[jira] [Created] (WW-4588) Improve the Struts2 Rest plugin to honor Accept nad Content-Type headers

2016-01-14 Thread Rich P Peters, II (JIRA)
Rich P Peters, II created WW-4588:
-

 Summary: Improve the Struts2 Rest plugin to honor Accept nad 
Content-Type headers
 Key: WW-4588
 URL: https://issues.apache.org/jira/browse/WW-4588
 Project: Struts 2
  Issue Type: Improvement
  Components: Plugin - REST
Affects Versions: 2.3.24
 Environment: tomcat
Reporter: Rich P Peters, II


Currently the rest plugin primarily looks at the url extension to connect the 
proper content type handlers.  This should be extended to use the Accept and 
Content-Type headers to drive the content-type handlers when no extension is 
present.  Note that the plugin currently partially handles the case for input 
request using the content-type header, but can be overridden by the extension.

In a use case,  if a request specifies in the header that the Content-Type is 
application/json, the input request data is converted to the json data format. 
If a request specifies the Accept:application/json header ,  the output data 
will be converted to json.  This is cleaner than specifying the extension in a 
lot of cases where the application rest urls have to be generated in javascript.

a short unit test shows how the accept header is ignored:
{code:java}
public void testObtainingHandlerForResponseByAcceptHeader() throws 
Exception {

// given
final DefaultContentTypeHandlerManager handlerManager = new 
DefaultContentTypeHandlerManager();
handlerManager.setContainer(new DummyContainer("application/json", 
"json"));

MockHttpServletRequest request = new MockHttpServletRequest();
request.setContentType("application/json;charset=UTF-8");
request.addHeader("accept","application/json;charset=UTF-8");
request.setRequestURI("/index");

final MockHttpServletResponse response = new MockHttpServletResponse();
response.setContentType("application/json;charset=UTF-8");

// when
ContentTypeHandler handler = 
handlerManager.getHandlerForResponse(request,response);

// then
assertNotNull(handler);
assertEquals("application/json", handler.getContentType());
assertEquals("json", handler.getExtension());
}
{code}
the output show the failure to acquire a handler:
{code:java}
junit.framework.AssertionFailedError: null

at junit.framework.Assert.fail(Assert.java:47)
at junit.framework.Assert.assertTrue(Assert.java:20)
at junit.framework.Assert.assertNotNull(Assert.java:214)
at junit.framework.Assert.assertNotNull(Assert.java:207)
at 
org.apache.struts2.rest.DefaultContentTypeHandlerManagerTest.testObtainingHandlerForResponseByAcceptHeader(DefaultContentTypeHandlerManagerTest.java:104)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at junit.framework.TestCase.runTest(TestCase.java:168)
at junit.framework.TestCase.runBare(TestCase.java:134)
at junit.framework.TestResult$1.protect(TestResult.java:110)
at junit.framework.TestResult.runProtected(TestResult.java:128)
at junit.framework.TestResult.run(TestResult.java:113)
at junit.framework.TestCase.run(TestCase.java:124)
at junit.framework.TestSuite.runTest(TestSuite.java:243)
at junit.framework.TestSuite.run(TestSuite.java:238)
at 
org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:83)
at org.junit.runner.JUnitCore.run(JUnitCore.java:157)
at 
com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
at 
com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:234)
at 
com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:74)
{code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4381) upgrade to jasperreports 6.0

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4381?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098414#comment-15098414
 ] 

ASF subversion and git services commented on WW-4381:
-

Commit ee83d4a6dbd558ac4022194ffb419c8f46516f79 in struts's branch 
refs/heads/master from [~rgielen]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=ee83d4a ]

WW-4381 - exclude org.olap4j:olap4j for compile, to fix broken builds behind 
Maven mirror


> upgrade to jasperreports 6.0
> 
>
> Key: WW-4381
> URL: https://issues.apache.org/jira/browse/WW-4381
> Project: Struts 2
>  Issue Type: Improvement
>  Components: Plugin - JasperReports
>Reporter: zhouyanming
>Assignee: Rene Gielen
> Fix For: 2.5
>
>
> JasperReportsResult.java is not compatible with jasperreports 6.0



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4381) upgrade to jasperreports 6.0

2016-01-14 Thread Hudson (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4381?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098491#comment-15098491
 ] 

Hudson commented on WW-4381:


SUCCESS: Integrated in Struts-JDK7-master #406 (See 
[https://builds.apache.org/job/Struts-JDK7-master/406/])
WW-4381 - exclude org.olap4j:olap4j for compile, to fix broken builds (rgielen: 
rev ee83d4a6dbd558ac4022194ffb419c8f46516f79)
* plugins/jasperreports/pom.xml


> upgrade to jasperreports 6.0
> 
>
> Key: WW-4381
> URL: https://issues.apache.org/jira/browse/WW-4381
> Project: Struts 2
>  Issue Type: Improvement
>  Components: Plugin - JasperReports
>Reporter: zhouyanming
>Assignee: Rene Gielen
> Fix For: 2.5
>
>
> JasperReportsResult.java is not compatible with jasperreports 6.0



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Resolved] (WW-4403) JDK 8: build fails due to JavaDoc checking issues

2016-01-14 Thread Rene Gielen (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4403?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Rene Gielen resolved WW-4403.
-
   Resolution: Fixed
 Assignee: Rene Gielen
Fix Version/s: 2.3.25

An automatically activated profile for JDK8 builds was introduced, configuring 
maven-javadoc-plugin to disable breaking javadoc lint checking

> JDK 8: build fails due to JavaDoc checking issues
> -
>
> Key: WW-4403
> URL: https://issues.apache.org/jira/browse/WW-4403
> Project: Struts 2
>  Issue Type: Bug
>  Components: Build Management
>Affects Versions: 2.3.16.3
>Reporter: Rene Gielen
>Assignee: Rene Gielen
>  Labels: jdk8
> Fix For: 2.3.25, 2.5
>
>
> JDK 8 introduced stricter checking for JavaDoc processing, causing issues 
> formerly producing warning messages to break the build.
> Basically the fix is as easy as adding the following configuration to the 
> pluginManagement section:
> {code:xml}
> 
> org.apache.maven.plugins
> maven-javadoc-plugin
> 2.9.1
> 
> private
> -Xdoclint:none
> 
> 
> {code}
> To fix and close this issue, we need a testable build though which is 
> currently blocked by WW-4402



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4585) Struts2 Rest plugin doesnt handle JSESSIONID

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098535#comment-15098535
 ] 

ASF subversion and git services commented on WW-4585:
-

Commit e0003f0471f98d5986844cd799555618aae88fce in struts's branch 
refs/heads/master from [~aleksandr-m]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=e0003f0 ]

WW-4585 Struts2 Rest plugin doesn't handle JSESSIONID with DMI


> Struts2 Rest plugin doesnt handle JSESSIONID
> 
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with a JSESSIONID is sent to a struts2 action, a failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMapping() throws Exception {
> req.setRequestURI("/myapp/animals/dog/fido;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("show", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4585) Struts2 Rest plugin doesnt handle JSESSIONID

