Skip to content

Commit 75cc664

Browse files
lukaszlenartlukaszlenart
authored
Merge pull request #1060 from apache/fix/WW-5297-invalid-session
WW-5297 Fixes checking nonce of invalidated session
2 parents 48c4e3b + 0bd4266 commit 75cc664

6 files changed

Lines changed: 59 additions & 35 deletions

File tree

‎core/src/main/java/org/apache/struts2/components/UIBean.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040

4141
import javax.servlet.http.HttpServletRequest;
4242
import javax.servlet.http.HttpServletResponse;
43+
import javax.servlet.http.HttpSession;
4344
import java.io.Writer;
4445
import java.util.HashMap;
4546
import java.util.LinkedHashMap;
@@ -863,10 +864,13 @@ public void evaluateParams() {
863864
}
864865

865866
// to be used with the CSP interceptor - adds the nonce value as a parameter to be accessed from ftl files
866-
Map<String, Object> session = stack.getActionContext().getSession();
867-
Object nonceValue = session != null ? session.get("nonce") : null;
867+
HttpSession session = stack.getActionContext().getServletRequest().getSession(false);
868+
Object nonceValue = session != null ? session.getAttribute("nonce") : null;
869+
868870
if (nonceValue != null) {
869871
addParameter("nonce", nonceValue.toString());
872+
} else {
873+
LOG.debug("Session is not active, cannot obtain nonce value");
870874
}
871875

872876
evaluateExtraParams();

‎core/src/test/java/org/apache/struts2/components/UIBeanTest.java‎

Lines changed: 38 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,13 @@
2525
import org.apache.struts2.components.template.Template;
2626
import org.apache.struts2.components.template.TemplateEngine;
2727
import org.apache.struts2.components.template.TemplateEngineManager;
28+
import org.apache.struts2.dispatcher.SessionMap;
2829
import org.apache.struts2.dispatcher.StaticContentLoader;
2930
import org.springframework.mock.web.MockHttpServletRequest;
3031
import org.springframework.mock.web.MockHttpServletResponse;
32+
import org.springframework.mock.web.MockHttpSession;
3133

3234
import java.util.Collections;
33-
import java.util.HashMap;
3435
import java.util.Map;
3536

3637
import static com.opensymphony.xwork2.security.DefaultNotExcludedAcceptedPatternsCheckerTest.NO_EXCLUSION_ACCEPT_ALL_PATTERNS_CHECKER;
@@ -160,7 +161,7 @@ public TemplateEngine getTemplateEngine(Template template, String templateTypeOv
160161
try {
161162
txtFld.mergeTemplate(null, new Template(null, null, null));
162163
fail("Exception not thrown");
163-
} catch(final Exception e){
164+
} catch (final Exception e) {
164165
assertTrue(e instanceof ConfigurationException);
165166
}
166167
}
@@ -225,6 +226,7 @@ public void testSetAccesskey() {
225226
ValueStack stack = ActionContext.getContext().getValueStack();
226227
MockHttpServletRequest req = new MockHttpServletRequest();
227228
MockHttpServletResponse res = new MockHttpServletResponse();
229+
ActionContext.getContext().withServletRequest(req);
228230

229231
TextField txtFld = new TextField(stack, req, res);
230232
txtFld.setAccesskey(accesskeyValue);
@@ -238,6 +240,7 @@ public void testValueParameterEvaluation() {
238240
ValueStack stack = ActionContext.getContext().getValueStack();
239241
MockHttpServletRequest req = new MockHttpServletRequest();
240242
MockHttpServletResponse res = new MockHttpServletResponse();
243+
ActionContext.getContext().withServletRequest(req);
241244

242245
TextField txtFld = new TextField(stack, req, res);
243246
txtFld.addParameter("value", value);
@@ -250,11 +253,13 @@ public void testValueParameterRecursion() {
250253
ValueStack stack = ActionContext.getContext().getValueStack();
251254
MockHttpServletRequest req = new MockHttpServletRequest();
252255
MockHttpServletResponse res = new MockHttpServletResponse();
256+
ActionContext.getContext().withServletRequest(req);
253257

254258
stack.push(new Object() {
255259
public String getMyValue() {
256260
return "%{myBad}";
257261
}
262+
258263
public String getMyBad() {
259264
throw new IllegalStateException("Recursion detected!");
260265
}
@@ -273,11 +278,13 @@ public void testValueNameParameterNotAccepted() {
273278
ValueStack stack = ActionContext.getContext().getValueStack();
274279
MockHttpServletRequest req = new MockHttpServletRequest();
275280
MockHttpServletResponse res = new MockHttpServletResponse();
281+
ActionContext.getContext().withServletRequest(req);
276282

