orphan-oss / ognl

Object Graph Navigation Library
https://orphan.software
Apache License 2.0
217 stars 77 forks source link

Evaluate "false" as false #8

Closed danielfernandez closed 9 years ago

danielfernandez commented 9 years ago

OGNL currently evaluates String objects with any value to true, but this makes OGNL's boolean coercion incompatible with two other very used Expression Languages: JSP EL and Spring EL, both of which would evaluate "true" and "false" as booleans true and false, respectively (even if they diverge in their evaluation of other non-booleanish String values).

It would be great if OGNL modified this behaviour in order to evaluate "false" as false (and better even if "off" and "no" were included in the pack, but that might be asking too much ;-)).

For me, it would allow me to remove this hugely ugly, javassist-based hack from thymeleaf: https://github.com/thymeleaf/thymeleaf/blob/159f963907e9d5e3943843031845df28934adafc/src/main/java/org/thymeleaf/standard/expression/OgnlVariableExpressionEvaluator.java#L201-L261

lukaszlenart commented 9 years ago

Some real example? Ognl.getValue("true")?

danielfernandez commented 9 years ago

I'm sorry, it seems I was actually wrong and the String objects as such are being already coerced to boolean like I describe... except in the case of the ! negation operator, which was the one causing my confusion (and the one which originally caused that patch to be applied on thymeleaf). See:

        System.out.println(Ognl.getValue("true", new Object()));              // true
        System.out.println(Ognl.getValue("false", new Object()));             // false
        System.out.println(Ognl.getValue("'true'", new Object()));            // true
        System.out.println(Ognl.getValue("'false'", new Object()));           // false
        System.out.println(Ognl.getValue("true and 'true'", new Object()));   // true
        System.out.println(Ognl.getValue("true and 'false'", new Object()));  // false
        System.out.println(Ognl.getValue("!'true'", new Object()));           // false
        // But the ! operator works differently here...
        System.out.println(Ognl.getValue("!'false'", new Object()));          // false

So it is only in the way !'false' is evaluated where OGNL differs...

danielfernandez commented 9 years ago

For the record: equivalent code using Spring EL (needs the spring-expression libraries):

    public static void main(String[] args) {
        SpelExpressionParser parser = new SpelExpressionParser();
        System.out.println(evaluate(parser, "true"));
        System.out.println(evaluate(parser, "false"));
        System.out.println(evaluate(parser, "'true'"));
        System.out.println(evaluate(parser, "'false'"));
        System.out.println(evaluate(parser, "true and true"));
        System.out.println(evaluate(parser, "true and false"));
        System.out.println(evaluate(parser, "true and 'true'"));
        System.out.println(evaluate(parser, "true and 'false'"));
        System.out.println(evaluate(parser, "!'true'"));
        System.out.println(evaluate(parser, "!'false'"));
    }

    private static Object evaluate(SpelExpressionParser parser, String expression) {
        SpelExpression exp = (SpelExpression) parser.parseExpression(expression);
        return exp.getValue();
    }

Returns:

true
false
true
false
true
false
true
false
false
true
lukaszlenart commented 9 years ago

Problem is here https://github.com/jkuhnert/ognl/blob/master/src/java/ognl/OgnlOps.java#L200

non-null object means true - there is no conversion, that's why !'true' works ;-)

lukaszlenart commented 9 years ago

I have added

        if ( c == String.class )
            return Boolean.parseBoolean(String.valueOf(value));

and deployed snapshot to Sonatype, could you test that?

danielfernandez commented 9 years ago

Works perfectly for me, thanks!

lukaszlenart commented 9 years ago

but this breaks backward compatibility...

danielfernandez commented 9 years ago

Well, for that specific case (!'false') yes, it does. In thymeleaf's case it would actually allow us to remove a hack we are applying via javassist, but maybe in Struts 2 this has other uses...

lukaszlenart commented 9 years ago

I'm releasing a new version (3.0.12) but without this fix. Then I will release another version (3.1) which will include this fix.