[
https://issues.apache.org/jira/browse/WW-5821?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5821:
------------------------------
Fix Version/s: 7.5.0
> HttpMethodInterceptor raises IllegalArgumentException for an unknown HTTP
> method on an HttpMethodAware action
> -------------------------------------------------------------------------------------------------------------
>
> Key: WW-5821
> URL: https://issues.apache.org/jira/browse/WW-5821
> Project: Struts 2
> Issue Type: Bug
> Components: Core Interceptors
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 7.5.0
>
>
> When an action implements {{HttpMethodAware}}, {{HttpMethodInterceptor}}
> converts the request method with {{HttpMethod.parse()}}, which calls
> {{valueOf()}} with no fallback. A request method outside the enum constants,
> such as {{PROPFIND}}, {{MKCOL}} or {{REPORT}}, raises
> {{IllegalArgumentException}} before the allowed-method checks run, so the
> client gets a 500 instead of the configured rejection.
> h2. Steps to reproduce
> # Define an action that implements {{HttpMethodAware}} and restricts methods,
> for example with {{@AllowedHttpMethod(POST)}} or {{http-method="POST"}}.
> # Send {{PROPFIND}} to that action.
> h2. Expected
> The request is rejected like any other disallowed method: the bad-request
> result, or {{405 Method Not Allowed}} with an {{Allow}} header when no such
> result is mapped.
> h2. Actual
> {code}java.lang.IllegalArgumentException: No enum constant
> org.apache.struts2.interceptor.httpmethod.HttpMethod.PROPFIND
> at java.base/java.lang.Enum.valueOf(Enum.java:273)
> at
> org.apache.struts2.interceptor.httpmethod.HttpMethod.parse(HttpMethod.java:40)
> {code}
> h2. Proposed change
> Add {{HttpMethod.parseOrNull()}}, a case-insensitive lookup that returns
> {{null}} for an unknown method. The interceptor passes that value to
> {{HttpMethodAware.setMethod()}}, documented as {{null}} for an unknown
> method, and falls through to the existing allowed-method check. {{parse()}}
> switches to {{Locale.ROOT}}, and {{XmlDocConfigurationProvider}} uses it for
> the {{http-method}} attribute.
> Pull request: [apache/struts#2043|https://github.com/apache/struts/pull/2043]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