277283
stack.push(new Object() {
278284
public String getMyValueName() {
279285
return "getMyValue()";
280286
}
287+
281288
public String getMyValue() {
282289
return "value";
283290
}
@@ -300,6 +307,7 @@ public void testValueNameParameterGetterAccepted() {
300307
ValueStack stack = ActionContext.getContext().getValueStack();
301308
MockHttpServletRequest req = new MockHttpServletRequest();
302309
MockHttpServletResponse res = new MockHttpServletResponse();
310+
ActionContext.getContext().withServletRequest(req);
303311

304312
stack.push(new Object() {
305313
public String getMyValue() {
@@ -320,6 +328,7 @@ public void testSetClass() {
320328
ValueStack stack = ActionContext.getContext().getValueStack();
321329
MockHttpServletRequest req = new MockHttpServletRequest();
322330
MockHttpServletResponse res = new MockHttpServletResponse();
331+
ActionContext.getContext().withServletRequest(req);
323332

324333
TextField txtFld = new TextField(stack, req, res);
325334
txtFld.setCssClass(cssClass);
@@ -333,6 +342,7 @@ public void testSetStyle() {
333342
ValueStack stack = ActionContext.getContext().getValueStack();
334343
MockHttpServletRequest req = new MockHttpServletRequest();
335344
MockHttpServletResponse res = new MockHttpServletResponse();
345+
ActionContext.getContext().withServletRequest(req);
336346

337347
TextField txtFld = new TextField(stack, req, res);
338348
txtFld.setStyle(cssStyle);
@@ -347,16 +357,39 @@ public void testNonce() {
347357
MockHttpServletRequest req = new MockHttpServletRequest();
348358
MockHttpServletResponse res = new MockHttpServletResponse();
349359
ActionContext actionContext = stack.getActionContext();
350-
Map<String, Object> session = new HashMap<>();
351-
session.put("nonce", nonceVal);
352-
actionContext.withSession(session);
360+
actionContext.withServletRequest(req);
361+
MockHttpSession session = new MockHttpSession();
362+
session.putValue("nonce", nonceVal);
363+
req.setSession(session);
364+
365+
actionContext.withSession(new SessionMap(req));
353366

354367
DoubleSelect dblSelect = new DoubleSelect(stack, req, res);
355368
dblSelect.evaluateParams();
356369

357370
assertEquals(nonceVal, dblSelect.getParameters().get("nonce"));
358371
}
359372

373+
public void testNonceOfInvalidSession() {
374+
String nonceVal = "r4nd0m";
375+
ValueStack stack = ActionContext.getContext().getValueStack();
376+
MockHttpServletRequest req = new MockHttpServletRequest();
377+
MockHttpServletResponse res = new MockHttpServletResponse();
378+
ActionContext actionContext = stack.getActionContext();
379+
actionContext.withServletRequest(req);
380+
MockHttpSession session = new MockHttpSession();
381+
session.putValue("nonce", nonceVal);
382+
req.setSession(session);
383+
actionContext.withSession(new SessionMap(req));
384+
385+
session.invalidate();
386+
387+
DoubleSelect dblSelect = new DoubleSelect(stack, req, res);
388+
dblSelect.evaluateParams();
389+
390+
assertNull(dblSelect.getParameters().get("nonce"));
391+
}
392+
360393
public void testSetNullUiStaticContentPath() {
361394
// given
362395
ValueStack stack = ActionContext.getContext().getValueStack();

‎plugins/javatemplates/src/test/java/org/apache/struts2/views/java/simple/AbstractTest.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535

3636
import javax.servlet.http.HttpServletRequest;
3737
import javax.servlet.http.HttpServletResponse;
38+
import javax.servlet.http.HttpSession;
3839
import java.io.StringWriter;
3940
import java.util.HashMap;
4041
import java.util.Map;
@@ -51,6 +52,8 @@ public abstract class AbstractTest extends TestCase {
5152
private final Map<String, String> commonAttrs = new HashMap<>();
5253
private final Map<String, String> dynamicAttrs = new HashMap<>();
5354

55+
protected static final String NONCE_VAL = "r4andom";
56+
5457
protected SimpleTheme theme;
5558

5659
protected StringWriter writer;
@@ -62,6 +65,7 @@ public abstract class AbstractTest extends TestCase {
6265
protected TemplateRenderingContext context;
6366
protected HttpServletRequest request;
6467
protected HttpServletResponse response;
68+
private HttpSession session;
6569

6670
protected abstract UIBean getUIBean() throws Exception;
6771

@@ -107,6 +111,12 @@ protected void setUp() throws Exception {
107111
expect(request.getContextPath()).andReturn("/some/path").anyTimes();
108112
response = createNiceMock(HttpServletResponse.class);
109113

114+
session = createNiceMock(HttpSession.class);
115+
expect(session.getAttribute("nonce")).andReturn(NONCE_VAL).anyTimes();
116+
expect(request.getSession(false)).andReturn(session).anyTimes();
117+
118+
actionContext.withServletRequest(request);
119+
110120
expect(stack.getActionContext()).andReturn(actionContext).anyTimes();
111121
expect(stack.getContext()).andReturn(stackContext).anyTimes();
112122

