[
https://issues.apache.org/jira/browse/WW-5729?focusedWorklogId=1041096&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041096
]
ASF GitHub Bot logged work on WW-5729:
--------------------------------------
Author: ASF GitHub Bot
Created on: 12/Sep/26 09:19
Start Date: 12/Sep/26 09:19
Worklog Time Spent: 10m
Work Description: sonarqubecloud[bot] commented on PR #1920:
URL: https://github.com/apache/struts/pull/1920#issuecomment-5644974722
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1920)
**Quality Gate failed**
Failed conditions
 [78.3% Coverage on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1920&metric=new_coverage&view=list)
(required ≥ 80%)
 [16.9% Duplication on New
Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1920&metric=new_duplicated_lines_density&view=list)
(required ≤ 3%)
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1041096)
Time Spent: 40m (was: 0.5h)
> JasperReports plugin: ValueStackShadowMap overloads get/containsKey instead
> of overriding them, so the value-stack fallback never reaches JasperReports
> -------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: WW-5729
> URL: https://issues.apache.org/jira/browse/WW-5729
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - JasperReports
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> {{org.apache.struts2.views.jasperreports.ValueStackShadowMap}} (the
> {{struts2-jasperreports-plugin}}, JasperReports 6.x line) is documented as a
> {{HashMap}} whose {{containsKey}} and {{get}} fall back to
> {{ValueStack.findValue(key)}} when the key is not in the map, so that a
> report parameter declared in the {{.jasper}} can be resolved straight from
> the action. That is how {{JasperReportsResult}} hands the parameter map to
> {{JasperFillManager.fillReport}}.
> The two methods are declared as
> {code:java}public boolean containsKey(String key)
> public Object get(String key)
> {code}
> The {{HashMap}} methods they are meant to replace take {{Object}}, so these
> are overloads, not overrides (the Javadoc says "overriding HashMap
> implementation", and there is no {{@Override}}). JasperReports holds the
> parameters as a {{java.util.Map}} and calls {{get(Object)}} /
> {{containsKey(Object)}}, which resolve to the plain {{HashMap}}
> implementation. The value-stack fallback therefore never runs when called
> through JasperReports; only the entries the result puts explicitly
> ({{reportDirectory}}, {{REPORT_LOCALE}}, {{REPORT_TIME_ZONE}}, and the
> {{reportParameters}} map) reach the fill.
> The copy in the {{struts2-jasperreports7-plugin}}
> ({{org.apache.struts2.views.jasperreports7.ValueStackShadowMap}}, WW-5455)
> declares both methods with an {{Object}} parameter and {{@Override}}, so the
> two plugins behave differently for the same report and action.
> Fix: change the parameter type to {{Object}} and add {{@Override}}, matching
> the JR7 copy, with a test that fills a report whose declared parameter is
> only available as an action property.
> Note this is a behaviour change for the 6.x plugin: after the fix, a declared
> report parameter that the action exposes as a property but does not put in
> {{reportParameters}} starts being resolved from the value stack, as the
> Javadoc has always claimed. Worth a line in the version notes.
> Found while triaging WW-3245; no security impact (the fallback keys are the
> parameter names compiled into the developer's {{.jasper}}, not request data).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
