[
https://issues.apache.org/jira/browse/WW-5688?focusedWorklogId=1037304&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1037304
]
ASF GitHub Bot logged work on WW-5688:
--------------------------------------
Author: ASF GitHub Bot
Created on: 23/Aug/26 19:01
Start Date: 23/Aug/26 19:01
Worklog Time Spent: 10m
Work Description: sonarqubecloud[bot] commented on PR #1863:
URL: https://github.com/apache/struts/pull/1863#issuecomment-5387900289
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1863)
**Quality Gate passed**
Issues
 [1 New
issue](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1863&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted
issues](https://sonarcloud.io/project/issues?id=apache_struts&pullRequest=1863&issueStatuses=ACCEPTED)
Measures
 [0 Security
Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_struts&pullRequest=1863&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [100.0% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1863&metric=new_coverage&view=list)
 [0.0% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1863&metric=new_duplicated_lines_density&view=list)
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1037304)
Time Spent: 40m (was: 0.5h)
> RestActionMapper maps URIs with an id into the empty namespace, so actions
> declared at namespace "/" 404
> --------------------------------------------------------------------------------------------------------
>
> Key: WW-5688
> URL: https://issues.apache.org/jira/browse/WW-5688
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - REST
> Affects Versions: 2.1.2
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 6.12.0, 7.4.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Split out of [WW-2820|https://issues.apache.org/jira/browse/WW-2820], a 2008
> umbrella of five unrelated REST plugin claims. This is the only one of the
> five that still reproduces on {{main}}. Originally reported by Alvin Singh.
> h3. Symptom
> When a package is declared at namespace {{/}}, REST URIs that carry an id are
> mapped into a _different_ namespace than those that do not. The result is
> that {{index}} works while {{show}} / {{update}} / {{destroy}} return 404 for
> the very same action.
> Given a single package whose namespace attribute is {{/}}, extending
> {{rest-default}}, holding one action named {{dog}}:
> ||Request||namespace from RestActionMapper||action resolves?||
> |{{GET /dog}}|{{/}}|yes|
> |{{GET /dog/1}}|(empty)|_no - 404_|
> The reporter's original phrasing was "if you want a blank namespace, do not
> use / as your namespace ... inconsistent behavior starts to occur", which is
> accurate.
> h3. Root cause
> {{RestActionMapper.parseNameAndNamespace()}} has two disjoint paths:
> * {{lastSlash == 0}} hardcodes {{namespace = "/"}} (the WW-1046 root case).
> * Any deeper URI instead runs the longest-matching-namespace loop. That
> loop's guard, {{prefix.charAt(ns.length()) == '/'}}, can never select {{"/"}}
> - it would require a {{//}} prefix - so it falls through to its default of
> the empty string.
> {{RuntimeConfiguration.getActionConfig()}} then only fails over {{"/"}} to
> the empty namespace, never the empty namespace to {{"/"}} (see
> {{DefaultConfiguration.shouldFallbackToEmptyNamespace}}). So the
> empty-namespace branch is a dead end for an action declared at {{"/"}}.
> Note that the loop computes {{name = uri.substring(namespace.length() + 1)}},
> which assumes a non-root namespace. Simply allowing {{"/"}} to match in the
> loop is therefore not sufficient on its own.
> h3. Reproduction
> Against a configuration holding only the package above:
> {noformat}
> PROBE index -> ns='/' name='dog'
> PROBE show -> ns='' name='dog'
> junit.framework.AssertionFailedError:
> GET /dog/1 must resolve to the action declared in namespace "/"
> {noformat}
> The companion assertion for {{GET /dog}} passes against the same
> configuration, so the failure is specific to the id-bearing URI and not an
> artefact of the fixture.
> h3. Security assessment
> Not a security issue. The defect makes actions _less_ reachable rather than
> more, and aligning {{/dog/1}} with what {{/dog}} already resolves to exposes
> no surface that the {{/dog}} path does not already expose.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