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098536#comment-15098536
 ] 

ASF subversion and git services commented on WW-4585:
-

Commit ff4cdd967031ed21740ee555d9e0c58b2033aa0c in struts's branch 
refs/heads/support-2-3 from [~aleksandr-m]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=ff4cdd9 ]

WW-4585 Struts2 Rest plugin doesn't handle JSESSIONID with DMI


> Struts2 Rest plugin doesnt handle JSESSIONID
> 
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with a JSESSIONID is sent to a struts2 action, a failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMapping() throws Exception {
> req.setRequestURI("/myapp/animals/dog/fido;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("show", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4585) Struts2 Rest plugin doesnt handle JSESSIONID

2016-01-14 Thread Aleksandr Mashchenko (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Aleksandr Mashchenko updated WW-4585:
-
Fix Version/s: 2.5

> Struts2 Rest plugin doesnt handle JSESSIONID
> 
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
>
> If a url with a JSESSIONID is sent to a struts2 action, a failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMapping() throws Exception {
> req.setRequestURI("/myapp/animals/dog/fido;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("show", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4507) Struts 2 XSS vulnerability with

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4507?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098141#comment-15098141
 ] 

ASF subversion and git services commented on WW-4507:
-

Commit 5421930b49822606792f36653b17d3d95ef106f9 in struts's branch 
refs/heads/support-2-3 from [~rgielen]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=5421930 ]

WW-4507 - clone Tomcat UDecoder and use it for in query string handling


> Struts 2 XSS vulnerability with 
> -
>
> Key: WW-4507
> URL: https://issues.apache.org/jira/browse/WW-4507
> Project: Struts 2
>  Issue Type: Bug
>Affects Versions: 2.3.16.3
> Environment: Operating System:  Windows 7.  Application Server:  
> JBoss-4.2.1.GA.  Java: jdk1.5.0.11.  Developloment Framework:  Struts 
> 2.3.16.3.  Browser:  FireFox 38.0.1
>Reporter: brian neisen
>  Labels: struts2, vulnerability, xss
> Fix For: 2.3.x
>
>
> WhiteHat Security (whitehatsec.com) has found an xss vulnerability with the 
>  tag.   When loading a url in a browser with some param name, in 
> this case "myinput", and the jsp being loaded has the tag  name="myinput" id="myinput">, an alert message is popped open 
> in the browser- which is WhiteHat's method of showing the vulnerability.  
> Example url is: 
> [http://localhost:8080/sample.action?myinput=%fc%80%80%80%80%a2%fc%80%80%80%80%bE%FC%80%80%80%80%BC%FC%80%80%80%81%B7%FC%80%80%80%81%A8%FC%80%80%80%81%B3%FC%80%80%80%81%A3%FC%80%80%80%81%A8%FC%80%80%80%81%A5%FC%80%80%80%81%A3%FC%80%80%80%81%AB%FC%80%80%80%80%BE%fc%80%80%80%80%bCscript%fc%80%80%80%80%bEalert%fc%80%80%80%80%a81%fc%80%80%80%80%a9%fc%80%80%80%80%bC%fc%80%80%80%80%aFscript%fc%80%80%80%80%bE]



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4507) Struts 2 XSS vulnerability with

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4507?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098146#comment-15098146
 ] 

ASF subversion and git services commented on WW-4507:
-

Commit 72471d7075681bea52046645ad7aa34e9c53751e in struts's branch 
refs/heads/master from [~rgielen]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=72471d7 ]

WW-4507 - clone Tomcat UDecoder and use it for in query string handling
(cherry picked from commit 5421930)


> Struts 2 XSS vulnerability with 
> -
>
> Key: WW-4507
> URL: https://issues.apache.org/jira/browse/WW-4507
> Project: Struts 2
>  Issue Type: Bug
>Affects Versions: 2.3.16.3
> Environment: Operating System:  Windows 7.  Application Server:  
> JBoss-4.2.1.GA.  Java: jdk1.5.0.11.  Developloment Framework:  Struts 
> 2.3.16.3.  Browser:  FireFox 38.0.1
>Reporter: brian neisen
>  Labels: struts2, vulnerability, xss
> Fix For: 2.3.x
>
>
> WhiteHat Security (whitehatsec.com) has found an xss vulnerability with the 
>  tag.   When loading a url in a browser with some param name, in 
> this case "myinput", and the jsp being loaded has the tag  name="myinput" id="myinput">, an alert message is popped open 
> in the browser- which is WhiteHat's method of showing the vulnerability.  
> Example url is: 
> [http://localhost:8080/sample.action?myinput=%fc%80%80%80%80%a2%fc%80%80%80%80%bE%FC%80%80%80%80%BC%FC%80%80%80%81%B7%FC%80%80%80%81%A8%FC%80%80%80%81%B3%FC%80%80%80%81%A3%FC%80%80%80%81%A8%FC%80%80%80%81%A5%FC%80%80%80%81%A3%FC%80%80%80%81%AB%FC%80%80%80%80%BE%fc%80%80%80%80%bCscript%fc%80%80%80%80%bEalert%fc%80%80%80%80%a81%fc%80%80%80%80%a9%fc%80%80%80%80%bC%fc%80%80%80%80%aFscript%fc%80%80%80%80%bE]



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4507) Struts 2 XSS vulnerability with

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4507?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098163#comment-15098163
 ] 

ASF subversion and git services commented on WW-4507:
-

Commit a89bbe22cd2461748d595a89a254de888a415e6c in struts's branch 
refs/heads/master from [~rgielen]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=a89bbe2 ]

WW-4507 - adjust Tomcat url decoding code to Log4j 2 logging used in Struts


> Struts 2 XSS vulnerability with 
> -
>
> Key: WW-4507
> URL: https://issues.apache.org/jira/browse/WW-4507
> Project: Struts 2
>  Issue Type: Bug
>Affects Versions: 2.3.16.3
> Environment: Operating System:  Windows 7.  Application Server:  
> JBoss-4.2.1.GA.  Java: jdk1.5.0.11.  Developloment Framework:  Struts 
> 2.3.16.3.  Browser:  FireFox 38.0.1
>Reporter: brian neisen
>  Labels: struts2, vulnerability, xss
> Fix For: 2.3.x
>
>
> WhiteHat Security (whitehatsec.com) has found an xss vulnerability with the 
>  tag.   When loading a url in a browser with some param name, in 
> this case "myinput", and the jsp being loaded has the tag  name="myinput" id="myinput">, an alert message is popped open 
> in the browser- which is WhiteHat's method of showing the vulnerability.  
> Example url is: 
> [http://localhost:8080/sample.action?myinput=%fc%80%80%80%80%a2%fc%80%80%80%80%bE%FC%80%80%80%80%BC%FC%80%80%80%81%B7%FC%80%80%80%81%A8%FC%80%80%80%81%B3%FC%80%80%80%81%A3%FC%80%80%80%81%A8%FC%80%80%80%81%A5%FC%80%80%80%81%A3%FC%80%80%80%81%AB%FC%80%80%80%80%BE%fc%80%80%80%80%bCscript%fc%80%80%80%80%bEalert%fc%80%80%80%80%a81%fc%80%80%80%80%a9%fc%80%80%80%80%bC%fc%80%80%80%80%aFscript%fc%80%80%80%80%bE]



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4507) Struts 2 XSS vulnerability with

2016-01-14 Thread Hudson (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4507?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098169#comment-15098169
 ] 

Hudson commented on WW-4507:


SUCCESS: Integrated in Struts-JDK6-support-2.3 #955 (See 
[https://builds.apache.org/job/Struts-JDK6-support-2.3/955/])
WW-4507 - clone Tomcat UDecoder and use it for in query string handling 
(rgielen: rev 5421930b49822606792f36653b17d3d95ef106f9)
* core/src/main/java/org/apache/struts2/views/util/DefaultUrlHelper.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/Ascii.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/ByteChunk.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/HexUtils.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/StringCache.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/UDecoder.java
* 
core/src/main/java/org/apache/struts2/dispatcher/mapper/Restful2ActionMapper.java
* core/src/main/java/org/apache/struts2/util/URLDecoderUtil.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/MessageBytes.java
* core/src/test/java/org/apache/struts2/util/URLDecoderUtilTest.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/CharChunk.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/B2CConverter.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/Utf8Decoder.java
* 
core/src/main/java/org/apache/struts2/dispatcher/mapper/RestfulActionMapper.java


> Struts 2 XSS vulnerability with 
> -
>
> Key: WW-4507
> URL: https://issues.apache.org/jira/browse/WW-4507
> Project: Struts 2
>  Issue Type: Bug
>Affects Versions: 2.3.16.3
> Environment: Operating System:  Windows 7.  Application Server:  
> JBoss-4.2.1.GA.  Java: jdk1.5.0.11.  Developloment Framework:  Struts 
> 2.3.16.3.  Browser:  FireFox 38.0.1
>Reporter: brian neisen
>  Labels: struts2, vulnerability, xss
> Fix For: 2.3.x
>
>
> WhiteHat Security (whitehatsec.com) has found an xss vulnerability with the 
>  tag.   When loading a url in a browser with some param name, in 
> this case "myinput", and the jsp being loaded has the tag  name="myinput" id="myinput">, an alert message is popped open 
> in the browser- which is WhiteHat's method of showing the vulnerability.  
> Example url is: 
> [http://localhost:8080/sample.action?myinput=%fc%80%80%80%80%a2%fc%80%80%80%80%bE%FC%80%80%80%80%BC%FC%80%80%80%81%B7%FC%80%80%80%81%A8%FC%80%80%80%81%B3%FC%80%80%80%81%A3%FC%80%80%80%81%A8%FC%80%80%80%81%A5%FC%80%80%80%81%A3%FC%80%80%80%81%AB%FC%80%80%80%80%BE%fc%80%80%80%80%bCscript%fc%80%80%80%80%bEalert%fc%80%80%80%80%a81%fc%80%80%80%80%a9%fc%80%80%80%80%bC%fc%80%80%80%80%aFscript%fc%80%80%80%80%bE]



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4585) Struts2 Rest plugin doesnt handle JSESSIONID

2016-01-14 Thread Rich P Peters, II (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Rich P Peters, II updated WW-4585:
--
Attachment: RestActionMapper.java

FWIW, attached is a version of this file based upon 2.3.34.1 which implements 
this change. processing the method name correctly required the other changes in 
the source.


> Struts2 Rest plugin doesnt handle JSESSIONID
> 
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with a JSESSIONID is sent to a struts2 action, a failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMapping() throws Exception {
> req.setRequestURI("/myapp/animals/dog/fido;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("show", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4403) JDK 8: build fails due to JavaDoc checking issues

2016-01-14 Thread Hudson (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098436#comment-15098436
 ] 

Hudson commented on WW-4403:


SUCCESS: Integrated in Struts-JDK7-master #405 (See 
[https://builds.apache.org/job/Struts-JDK7-master/405/])
WW-4403 - add JDK 8 profile, disabling JavaDoc lint checker when (rgielen: rev 
9f6a0c9c9473a3bbe4e78d85b4b00523ac55ce64)
* pom.xml


> JDK 8: build fails due to JavaDoc checking issues
> -
>
> Key: WW-4403
> URL: https://issues.apache.org/jira/browse/WW-4403
> Project: Struts 2
>  Issue Type: Bug
>  Components: Build Management
>Affects Versions: 2.3.16.3
>Reporter: Rene Gielen
>  Labels: jdk8
> Fix For: 2.5
>
>
> JDK 8 introduced stricter checking for JavaDoc processing, causing issues 
> formerly producing warning messages to break the build.
> Basically the fix is as easy as adding the following configuration to the 
> pluginManagement section:
> {code:xml}
> 
> org.apache.maven.plugins
> maven-javadoc-plugin
> 2.9.1
> 
> private
> -Xdoclint:none
> 
> 
> {code}
> To fix and close this issue, we need a testable build though which is 
> currently blocked by WW-4402



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4403) JDK 8: build fails due to JavaDoc checking issues

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098372#comment-15098372
 ] 

ASF subversion and git services commented on WW-4403:
-

Commit 7c4bb7e7bd9da86eee09018c007556c12f2520e1 in struts's branch 
refs/heads/support-2-3 from [~rgielen]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=7c4bb7e ]

WW-4403 - add JDK 8 profile, disabling JavaDoc lint checker when building with 
JDK8


> JDK 8: build fails due to JavaDoc checking issues
> -
>
> Key: WW-4403
> URL: https://issues.apache.org/jira/browse/WW-4403
> Project: Struts 2
>  Issue Type: Bug
>  Components: Build Management
>Affects Versions: 2.3.16.3
>Reporter: Rene Gielen
>  Labels: jdk8
> Fix For: 2.5
>
>
> JDK 8 introduced stricter checking for JavaDoc processing, causing issues 
> formerly producing warning messages to break the build.
> Basically the fix is as easy as adding the following configuration to the 
> pluginManagement section:
> {code:xml}
> 
> org.apache.maven.plugins
> maven-javadoc-plugin
> 2.9.1
> 
> private
> -Xdoclint:none
> 
> 
> {code}
> To fix and close this issue, we need a testable build though which is 
> currently blocked by WW-4402



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4403) JDK 8: build fails due to JavaDoc checking issues

2016-01-14 Thread ASF subversion and git services (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098371#comment-15098371
 ] 

ASF subversion and git services commented on WW-4403:
-

Commit 9f6a0c9c9473a3bbe4e78d85b4b00523ac55ce64 in struts's branch 
refs/heads/master from [~rgielen]
[ https://git-wip-us.apache.org/repos/asf?p=struts.git;h=9f6a0c9 ]

WW-4403 - add JDK 8 profile, disabling JavaDoc lint checker when building with 
JDK8
(cherry picked from commit 7c4bb7e)


