific to the id-bearing URI and not an
> artefact of the fixture.
> h3. Security assessment
> Not a security issue. The defect makes actions _less_ reachable rather than
> more, and aligning {{/dog/1}} with what {{/dog}} already resolves to exposes
> no surface that the {{/dog}} path does not already expose.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
