Lukasz Lenart created WW-5821:
---------------------------------
Summary: HttpMethodInterceptor raises IllegalArgumentException for
an unknown HTTP method on an HttpMethodAware action
Key: WW-5821
URL: https://issues.apache.org/jira/browse/WW-5821
Project: Struts 2
Issue Type: Bug
Components: Core Interceptors
Reporter: Lukasz Lenart
When an action implements {{HttpMethodAware}}, {{HttpMethodInterceptor}}
converts the request method with {{HttpMethod.parse()}}, which calls
{{valueOf()}} with no fallback. A request method outside the enum constants,
such as {{PROPFIND}}, {{MKCOL}} or {{REPORT}}, raises
{{IllegalArgumentException}} before the allowed-method checks run, so the
client gets a 500 instead of the configured rejection.
h2. Steps to reproduce
# Define an action that implements {{HttpMethodAware}} and restricts methods,
for example with {{@AllowedHttpMethod(POST)}} or {{http-method="POST"}}.
# Send {{PROPFIND}} to that action.
h2. Expected
The request is rejected like any other disallowed method: the bad-request
result, or {{405 Method Not Allowed}} with an {{Allow}} header when no such
result is mapped.
h2. Actual
{code}java.lang.IllegalArgumentException: No enum constant
org.apache.struts2.interceptor.httpmethod.HttpMethod.PROPFIND
at java.base/java.lang.Enum.valueOf(Enum.java:273)
at
org.apache.struts2.interceptor.httpmethod.HttpMethod.parse(HttpMethod.java:40)
{code}
h2. Proposed change
Add {{HttpMethod.parseOrNull()}}, a case-insensitive lookup that returns
{{null}} for an unknown method. The interceptor passes that value to
{{HttpMethodAware.setMethod()}}, documented as {{null}} for an unknown method,
and falls through to the existing allowed-method check. {{parse()}} switches to
{{Locale.ROOT}}, and {{XmlDocConfigurationProvider}} uses it for the
{{http-method}} attribute.
Pull request: [apache/struts#2043|https://github.com/apache/struts/pull/2043]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
