[
https://issues.apache.org/jira/browse/WW-5786?focusedWorklogId=1049584&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1049584
]
ASF GitHub Bot logged work on WW-5786:
--------------------------------------
Author: ASF GitHub Bot
Created on: 23/Oct/26 08:34
Start Date: 23/Oct/26 08:34
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #2052:
URL: https://github.com/apache/struts/pull/2052
Fixes [WW-5786](https://issues.apache.org/jira/browse/WW-5786)
Follow-up to WW-3717. Convention actions have no XML declaration and so
cannot use the new `http-method` attribute; the ticket asked to verify that the
existing annotations (`@HttpGet`, `@HttpPost`, `@HttpPut`, `@HttpDelete`,
`@HttpGetOrPost`, `@AllowedHttpMethod`) cover them, and to pin that with tests
or document a gap.
**Outcome: covered.** `HttpMethodInterceptor` sits in the default stack that
Convention packages inherit, checks method-level annotations first (the
Convention `ActionConfig` always names its method, so `isMethodSpecified()` is
true) and class-level second. No gap was found, so no 8.0.0 feature ticket is
opened.
`ConventionHttpMethodTest` drives four annotated Convention actions through
the real dispatcher:
- class-level `@HttpPost`: POST executes, GET gets `405` + `Allow: POST` and
an empty body
- method-level `@HttpPost` on an `@Action("create-order")`-mapped method
named `create()`: same
- class-level `@HttpPost` with a Convention-discovered
`upload-bad-request.ftl`: GET renders it, no `Allow` header
- class-level `@HttpPut` with `@Result(name = "bad-request", ...)`: GET
renders it, PUT executes
- the scanned `ActionConfig`s carry an empty http-method set, so
annotation-only enforcement is what is under test
The fixtures live in `actions.httpmethod` under a package-level
`@Namespace("/httpmethod")`, so their templates and bad-request lookups cannot
collide with other fixtures in the shared root namespace. A root-level
`actions` package locator only yields a namespace for sub-packages when a dot
precedes it, hence the explicit annotation.
**Verification.** Mutating `isAllowed()` to always return `true` fails
exactly the four rejection tests and leaves the five others green. Full
Convention module: 94 tests pass, RAT clean. Security review of the diff: clean
(test-only, static templates, no input handling).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1049584)
Remaining Estimate: 0h
Time Spent: 10m
> Verify HTTP method restrictions for Convention plugin actions
> -------------------------------------------------------------
>
> Key: WW-5786
> URL: https://issues.apache.org/jira/browse/WW-5786
> Project: Struts 2
> Issue Type: Task
> Components: Plugin - Convention
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Follow-up to WW-3717, which adds an {{http-method}} attribute to {{<action>}}
> in {{struts.xml}}, enforced by {{HttpMethodInterceptor}}, with a 405 response
> (and an {{Allow}} header) when no {{bad-request}} result is mapped.
> Actions discovered by the Convention plugin have no XML declaration, so they
> cannot use the new attribute. The expectation is that they are already
> covered by the existing annotations ({{@HttpGet}}, {{@HttpPost}},
> {{@HttpPut}}, {{@HttpDelete}}, {{@HttpGetOrPost}}, {{@AllowedHttpMethod}}) on
> the action class or method.
> Verify this and pick one outcome:
> * *Covered:* add tests in the Convention plugin that pin it: an annotated
> Convention action (class-level and method-level, including an
> {{@Action}}-mapped method) rejects a disallowed method with the mapped
> {{bad-request}} result, or with 405 + {{Allow}} when none is mapped, and
> accepts an allowed one.
> * *Gap confirmed:* document what is missing (for example, a case the
> annotations cannot express for Convention actions) and open a New Feature
> ticket at 8.0.0 for an {{@Action(httpMethod = ...)}} style attribute, linking
> it here.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