> JDK 8: build fails due to JavaDoc checking issues
> -
>
> Key: WW-4403
> URL: https://issues.apache.org/jira/browse/WW-4403
> Project: Struts 2
>  Issue Type: Bug
>  Components: Build Management
>Affects Versions: 2.3.16.3
>Reporter: Rene Gielen
>  Labels: jdk8
> Fix For: 2.5
>
>
> JDK 8 introduced stricter checking for JavaDoc processing, causing issues 
> formerly producing warning messages to break the build.
> Basically the fix is as easy as adding the following configuration to the 
> pluginManagement section:
> {code:xml}
> 
> org.apache.maven.plugins
> maven-javadoc-plugin
> 2.9.1
> 
> private
> -Xdoclint:none
> 
> 
> {code}
> To fix and close this issue, we need a testable build though which is 
> currently blocked by WW-4402



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4588) Improve the Struts2 Rest plugin to honor Accept and Content-Type headers

2016-01-14 Thread Rich P Peters, II (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4588?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Rich P Peters, II updated WW-4588:
--
Description: 
Currently the rest plugin primarily looks at the url extension to connect the 
proper content type handlers.  This should be extended to use the Accept and 
Content-Type headers to drive the content-type handlers when no extension is 
present.  Note that the plugin currently partially handles the case for input 
request using the content-type header, but can be overridden by the extension.

In a use case,  if a request specifies in the header that the Content-Type is 
application/json, the input request data is converted to the json data format. 
If a request specifies the Accept:application/json header ,  the output data 
will be converted to json.  This is cleaner than specifying the extension in a 
lot of cases where the application rest urls have to be generated in javascript.

a short unit test shows how the accept header is ignored:
{code:java}
public void testObtainingHandlerForResponseByAcceptHeader() throws 
Exception {

// given
final DefaultContentTypeHandlerManager handlerManager = new 
DefaultContentTypeHandlerManager();
handlerManager.setContainer(new DummyContainer("application/json", 
"json"));

MockHttpServletRequest request = new MockHttpServletRequest();
request.setContentType("application/json;charset=UTF-8");
request.addHeader("accept","application/json;charset=UTF-8");
request.setRequestURI("/index");

final MockHttpServletResponse response = new MockHttpServletResponse();
response.setContentType("application/json;charset=UTF-8");

// when
ContentTypeHandler handler = 
handlerManager.getHandlerForResponse(request,response);

// then
assertNotNull(handler);
assertEquals("application/json", handler.getContentType());
assertEquals("json", handler.getExtension());
}
{code}
the output show the failure to acquire a handler:
{code:java}
junit.framework.AssertionFailedError: null

at junit.framework.Assert.fail(Assert.java:47)
at junit.framework.Assert.assertTrue(Assert.java:20)
at junit.framework.Assert.assertNotNull(Assert.java:214)
at junit.framework.Assert.assertNotNull(Assert.java:207)
at 
org.apache.struts2.rest.DefaultContentTypeHandlerManagerTest.testObtainingHandlerForResponseByAcceptHeader(DefaultContentTypeHandlerManagerTest.java:104)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at junit.framework.TestCase.runTest(TestCase.java:168)
at junit.framework.TestCase.runBare(TestCase.java:134)
at junit.framework.TestResult$1.protect(TestResult.java:110)
at junit.framework.TestResult.runProtected(TestResult.java:128)
at junit.framework.TestResult.run(TestResult.java:113)
at junit.framework.TestCase.run(TestCase.java:124)
at junit.framework.TestSuite.runTest(TestSuite.java:243)
at junit.framework.TestSuite.run(TestSuite.java:238)
at 
org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:83)
at org.junit.runner.JUnitCore.run(JUnitCore.java:157)
at 
com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
at 
com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:234)
at 
com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:74)
{code}

FWIW: Attached is a modified version of the 2.3.24.1 file that implements this

  was:
Currently the rest plugin primarily looks at the url extension to connect the 
proper content type handlers.  This should be extended to use the Accept and 
Content-Type headers to drive the content-type handlers when no extension is 
present.  Note that the plugin currently partially handles the case for input 
request using the content-type header, but can be overridden by the extension.

In a use case,  if a request specifies in the header that the Content-Type is 
application/json, the input request data is converted to the json data format. 
If a request specifies the Accept:application/json header ,  the output data 
will be converted to json.  This is cleaner than specifying the extension in a 
lot of cases where the application rest urls have to be generated in javascript.

a short unit test shows how the accept header is ignored:
{code:java}
public void testObtainingHandlerForResponseByAcceptHeader() throws 
Exception {

// given
final DefaultContentTypeHandlerManager handlerManager = new 

[jira] [Commented] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Rich P Peters, II (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15099003#comment-15099003
 ] 

Rich P Peters, II commented on WW-4585:
---

Aleksander,  thanks for the fix.  I tested it, and it showed another issue 
which I had addressed in the code I provided:
Here is a test of it.  would you like me to file a separate issue for this?

The code I provided actually fixed a second issue with a complex id:

{code:java}
public void testMappingWithMethodAndId() throws Exception {

req.setRequestURI("/myapp/animals/dog/fido/test/some-url!update;jsessionid=29fefpv23do1g");
req.setServletPath("/animals/dog/fido/test/some-url");
req.setMethod("GET");
mapper.setAllowDynamicMethodCalls("true");
ActionMapping mapping = mapper.getMapping(req, configManager);

assertEquals("/animals", mapping.getNamespace());
assertEquals("dog", mapping.getName());
assertEquals("fido/test/some-url", ((String[]) 
mapping.getParams().get("id"))[0]);
assertEquals("update", mapping.getMethod());
}
{code}

> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Comment Edited] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Rich P Peters, II (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15099003#comment-15099003
 ] 

Rich P Peters, II edited comment on WW-4585 at 1/14/16 10:18 PM:
-

Aleksander,  thanks for the fix.  I tested it, and it showed another issue 
which I had addressed in the code I provided:
Here is a test of it.  would you like me to file a separate issue for this?

The code I provided actually fixed a second issue with a complex id:

{code:java}
public void testMappingWithMethodAndId() throws Exception {

req.setRequestURI("/myapp/animals/dog/fido/test/some-url!update;jsessionid=29fefpv23do1g");
req.setServletPath("/animals/dog/fido/test/some-url");
req.setMethod("GET");
mapper.setAllowDynamicMethodCalls("true");
ActionMapping mapping = mapper.getMapping(req, configManager);

assertEquals("/animals", mapping.getNamespace());
assertEquals("dog", mapping.getName());
assertEquals("fido/test/some-url", ((String[]) 
mapping.getParams().get("id"))[0]);
assertEquals("update", mapping.getMethod());
}
{code}
Here is the test:

{code:java}
junit.framework.ComparisonFailure: null 
Expected :dog
Actual   :dog/fido
  
{code}


was (Author: rpii):
Aleksander,  thanks for the fix.  I tested it, and it showed another issue 
which I had addressed in the code I provided:
Here is a test of it.  would you like me to file a separate issue for this?