@@ -116,6 +126,7 @@ protected void setUp() throws Exception {
116126
TextParser parser = new OgnlTextParser();
117127
expect(container.getInstance(TextParser.class)).andReturn(parser).anyTimes();
118128

129+
replay(session);
119130
replay(request);
120131
replay(stack);
121132
replay(container);

‎plugins/javatemplates/src/test/java/org/apache/struts2/views/java/simple/HeadTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public void testRenderTextField() {
3131
map.putAll(tag.getParameters());
3232
theme.renderTag(getTagName(), context);
3333
String output = writer.getBuffer().toString();
34-
String expected = s("<script type='text/javascript' base='/some/path' src='/some/path/static/utils.js'></script>");
34+
String expected = s("<script type='text/javascript' base='/some/path' src='/some/path/static/utils.js' nonce='r4andom'></script>");
3535
assertEquals(expected, output);
3636
}
3737

‎plugins/javatemplates/src/test/java/org/apache/struts2/views/java/simple/LinkTest.java‎

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,13 @@
1818
*/
1919
package org.apache.struts2.views.java.simple;
2020

21-
import com.opensymphony.xwork2.ActionContext;
2221
import org.apache.struts2.components.Link;
2322
import org.apache.struts2.components.UIBean;
2423

25-
import java.util.HashMap;
26-
import java.util.Map;
27-
28-
public class LinkTest extends AbstractTest{
24+
public class LinkTest extends AbstractTest {
2925

3026
private Link tag;
3127

32-
private static final String NONCE_VAL = "r4andom";
33-
3428
public void testRenderLinkTag() {
3529
tag.setHref("testhref");
3630
tag.setHreflang("test");
@@ -60,7 +54,7 @@ public void testRenderLinkTag() {
6054
assertTrue("Incorrect as attribute for link tag", output.contains(s("as='test'")));
6155
assertFalse("Non-existent disabled attribute for link tag", output.contains(s("disabled='disabled'")));
6256
assertTrue("Incorrect title attribute for link tag", output.contains(s("title='test'")));
63-
assertTrue("Incorrect nonce attribute for link tag", output.contains(s("nonce='" + NONCE_VAL+"'")));
57+
assertTrue("Incorrect nonce attribute for link tag", output.contains(s("nonce='" + NONCE_VAL + "'")));
6458
}
6559

6660
public void testRenderLinkTagAsStylesheet() {
@@ -92,7 +86,7 @@ public void testRenderLinkTagAsStylesheet() {
9286
assertTrue("Incorrect as attribute for link tag", output.contains(s("as='test'")));
9387
assertTrue("Incorrect disabled attribute for link tag", output.contains(s("disabled='disabled'")));
9488
assertTrue("Incorrect title attribute for link tag", output.contains(s("title='test'")));
95-
assertTrue("Incorrect nonce attribute for link tag", output.contains(s("nonce='" + NONCE_VAL+"'")));
89+
assertTrue("Incorrect nonce attribute for link tag", output.contains(s("nonce='" + NONCE_VAL + "'")));
9690
}
9791

9892
@Override
@@ -108,12 +102,6 @@ protected String getTagName() {
108102
@Override
109103
protected void setUp() throws Exception {
110104
super.setUp();
111-
112-
ActionContext actionContext = stack.getActionContext();
113-
Map<String, Object> session = new HashMap<>();
114-
session.put("nonce", NONCE_VAL);
115-
actionContext.withSession(session);
116-
117105
this.tag = new Link(stack, request, response);
118106
}
119107
}

‎plugins/javatemplates/src/test/java/org/apache/struts2/views/java/simple/ScriptTest.java‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,22 +18,15 @@
1818
*/
1919
package org.apache.struts2.views.java.simple;
2020

21-
import com.opensymphony.xwork2.ActionContext;
2221
import com.opensymphony.xwork2.security.DefaultNotExcludedAcceptedPatternsChecker;
2322
import org.apache.struts2.components.Script;
2423
import org.apache.struts2.components.UIBean;
2524

2625

27-
import java.util.HashMap;
28-
import java.util.Map;
29-
30-
3126
public class ScriptTest extends AbstractTest {
3227

3328
private Script tag;
3429

35-
private static final String NONCE_VAL = "r4andom";
36-
3730
public void testRenderScriptTag() {
3831
tag.setName("name_");
3932
tag.setType("text/javascript");
@@ -77,11 +70,6 @@ protected String getTagName() {
7770
protected void setUp() throws Exception {
7871
super.setUp();
7972

80-
ActionContext actionContext = stack.getActionContext();
81-
Map<String, Object> session = new HashMap<>();
82-
session.put("nonce", NONCE_VAL);
83-
actionContext.withSession(session);
84-
8573
this.tag = new Script(stack, request, response);
8674
tag.setNotExcludedAcceptedPatterns(new DefaultNotExcludedAcceptedPatternsChecker());
8775
}

0 commit comments

Comments
 (0)