search

matiwinnetou / spring-soy-view

Google Closure Templates integration with Spring MVC
Apache License 2.0
16 stars 9 forks source link

Cookies with numbers in the name produce an exception #45

Closed vfelberg closed 10 years ago

vfelberg commented 10 years ago

Cookies with names containing a single number after a dot are interpreted by Soy as an index into a collection and their processing results in an ArrayIndexOutOfBoundsException. Example: cookie with name x.y2.1

Steps to reproduce in a browser:

After that an exception should occur in CookieResolver while processing this cookie.

An example stack trace: java.lang.IndexOutOfBoundsException: Index: 1, Size: 0 at java.util.ArrayList.rangeCheck(ArrayList.java:604) at java.util.ArrayList.set(ArrayList.java:397) at com.google.template.soy.data.SoyListData.set(SoyListData.java:201) at com.google.template.soy.data.SoyListData.putSingle(SoyListData.java:341) at com.google.template.soy.data.restricted.CollectionData.put(CollectionData.java:95) at com.google.template.soy.data.restricted.CollectionData.put(CollectionData.java:141) at pl.matisoft.soy.global.runtime.resolvers.CookieResolver.resolveData(CookieResolver.java:35) at pl.matisoft.soy.global.runtime.DefaultGlobalModelResolver.resolveData(DefaultGlobalModelResolver.java:36) at pl.matisoft.soy.SoyView.render(SoyView.java:78)

A possible fix could escape numbers in a cookie name with underscores.

matiwinnetou commented 10 years ago

Thanks for pointing this out.

matiwinnetou commented 10 years ago

Working on this, due to the nature soy handles numbers and dots I will change all numbers to _ for classes that include extra http data to soy $ij (global runtime data)

matiwinnetou commented 10 years ago

I deprecated all included runtime resolvers (1.25.4 release), therefore one should not use them. They will be removed in future release. In order to expose cookie data, request params data or any data, one should write own implementation of runtime data resolver and expose only data one needs.