WW-5718 fix(rest,bean-validation): add the resource-isolation interceptors to the plugin default stacks (6.x) - #1958
Merged
Merged
Conversation
…ptors to the plugin default stacks restDefaultStack and beanValidationDefaultStack were forked from core's defaultStack before WW-5083 added coep, coop and fetchMetadata in 6.0.0 and were never brought back in step, so a package extending rest-default or struts-bean-validation silently lost the COOP/COEP headers and the Fetch Metadata request check. The three refs are copied with defaultStack's parameters into the same slot: after conversionError, ahead of validation. (cherry picked from commit 27f3012, adapted to 6.x) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
FetchMetadataInterceptor rejects a cross-site request by returning "403" as the result code without invoking the action. RestActionInvocation wrapped any unknown code in a DefaultHttpHeaders whose status defaults to 200, so a JSON or XML client saw a 200 - carrying the unexecuted model for a GET. A bare HTTP status returned as the result code now sets the response status and drops the representation; a mapped "403" result still executes as before. (cherry picked from commit 1785661, adapted to 6.x) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
lukaszlenart
marked this pull request as ready for review
September 16, 2026 16:43
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes WW-5718 on the 6.x line — backport of #1957 (fix version 6.12.0), adapted to
com.opensymphony.xwork2packages,javax.servletand Java 8.restDefaultStackandbeanValidationDefaultStackwere forked from core'sdefaultStackbefore WW-5083 addedcoep,coopandfetchMetadatain 6.0.0 and were never brought back in step, so a package extendingrest-defaultorstruts-bean-validationsilently lost the COOP/COEP response headers and the Fetch Metadata request check.Changes
defaultStack's parameters, in the same slot: afterconversionError, ahead of validation. A test per plugin loadsstruts-default.xml+struts-plugin.xmland pins that order.RestActionInvocationnow honours a bare HTTP status returned as the result code.FetchMetadataInterceptorrejects a cross-site request by returning"403"without invoking the action; the REST result path wrapped any unknown code in aDefaultHttpHeaderswhose status defaults to 200, so a JSON/XML client received 200 — for a GET, with the unexecuted model serialised. Such a code now sets the status and drops the representation; a mapped403result still executes as before.Migration note
Behaviour change for existing REST and Bean Validation deployments:
fetchMetadatarejects requests whoseSec-Fetch-Sitemarks them cross-site (other than top-level navigations), so a REST API deliberately serving cross-origin browser clients will answer them with 403 unless it setsfetchMetadata.exemptedPathsorfetchMetadata.disabled=trueon the stack ref. To be called out in the 6.12.0 Version Notes.Testing
./mvnw test -DskipAssembly -pl plugins/rest,plugins/bean-validation— green.🤖 Generated with Claude Code