The code I provided actually fixed a second issue with a complex id:

{code:java}
public void testMappingWithMethodAndId() throws Exception {

req.setRequestURI("/myapp/animals/dog/fido/test/some-url!update;jsessionid=29fefpv23do1g");
req.setServletPath("/animals/dog/fido/test/some-url");
req.setMethod("GET");
mapper.setAllowDynamicMethodCalls("true");
ActionMapping mapping = mapper.getMapping(req, configManager);

assertEquals("/animals", mapping.getNamespace());
assertEquals("dog", mapping.getName());
assertEquals("fido/test/some-url", ((String[]) 
mapping.getParams().get("id"))[0]);
assertEquals("update", mapping.getMethod());
}
{code}

> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Resolved] (WW-3010) s:iterator fails to iterate over collections containing null

2016-01-14 Thread Aleksandr Mashchenko (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-3010?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Aleksandr Mashchenko resolved WW-3010.
--
Resolution: Fixed

Fixed in WW-4312

> s:iterator fails to iterate over collections containing null
> 
>
> Key: WW-3010
> URL: https://issues.apache.org/jira/browse/WW-3010
> Project: Struts 2
>  Issue Type: Bug
>Affects Versions: 2.0.14
> Environment: any
>Reporter: Daniel Baldes
> Fix For: 2.5
>
>
> When using the struts2 taglib's iterator tag to iterate over a collection 
> which contains nulls, the current value ("id") is not set to null, but to the 
> value it had in the last iteration before. This behaviour is explicitly coded 
> without any obvious reason. See IteratorComponent.java from line 219:
> {code:java}
> if ((id != null) && (currentValue != null)) {
> //pageContext.setAttribute(id, currentValue);
> //pageContext.setAttribute(id, currentValue, 
> PageContext.REQUEST_SCOPE);
> stack.getContext().put(id, currentValue);
> }
> {code}
> Expected behaviour: just iterate over the null values as a plain java 
> iterator would.
> If nulls are forbidden for some important reason, it should throw an 
> execption, but not return a wrong value.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Hudson (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098577#comment-15098577
 ] 

Hudson commented on WW-4585:


SUCCESS: Integrated in Struts-JDK7-master #407 (See 
[https://builds.apache.org/job/Struts-JDK7-master/407/])
WW-4585 Struts2 Rest plugin doesn't handle JSESSIONID with DMI (amashchenko: 
rev e0003f0471f98d5986844cd799555618aae88fce)
* plugins/rest/src/test/java/org/apache/struts2/rest/RestActionMapperTest.java
* plugins/rest/src/main/java/org/apache/struts2/rest/RestActionMapper.java


> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Comment Edited] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Aleksandr Mashchenko (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098567#comment-15098567
 ] 

Aleksandr Mashchenko edited comment on WW-4585 at 1/14/16 7:03 PM:
---

[~rpii] Fixed it in master branch also which has newer version than 2.3.24.1, 
that's why fix is different from yours. Next time try to preserve original 
source formatting when submitting patches/PR-s. Thank you for reporting. :)


was (Author: aleksandr-m):
[~rpii] Fixed it in master branch also which has newer version than 2.3.34.1, 
that's why fix is different from yours. Next time try to preserve original 
source formatting when submitting patches/PR-s. Thank you for reporting. :)

> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Reopened] (WW-4543) Wrong Filter code in the documentation

2016-01-14 Thread Andrea Ligios (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4543?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Andrea Ligios reopened WW-4543:
---

The filter code is still wrong, because it has 

org.apache.struts2.dispatcher.filter.ng.StrutsPrepareAndExecuteFilter

while the correct FQCN is 

org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter

( as noted in this Q: 
http://stackoverflow.com/questions/34795076/struts-2-java-lang-classnotfoundexception
 )

> Wrong Filter code in the documentation
> --
>
> Key: WW-4543
> URL: https://issues.apache.org/jira/browse/WW-4543
> Project: Struts 2
>  Issue Type: Bug
>  Components: Documentation
>Reporter: Andrea Ligios
>
> The filter in the webxml page of the documentation ( 
> http://struts.apache.org/docs/webxml.html ) has a wrong package: 
> It is 
> org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter
> it should be 
> org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
> As it is now, it is highly misleading.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4584) Upgrade Tiles 3 pugin to latest available Tiles 3 version

2016-01-14 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4584?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15101352#comment-15101352
 ] 

ASF GitHub Bot commented on WW-4584:


Github user lukaszlenart commented on the pull request:

https://github.com/apache/struts/pull/73#issuecomment-171891083
  
> In my experiments the tiles.xml was only loaded one time, at first 
request.

Yes, it was clarified during my discussion on Tiles Users mailing list


> Upgrade Tiles 3 pugin to latest available Tiles 3 version
> -
>
> Key: WW-4584
> URL: https://issues.apache.org/jira/browse/WW-4584
> Project: Struts 2
>  Issue Type: Improvement
>  Components: Plugin - Tiles
>Reporter: Lukasz Lenart
> Fix For: 2.5
>
>




--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Resolved] (WW-4381) upgrade to jasperreports 6.0

2016-01-14 Thread Rene Gielen (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4381?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Rene Gielen resolved WW-4381.
-
Resolution: Fixed

excluded dependencies that are not served from Maven Central and that are not 
needed during build

> upgrade to jasperreports 6.0
> 
>
> Key: WW-4381
> URL: https://issues.apache.org/jira/browse/WW-4381
> Project: Struts 2
>  Issue Type: Improvement
>  Components: Plugin - JasperReports
>Reporter: zhouyanming
>Assignee: Rene Gielen
> Fix For: 2.5
>
>
> JasperReportsResult.java is not compatible with jasperreports 6.0



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4543) Wrong Filter code in the documentation

2016-01-14 Thread Lukasz Lenart (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4543?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098834#comment-15098834
 ] 

Lukasz Lenart commented on WW-4543:
---

Thanks & done :)
https://cwiki.apache.org/confluence/display/WW/web.xml

> Wrong Filter code in the documentation
> --
>
> Key: WW-4543
> URL: https://issues.apache.org/jira/browse/WW-4543
> Project: Struts 2
>  Issue Type: Bug
>  Components: Documentation
>Reporter: Andrea Ligios
> Fix For: 2.3.25
>
>
> The filter in the webxml page of the documentation ( 
> http://struts.apache.org/docs/webxml.html ) has a wrong package: 
> It is 
> org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter
> it should be 
> org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
> As it is now, it is highly misleading.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4543) Wrong Filter code in the documentation

2016-01-14 Thread Lukasz Lenart (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4543?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Lukasz Lenart updated WW-4543:
--
Fix Version/s: 2.3.25

> Wrong Filter code in the documentation
> --
>
> Key: WW-4543
> URL: https://issues.apache.org/jira/browse/WW-4543
> Project: Struts 2
>  Issue Type: Bug
>  Components: Documentation
>Reporter: Andrea Ligios
> Fix For: 2.3.25
>
>
> The filter in the webxml page of the documentation ( 
> http://struts.apache.org/docs/webxml.html ) has a wrong package: 
> It is 
> org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter
> it should be 
> org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
> As it is now, it is highly misleading.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Resolved] (WW-4543) Wrong Filter code in the documentation

