struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Richard Vermillion (JIRA)" <>
Subject [jira] Created: (WW-3529) In xwork-core, NamedVariablePatternMatcher does not properly escape characters
Date Fri, 05 Nov 2010 19:16:43 GMT
In xwork-core, NamedVariablePatternMatcher does not properly escape characters

                 Key: WW-3529
             Project: Struts 2
          Issue Type: Bug
          Components: Other
    Affects Versions: 2.2.1
            Reporter: Richard Vermillion

The com.opensymphony.xwork2.util.NamedVariablePatternMatcher class has a bug in the compilePattern(String)
method.  The purpose of the method is to compile patterns such as "action/{foo}" to a regular
expression Pattern and extract the variable names that match each group in the regex.  In
the example given and the 2.2.1 code base, the pattern will be compiled as "action/([^/]+)".
 However, if the pattern includes characters that have special meaning to Java's regular expression
engine, they are currently not being escaped.

For example, the pattern "action.{format}" is being compiled to "action.([^/]+)" which correctly
matches "action.html" but also "actionK.html" or any other character because the '.' is not
escaped.  The bug really bites when a pattern like "{name}.{format}" is used.  This will be
compiled to "([^/]+).([^/]+)" which will match "cars.html" but not the way you expect.  Because
of greediness, it will set name = "" and format = "l".

I will submit a patch to fix this behavior on the next screen.

This message is automatically generated by JIRA.
You can reply to this email to add a comment to the issue online.

View raw message