WW-5718 fix(rest,bean-validation): add the resource-isolation interceptors to the plugin default stacks

[lukaszlenart]

Fixes WW-5718

restDefaultStack and beanValidationDefaultStack were forked from core's defaultStack before WW-5083 added coep, coop and fetchMetadata in 6.0.0 and were never brought back in step, so a package extending rest-default or struts-bean-validation silently lost the COOP/COEP response headers and the Fetch Metadata request check.

Changes

• The three refs are copied into both stacks with defaultStack's parameters, in the same slot: after conversionError, ahead of validation. A test per plugin loads struts-default.xml + struts-plugin.xml and pins that order.
• RestActionInvocation now honours a bare HTTP status returned as the result code. FetchMetadataInterceptor rejects a cross-site request by returning "403" without invoking the action; the REST result path wrapped any unknown code in a DefaultHttpHeaders whose status defaults to 200, so a JSON/XML client received 200 — for a GET, with the unexecuted model serialised. Such a code now sets the status and drops the representation; a mapped 403 result still executes as before.

Migration note

This is a behaviour change for existing REST and Bean Validation deployments. fetchMetadata rejects requests whose Sec-Fetch-Site marks them cross-site (other than top-level navigations), so a REST API deliberately serving cross-origin browser clients will answer them with 403 unless it sets fetchMetadata.exemptedPaths or fetchMetadata.disabled=true on the stack ref. To be called out in the Version Notes; the same change is due on support/struts-6-x-x (fix version 6.12.0).

Observed, left out

• csp (2020) and httpMethod (2014) are absent from both plugin stacks for the same reason; datetime/multiselect from restDefaultStack too. Not in this ticket's scope.
• JacksonXmlHandler.fromObject and JuneauXmlHandler.fromObject dereference obj.getClass() and NPE on a null target (XStreamHandler guards it). Pre-existing on main for every XML POST/PUT/DELETE under the default restrictToGet=true; a rejected cross-site XML GET now reaches the same path. Separate ticket.
• On the HTML path a 403 code without a mapped result still ends in ConfigurationException("No result defined …"), exactly as in core's DefaultActionInvocation.

Testing

mvn test -DskipAssembly -pl plugins/rest,plugins/bean-validation — green (286 + 17 tests).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud