- Improve Dispatcher getLocale() handling if running in AppEngine.
- Implemented the same improvement to the defaultLocale logic path within
getLocale().
- Force US Locale for two tests that use date strings of the form
MM/DD/CCYY.
- When the tests/build are run in an environment with a non-US Locale
and newer JDKs the tests may fail due to inability to parse the US date
format.
Note: Was noticed on Windows 10 with JDK11, but could affect other
environments when run in a non-US Locale.
- Tests were using "text/html" which is not a valid character encoding.
No impact currently, but the tests could fail in the future if this is not
corrected. If the code is re-used elsewhere for a test of an action a
valid encoding will be needed.
- Switch to a predefined constant CharSet to get the string instead.
* Disable struts.ognl.expressionMaxLength by default for Struts 2.5.x.
- Commented out struts.ognl.expressionMaxLength line in default.properties
and provided in-place comments about its usage.
- Changed OgnlValueStack.handleOgnlException() methods to output error
instead of warn for failures to evaluate expressions due to security
constraints.
- Updated existing unit tests to compensate for change in default
behaviour.
- Added a unit test to confirm default behaviour for
struts.ognl.expressionMaxLength is disabled.
* Updated commit for disable struts.ognl.expressionMaxLength by default for
Struts 2.5.x
- Additional unit test requested by Y. Zamani for code coverage.
- Corrected accidental use of wrong (static) toString method in one test.
- Addition of a minimum struts.ognl.expressionMaxLength value permitted
by Struts 2 (128). Any value smaller than that is likely to be a
configuration error and if a user really wishes to force it they may go to
OGNL directly to do so.
* Updated commit for disable struts.ognl.expressionMaxLength by default for
Struts 2.5.x
- Removed minimum struts.ognl.expressionMaxLength (restored to previous
behaviour) as requested by Y. Zamani and L. Lenart.
- Updated unit tests to compensate for the above change.
- Changed log output from warn to error in applyExpressionMaxLength() on
exception since it will likely be considered a fatal condition.
- added some additional exclusions in struts-default.xml.
- added log warning that specifies the value of maxLength involved if
applyExpressionMaxLength(maxLength) fails.
- added null guards to two handleOgnlException() methods that could
result in an NPE with #371 changes (a null OgnlException parameter
was permissible previously, correct or not).
L. Lenart).
Added comment to explain why the log output avoids a stacktrace (due to
exceptions being re-thrown).
Updated existing ServletRedirectResultTest to supply tests that exercise
the new code paths and demonstrate expected logging.
Changed the log outputs to output full stacktraces (as suggested by
A. Mashchenko and L. Lenart).
Updated existing DefaultStaticContentLoaderTest and created a new
DefaultDispatcherErrorHandlerTest to supply tests that exercise the new
code paths and demonstrate expected logging.
Supply log warning when an IOException or IllegalStateException occurs to
better allow developers to track the failed redirect location and status
details. The exceptions are re-thrown to ensure existing flow-control
behaviour is preserved.
When getWriter() is called, utilize a finally block to ensure close is
called.
suggestion by A. Mashchenko and L. Lenart)
Changed the log outputs in this PR from info level to warn level (as per
suggestion by L. Lenart).
Note: The info level was originally chosen to make it easier to filter out
in the very unlikely case of log flood.
DefaultStaticContentLoader.
Provide informational logging for the processing of the two dispatcher
classes when an http sendError fails for the two known failure types
(IOException, IllegalStateException).
In both circumstances it is beneficial to have the developer aware of the
failures via the logs. These are not events that should be happening on a
regular basis, so there is little risk of a log flood.
DefaultStaticContentLoader didn't catch either exception type previously,
so changing it to make handling the same as DefaultDispatcherErrorHandler.
For DefaultDispatcherErrorHandler the IOException was caught with no
notice of failure previously. Now there will be an info level log output.
Previously the IllegalStateException was not caught, which resulted in the
unrecoverable exception being thrown up to the calling thread, usually
resulting in an ugly stacktrace to stdout/stderr. Now there will be an
info level log output instead.
If devMode is true, the info log outputs will include the exception
parameter to the log, so a stacktrace can be viewed for more details. If
devMode is false (production mode), then only the exception's tostring()
output will be produced.
Lukasz Lenart