2016-01-14 Thread Lukasz Lenart (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4543?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Lukasz Lenart resolved WW-4543.
---
Resolution: Fixed

> Wrong Filter code in the documentation
> --
>
> Key: WW-4543
> URL: https://issues.apache.org/jira/browse/WW-4543
> Project: Struts 2
>  Issue Type: Bug
>  Components: Documentation
>Reporter: Andrea Ligios
> Fix For: 2.3.25
>
>
> The filter in the webxml page of the documentation ( 
> http://struts.apache.org/docs/webxml.html ) has a wrong package: 
> It is 
> org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter
> it should be 
> org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
> As it is now, it is highly misleading.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4588) Improve the Struts2 Rest plugin to honor Accept and Content-Type headers

2016-01-14 Thread Lukasz Lenart (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4588?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Lukasz Lenart updated WW-4588:
--
Fix Version/s: 2.5
   2.3.25

> Improve the Struts2 Rest plugin to honor Accept and Content-Type headers
> 
>
> Key: WW-4588
> URL: https://issues.apache.org/jira/browse/WW-4588
> Project: Struts 2
>  Issue Type: Improvement
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>  Labels: rest, struts2
> Fix For: 2.3.25, 2.5
>
> Attachments: DefaultContentTypeHandlerManager.java
>
>
> Currently the rest plugin primarily looks at the url extension to connect the 
> proper content type handlers.  This should be extended to use the Accept and 
> Content-Type headers to drive the content-type handlers when no extension is 
> present.  Note that the plugin currently partially handles the case for input 
> request using the content-type header, but can be overridden by the extension.
> In a use case,  if a request specifies in the header that the Content-Type is 
> application/json, the input request data is converted to the json data 
> format. If a request specifies the Accept:application/json header ,  the 
> output data will be converted to json.  This is cleaner than specifying the 
> extension in a lot of cases where the application rest urls have to be 
> generated in javascript.
> a short unit test shows how the accept header is ignored:
> {code:java}
> public void testObtainingHandlerForResponseByAcceptHeader() throws 
> Exception {
> // given
> final DefaultContentTypeHandlerManager handlerManager = new 
> DefaultContentTypeHandlerManager();
> handlerManager.setContainer(new DummyContainer("application/json", 
> "json"));
> MockHttpServletRequest request = new MockHttpServletRequest();
> request.setContentType("application/json;charset=UTF-8");
> request.addHeader("accept","application/json;charset=UTF-8");
> request.setRequestURI("/index");
> final MockHttpServletResponse response = new 
> MockHttpServletResponse();
> response.setContentType("application/json;charset=UTF-8");
> // when
> ContentTypeHandler handler = 
> handlerManager.getHandlerForResponse(request,response);
> // then
> assertNotNull(handler);
> assertEquals("application/json", handler.getContentType());
> assertEquals("json", handler.getExtension());
> }
> {code}
> the output show the failure to acquire a handler:
> {code:java}
> junit.framework.AssertionFailedError: null
>   at junit.framework.Assert.fail(Assert.java:47)
>   at junit.framework.Assert.assertTrue(Assert.java:20)
>   at junit.framework.Assert.assertNotNull(Assert.java:214)
>   at junit.framework.Assert.assertNotNull(Assert.java:207)
>   at 
> org.apache.struts2.rest.DefaultContentTypeHandlerManagerTest.testObtainingHandlerForResponseByAcceptHeader(DefaultContentTypeHandlerManagerTest.java:104)
>   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>   at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>   at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>   at java.lang.reflect.Method.invoke(Method.java:497)
>   at junit.framework.TestCase.runTest(TestCase.java:168)
>   at junit.framework.TestCase.runBare(TestCase.java:134)
>   at junit.framework.TestResult$1.protect(TestResult.java:110)
>   at junit.framework.TestResult.runProtected(TestResult.java:128)
>   at junit.framework.TestResult.run(TestResult.java:113)
>   at junit.framework.TestCase.run(TestCase.java:124)
>   at junit.framework.TestSuite.runTest(TestSuite.java:243)
>   at junit.framework.TestSuite.run(TestSuite.java:238)
>   at 
> org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:83)
>   at org.junit.runner.JUnitCore.run(JUnitCore.java:157)
>   at 
> com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
>   at 
> com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:234)
>   at 
> com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:74)
> {code}
> FWIW: Attached is a modified version of the 2.3.24.1 file that implements this



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Aleksandr Mashchenko (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Aleksandr Mashchenko updated WW-4585:
-
Summary: Struts2 Rest plugin doesn't handle JSESSIONID with DMI  (was: 
Struts2 Rest plugin doesnt handle JSESSIONID)

> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with a JSESSIONID is sent to a struts2 action, a failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMapping() throws Exception {
> req.setRequestURI("/myapp/animals/dog/fido;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("show", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Aleksandr Mashchenko (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Aleksandr Mashchenko updated WW-4585:
-
Description: 
If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a failure 
will result

see this modified unit test from the plugin unit test:
{code:java}
public void testGetJsessionIdSemicolonMappingWithMethod() throws Exception {

req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
req.setServletPath("/animals/dog/fido");
req.setMethod("GET");

mapper.setAllowDynamicMethodCalls("true");

ActionMapping mapping = mapper.getMapping(req, configManager);

assertEquals("/animals", mapping.getNamespace());
assertEquals("dog", mapping.getName());
assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
assertEquals("update", mapping.getMethod());
}
{code}

  was:
If a url with a JSESSIONID is sent to a struts2 action, a failure will result

see this modified unit test from the plugin unit test:
{code:java}
public void testGetJsessionIdSemicolonMapping() throws Exception {
req.setRequestURI("/myapp/animals/dog/fido;jsessionid=29fefpv23do1g");
req.setServletPath("/animals/dog/fido");
req.setMethod("GET");

ActionMapping mapping = mapper.getMapping(req, configManager);

assertEquals("/animals", mapping.getNamespace());
assertEquals("dog", mapping.getName());
assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
assertEquals("show", mapping.getMethod());
}
{code}


> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Resolved] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Aleksandr Mashchenko (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Aleksandr Mashchenko resolved WW-4585.
--
Resolution: Fixed

> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Rich P Peters, II (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098591#comment-15098591
 ] 

Rich P Peters, II commented on WW-4585:
---

Sorry about the formatting, Intellij reformatted it automatically.  I have 
ignore white space differences on in my diff tool.  Ill be more careful in the 
future.

> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4585) Struts2 Rest plugin doesn't handle JSESSIONID with DMI

2016-01-14 Thread Hudson (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098610#comment-15098610
 ] 

Hudson commented on WW-4585:


SUCCESS: Integrated in Struts-JDK6-support-2.3 #958 (See 
[https://builds.apache.org/job/Struts-JDK6-support-2.3/958/])
WW-4585 Struts2 Rest plugin doesn't handle JSESSIONID with DMI (amashchenko: 
rev ff4cdd967031ed21740ee555d9e0c58b2033aa0c)
* plugins/rest/src/test/java/org/apache/struts2/rest/RestActionMapperTest.java
* plugins/rest/src/main/java/org/apache/struts2/rest/RestActionMapper.java


> Struts2 Rest plugin doesn't handle JSESSIONID with DMI
> --
>
> Key: WW-4585
> URL: https://issues.apache.org/jira/browse/WW-4585
> Project: Struts 2
>  Issue Type: Bug
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>Assignee: Aleksandr Mashchenko
>Priority: Blocker
> Fix For: 2.3.25, 2.5
>
> Attachments: RestActionMapper.java
>
>
> If a url with DMI and with a JSESSIONID is sent to a Struts2 action, a 
> failure will result
> see this modified unit test from the plugin unit test:
> {code:java}
> public void testGetJsessionIdSemicolonMappingWithMethod() throws 
> Exception {
> 
> req.setRequestURI("/myapp/animals/dog/fido!update;jsessionid=29fefpv23do1g");
> req.setServletPath("/animals/dog/fido");
> req.setMethod("GET");
> mapper.setAllowDynamicMethodCalls("true");
> ActionMapping mapping = mapper.getMapping(req, configManager);
> assertEquals("/animals", mapping.getNamespace());
> assertEquals("dog", mapping.getName());
> assertEquals("fido", ((String[]) mapping.getParams().get("id"))[0]);
> assertEquals("update", mapping.getMethod());
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4507) Struts 2 XSS vulnerability with

2016-01-14 Thread Hudson (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4507?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098189#comment-15098189
 ] 

Hudson commented on WW-4507:


SUCCESS: Integrated in Struts-JDK7-master #404 (See 
[https://builds.apache.org/job/Struts-JDK7-master/404/])
WW-4507 - clone Tomcat UDecoder and use it for in query string handling 
(rgielen: rev 72471d7075681bea52046645ad7aa34e9c53751e)
* core/src/main/java/org/apache/struts2/views/util/DefaultUrlHelper.java
* 
core/src/main/java/org/apache/struts2/dispatcher/mapper/RestfulActionMapper.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/HexUtils.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/UDecoder.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/MessageBytes.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/Ascii.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/B2CConverter.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/StringCache.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/Utf8Decoder.java
* core/src/main/java/org/apache/struts2/util/URLDecoderUtil.java
* 
core/src/main/java/org/apache/struts2/dispatcher/mapper/Restful2ActionMapper.java
* core/src/test/java/org/apache/struts2/util/URLDecoderUtilTest.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/ByteChunk.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/CharChunk.java
WW-4507 - adjust Tomcat url decoding code to Log4j 2 logging used in (rgielen: 
rev a89bbe22cd2461748d595a89a254de888a415e6c)
* core/src/main/java/org/apache/struts2/util/tomcat/buf/UDecoder.java
* core/src/main/java/org/apache/struts2/util/tomcat/buf/StringCache.java


> Struts 2 XSS vulnerability with 
> -
>
> Key: WW-4507
> URL: https://issues.apache.org/jira/browse/WW-4507
> Project: Struts 2
>  Issue Type: Bug
>Affects Versions: 2.3.16.3
> Environment: Operating System:  Windows 7.  Application Server:  
> JBoss-4.2.1.GA.  Java: jdk1.5.0.11.  Developloment Framework:  Struts 
> 2.3.16.3.  Browser:  FireFox 38.0.1
>Reporter: brian neisen
>  Labels: struts2, vulnerability, xss
> Fix For: 2.3.x
>
>
> WhiteHat Security (whitehatsec.com) has found an xss vulnerability with the 
>  tag.   When loading a url in a browser with some param name, in 
> this case "myinput", and the jsp being loaded has the tag  name="myinput" id="myinput">, an alert message is popped open 
> in the browser- which is WhiteHat's method of showing the vulnerability.  
> Example url is: 
> [http://localhost:8080/sample.action?myinput=%fc%80%80%80%80%a2%fc%80%80%80%80%bE%FC%80%80%80%80%BC%FC%80%80%80%81%B7%FC%80%80%80%81%A8%FC%80%80%80%81%B3%FC%80%80%80%81%A3%FC%80%80%80%81%A8%FC%80%80%80%81%A5%FC%80%80%80%81%A3%FC%80%80%80%81%AB%FC%80%80%80%80%BE%fc%80%80%80%80%bCscript%fc%80%80%80%80%bEalert%fc%80%80%80%80%a81%fc%80%80%80%80%a9%fc%80%80%80%80%bC%fc%80%80%80%80%aFscript%fc%80%80%80%80%bE]



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4507) Struts 2 XSS vulnerability with

2016-01-14 Thread Rene Gielen (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4507?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098308#comment-15098308
 ] 

Rene Gielen commented on WW-4507:
-

We can confirm now that this is a platform issue. Especially JRE 1.5's 
URLDecoder implementation seems to be broken to the point that this non-spec 
encoding isn't rejected / filtered. The current implementation of URLDecoder in 
JRE 1.8 seems to address all issues in this space, thus it is highly 
recommended to upgrade to JRE 1.8 for production environments

Some containers such as Tomcat and Jetty circumvent broken JRE URLDecoder 
implementations by providing their own decoder for dealing with request 
parameters. JBoss 4.2.1 does not seem to be in this space.

While upcoming Struts 2.3.25 will have improved handling for some edge cases 
where URLDecoder is called by using Tomcat's UDecoder solution, this will not 
address the specific issue mentioned here. To address this, one will either 
have to upgrade the JRE to a version with non-broken URLDecoder implementation 
(preferably JRE 1.8) or a container that circumvents calls to broken URLDecoder 
implementation calls in it's Servlet API implementation.

> Struts 2 XSS vulnerability with 
> -
>
> Key: WW-4507
> URL: https://issues.apache.org/jira/browse/WW-4507
> Project: Struts 2
>  Issue Type: Bug
>Affects Versions: 2.3.16.3
> Environment: Operating System:  Windows 7.  Application Server:  
> JBoss-4.2.1.GA.  Java: jdk1.5.0.11.  Developloment Framework:  Struts 
> 2.3.16.3.  Browser:  FireFox 38.0.1
>Reporter: brian neisen
>  Labels: struts2, vulnerability, xss
> Fix For: 2.3.x
>
>
> WhiteHat Security (whitehatsec.com) has found an xss vulnerability with the 
>  tag.   When loading a url in a browser with some param name, in 
> this case "myinput", and the jsp being loaded has the tag  name="myinput" id="myinput">, an alert message is popped open 
> in the browser- which is WhiteHat's method of showing the vulnerability.  
> Example url is: 
> [http://localhost:8080/sample.action?myinput=%fc%80%80%80%80%a2%fc%80%80%80%80%bE%FC%80%80%80%80%BC%FC%80%80%80%81%B7%FC%80%80%80%81%A8%FC%80%80%80%81%B3%FC%80%80%80%81%A3%FC%80%80%80%81%A8%FC%80%80%80%81%A5%FC%80%80%80%81%A3%FC%80%80%80%81%AB%FC%80%80%80%80%BE%fc%80%80%80%80%bCscript%fc%80%80%80%80%bEalert%fc%80%80%80%80%a81%fc%80%80%80%80%a9%fc%80%80%80%80%bC%fc%80%80%80%80%aFscript%fc%80%80%80%80%bE]



