[
https://issues.apache.org/jira/browse/WW-5718?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5718:
------------------------------
Component/s: Core Interceptors
> Plugin-provided default interceptor stacks omit the resource-isolation
> interceptors
> -----------------------------------------------------------------------------------
>
> Key: WW-5718
> URL: https://issues.apache.org/jira/browse/WW-5718
> Project: Struts 2
> Issue Type: Improvement
> Components: Core Interceptors
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 6.12.0, 7.4.0
>
>
> {{WW-5083}} added the Fetch Metadata resource-isolation interceptor to core's
> {{defaultStack}} in 6.0.0, alongside {{coop}} and {{coep}}. All three are
> declared enabled in {{core/src/main/resources/struts-default.xml}}:
> {code}<interceptor-ref name="coep">
> <param name="disabled">false</param>
> ...
> <interceptor-ref name="coop">
> <param name="disabled">false</param>
> ...
> <interceptor-ref name="fetchMetadata">
> <param name="disabled">false</param>
> </interceptor-ref>
> {code}
> Two bundled plugins replace {{defaultStack}} wholesale with their own stack
> and set it as the package default. Both stacks were forked from
> {{defaultStack}} before {{WW-5083}} and were never updated, so neither
> carries any of the three interceptors:
> * {{plugins/rest/src/main/resources/struts-plugin.xml}} —
> {{restDefaultStack}}, installed via {{<default-interceptor-ref
> name="restDefaultStack"/>}}
> * {{plugins/bean-validation/src/main/resources/struts-plugin.xml}} —
> {{beanValidationDefaultStack}}, installed via {{<default-interceptor-ref
> name="beanValidationDefaultStack"/>}}
> The result is that an action package extending {{rest-default}} or
> {{bean-validation-default}} silently loses the cross-origin request filtering
> and the COOP/COEP response headers that an otherwise identical
> {{struts-default}} package gets by default. Nothing in the configuration
> signals the difference, and the omission is not the outcome of a decision
> recorded anywhere — the interceptors simply post-date the forks.
> {{config-browser}}'s {{configBrowserDefault}} delegates to
> {{validationWorkflowStack}}, which derives from {{defaultStack}}, so it is
> unaffected.
> h3. Proposed change
> Add {{coep}}, {{coop}} and {{fetchMetadata}} to {{restDefaultStack}} and
> {{beanValidationDefaultStack}}, with the same parameters {{defaultStack}}
> uses, positioned as they are in {{defaultStack}}.
> h3. Notes
> * Affects 6.x and 7.x alike: {{WW-5083}} shipped in 6.0.0, and both plugin
> stacks lack the interceptors on {{main}} and on {{support/struts-6-x-x}}.
> * This is a behaviour change for existing REST and Bean Validation
> deployments: {{fetchMetadata}} rejects requests whose {{Sec-Fetch-Site}}
> marks them cross-site, so a REST API deliberately serving cross-origin
> browser clients will start seeing 403s unless it configures {{exemptedPaths}}
> or disables the interceptor. It should be called out in the migration notes.
> * The wider point is structural: a plugin that replaces {{defaultStack}}
> inherits nothing from it afterwards, so every future addition to
> {{defaultStack}} has to be mirrored by hand into each fork. Worth considering
> whether these stacks can extend the core stack rather than restate it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
