WW-5713 refactor(tiles): resolve the legacy OGNL flag from the container's own ServletContext - #1961
Merged
Merged
Conversation
…ner's own ServletContext The lazy OGNL: evaluator read struts.tiles.ognl.legacy.enabled from the ServletContext of whichever Tiles Request reached it first, walking the request wrappers and catching NotAServletEnvironmentException. The Tiles container is built for exactly one ApplicationContext, so capture that context's ServletContext at construction and key the Dispatcher lookup to it. A non-servlet ApplicationContext cannot carry a Dispatcher and now gets the disabled evaluator outright. Removal-version mentions are dropped from the Javadoc, the runtime messages and the README; forRemoval = true and WW-5714 track the removal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
lukaszlenart
marked this pull request as ready for review
September 17, 2026 05:07
…ows lambda Sonar S5778 on nonServletApplicationContextFailsClosedWithoutLookup. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1890, addressing the two non-blocking review notes on it.
Fixes WW-5713
What changed
Flag lookup keyed to the container's own web application. The lazy
OGNL:evaluator readstruts.tiles.ognl.legacy.enabledfrom theServletContextof whichever TilesRequestreached it first — walking the request wrappers and catchingNotAServletEnvironmentException. A Tiles container is built for exactly oneApplicationContext, so the factory now captures that context'sServletContextat construction (ServletUtil.getServletContext) and resolvesDispatcher.getInstance(servletContext)against it.isLegacyOgnlEnabled(ServletContext)replacesisLegacyOgnlEnabled(Request); request objects no longer participate in the decision. A non-servletApplicationContextcannot carry a Dispatcher and gets the disabled evaluator outright, with no lookup.Removal version dropped from Javadoc, messages and README.
@Deprecated(since = "7.4.0", forRemoval = true)and WW-5714 already track the removal; the text no longer promises a release number.Tests
nonServletApplicationContextFailsClosedWithoutLookup— mockApplicationContext→ disabled, zero configuration resolutions, zero raw-evaluator constructions.flagIsReadFromTheOwningWebApplicationNotFromTheRequest— factory built for a web application with the flagfalse, evaluated with a request from a neighbouringServletContextwhose flag istrue→ still disabled.ServletApplicationContext;noArgInitializerPreservesLazyWebApplicationConfigurationnow configures the flag on the factory's own context, since the request no longer carries it.Tiles module: 565 run, 0 failures. Security review of the diff: clean — the captured context is always the registering application's own (
StrutsTilesListener→StrutsTilesInitializer→BasicTilesContainerFactory.createContainer), and the raw evaluator plus theOgnlRuntime.setPropertyAccessormutation remain reachable only through an explicittrue.🤖 Generated with Claude Code