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Updated] (WW-4588) Improve the Struts2 Rest plugin to honor Accept and Content-Type headers

2016-01-14 Thread Rich P Peters, II (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4588?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Rich P Peters, II updated WW-4588:
--
Attachment: DefaultContentTypeHandlerManager.java

FWIW a modified version of DefaultContentTypeHandlerManager which implements 
this feature

> Improve the Struts2 Rest plugin to honor Accept and Content-Type headers
> 
>
> Key: WW-4588
> URL: https://issues.apache.org/jira/browse/WW-4588
> Project: Struts 2
>  Issue Type: Improvement
>  Components: Plugin - REST
>Affects Versions: 2.3.24
> Environment: tomcat
>Reporter: Rich P Peters, II
>  Labels: rest, struts2
> Attachments: DefaultContentTypeHandlerManager.java
>
>
> Currently the rest plugin primarily looks at the url extension to connect the 
> proper content type handlers.  This should be extended to use the Accept and 
> Content-Type headers to drive the content-type handlers when no extension is 
> present.  Note that the plugin currently partially handles the case for input 
> request using the content-type header, but can be overridden by the extension.
> In a use case,  if a request specifies in the header that the Content-Type is 
> application/json, the input request data is converted to the json data 
> format. If a request specifies the Accept:application/json header ,  the 
> output data will be converted to json.  This is cleaner than specifying the 
> extension in a lot of cases where the application rest urls have to be 
> generated in javascript.
> a short unit test shows how the accept header is ignored:
> {code:java}
> public void testObtainingHandlerForResponseByAcceptHeader() throws 
> Exception {
> // given
> final DefaultContentTypeHandlerManager handlerManager = new 
> DefaultContentTypeHandlerManager();
> handlerManager.setContainer(new DummyContainer("application/json", 
> "json"));
> MockHttpServletRequest request = new MockHttpServletRequest();
> request.setContentType("application/json;charset=UTF-8");
> request.addHeader("accept","application/json;charset=UTF-8");
> request.setRequestURI("/index");
> final MockHttpServletResponse response = new 
> MockHttpServletResponse();
> response.setContentType("application/json;charset=UTF-8");
> // when
> ContentTypeHandler handler = 
> handlerManager.getHandlerForResponse(request,response);
> // then
> assertNotNull(handler);
> assertEquals("application/json", handler.getContentType());
> assertEquals("json", handler.getExtension());
> }
> {code}
> the output show the failure to acquire a handler:
> {code:java}
> junit.framework.AssertionFailedError: null
>   at junit.framework.Assert.fail(Assert.java:47)
>   at junit.framework.Assert.assertTrue(Assert.java:20)
>   at junit.framework.Assert.assertNotNull(Assert.java:214)
>   at junit.framework.Assert.assertNotNull(Assert.java:207)
>   at 
> org.apache.struts2.rest.DefaultContentTypeHandlerManagerTest.testObtainingHandlerForResponseByAcceptHeader(DefaultContentTypeHandlerManagerTest.java:104)
>   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>   at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>   at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>   at java.lang.reflect.Method.invoke(Method.java:497)
>   at junit.framework.TestCase.runTest(TestCase.java:168)
>   at junit.framework.TestCase.runBare(TestCase.java:134)
>   at junit.framework.TestResult$1.protect(TestResult.java:110)
>   at junit.framework.TestResult.runProtected(TestResult.java:128)
>   at junit.framework.TestResult.run(TestResult.java:113)
>   at junit.framework.TestCase.run(TestCase.java:124)
>   at junit.framework.TestSuite.runTest(TestSuite.java:243)
>   at junit.framework.TestSuite.run(TestSuite.java:238)
>   at 
> org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:83)
>   at org.junit.runner.JUnitCore.run(JUnitCore.java:157)
>   at 
> com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
>   at 
> com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:234)
>   at 
> com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:74)
> {code}
> FWIW: Attached is a modified version of the 2.3.24.1 file that implements this



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Reopened] (WW-4381) upgrade to jasperreports 6.0

2016-01-14 Thread Rene Gielen (JIRA)

 [ 
https://issues.apache.org/jira/browse/WW-4381?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Rene Gielen reopened WW-4381:
-
  Assignee: Rene Gielen

Jasper Reports 6 unfortunately introduces custom repositories in its pom to 
provide a source for org.olap4j:olap4j which cannot be found in an official 
repository. This break builds on systems behind a Maven mirror.

The solution is to exclude this dependency, since it is not required at compile 
time. Jasper Reports is marked as provided within the plugin, such that the end 
user is responsible for providing it in his project build.

> upgrade to jasperreports 6.0
> 
>
> Key: WW-4381
> URL: https://issues.apache.org/jira/browse/WW-4381
> Project: Struts 2
>  Issue Type: Improvement
>  Components: Plugin - JasperReports
>Reporter: zhouyanming
>Assignee: Rene Gielen
> Fix For: 2.5
>
>
> JasperReportsResult.java is not compatible with jasperreports 6.0



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)


[jira] [Commented] (WW-4403) JDK 8: build fails due to JavaDoc checking issues

2016-01-14 Thread Hudson (JIRA)

[ 
https://issues.apache.org/jira/browse/WW-4403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15098410#comment-15098410
 ] 

Hudson commented on WW-4403:


SUCCESS: Integrated in Struts-JDK6-support-2.3 #956 (See 
[https://builds.apache.org/job/Struts-JDK6-support-2.3/956/])
WW-4403 - add JDK 8 profile, disabling JavaDoc lint checker when (rgielen: rev 
7c4bb7e7bd9da86eee09018c007556c12f2520e1)
* pom.xml


> JDK 8: build fails due to JavaDoc checking issues
> -
>
> Key: WW-4403
> URL: https://issues.apache.org/jira/browse/WW-4403
> Project: Struts 2
>  Issue Type: Bug
>  Components: Build Management
>Affects Versions: 2.3.16.3
>Reporter: Rene Gielen
>  Labels: jdk8
> Fix For: 2.5
>
>
> JDK 8 introduced stricter checking for JavaDoc processing, causing issues 
> formerly producing warning messages to break the build.
> Basically the fix is as easy as adding the following configuration to the 
> pluginManagement section:
> {code:xml}
> 
> org.apache.maven.plugins
> maven-javadoc-plugin
> 2.9.1
> 
> private
> -Xdoclint:none
> 
> 
> {code}
> To fix and close this issue, we need a testable build though which is 
> currently blocked by WW-4402



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)