Lukasz Lenart created WW-5729:
---------------------------------
Summary: JasperReports plugin: ValueStackShadowMap overloads
get/containsKey instead of overriding them, so the value-stack fallback never
reaches JasperReports
Key: WW-5729
URL: https://issues.apache.org/jira/browse/WW-5729
Project: Struts 2
Issue Type: Bug
Components: Plugin - JasperReports
Reporter: Lukasz Lenart
Fix For: 7.4.0
{{org.apache.struts2.views.jasperreports.ValueStackShadowMap}} (the
{{struts2-jasperreports-plugin}}, JasperReports 6.x line) is documented as a
{{HashMap}} whose {{containsKey}} and {{get}} fall back to
{{ValueStack.findValue(key)}} when the key is not in the map, so that a report
parameter declared in the {{.jasper}} can be resolved straight from the action.
That is how {{JasperReportsResult}} hands the parameter map to
{{JasperFillManager.fillReport}}.
The two methods are declared as
{code:java}public boolean containsKey(String key)
public Object get(String key)
{code}
The {{HashMap}} methods they are meant to replace take {{Object}}, so these are
overloads, not overrides (the Javadoc says "overriding HashMap implementation",
and there is no {{@Override}}). JasperReports holds the parameters as a
{{java.util.Map}} and calls {{get(Object)}} / {{containsKey(Object)}}, which
resolve to the plain {{HashMap}} implementation. The value-stack fallback
therefore never runs when called through JasperReports; only the entries the
result puts explicitly ({{reportDirectory}}, {{REPORT_LOCALE}},
{{REPORT_TIME_ZONE}}, and the {{reportParameters}} map) reach the fill.
The copy in the {{struts2-jasperreports7-plugin}}
({{org.apache.struts2.views.jasperreports7.ValueStackShadowMap}}, WW-5455)
declares both methods with an {{Object}} parameter and {{@Override}}, so the
two plugins behave differently for the same report and action.
Fix: change the parameter type to {{Object}} and add {{@Override}}, matching
the JR7 copy, with a test that fills a report whose declared parameter is only
available as an action property.
Note this is a behaviour change for the 6.x plugin: after the fix, a declared
report parameter that the action exposes as a property but does not put in
{{reportParameters}} starts being resolved from the value stack, as the Javadoc
has always claimed. Worth a line in the version notes.
Found while triaging WW-3245; no security impact (the fallback keys are the
parameter names compiled into the developer's {{.jasper}}, not request data).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
