spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.81k stars 5.9k forks source link

SEC-322: SavedRequest : ClassCastException when calling parameters.get(paramName) #583

Closed spring-projects-issues closed 17 years ago

spring-projects-issues commented 18 years ago

["Tomo Izumi":https://jira.spring.io/secure/ViewProfile.jspa?name=chanta](Migrated from ["SEC-322":https://jira.spring.io/browse/SEC-322?redirect=false]) said:

If you are using WebSphere and IBM JSF, the following problem happens: The fact that WebSphere container puts non-string array objects into the request parameter maps such as String object causes ClassCastException when ExceptionTranslator instanciates a new SavedRequest instance, which executes the following code in its constructor(Line #113):

//SavedRequest class . . . // Parameters Map parameters = request.getParameterMap(); Iterator paramNames = parameters.keySet().iterator();

while (paramNames.hasNext()) { String paramName = (String) paramNames.next(); String[] paramValues = (String[]) parameters.get(paramName); this.addParameter(paramName, paramValues); } . . .

Since it's happening in the constructor, I can't override this behavior,so I have to write my own SavedRequest class that does string-array type check before casting the returned value from the parameter map.

//Custom SavedRequest class . . . // Parameters Map parameters = request.getParameterMap(); Iterator paramNames = parameters.keySet().iterator(); while (paramNames.hasNext()) { String paramName = (String) paramNames.next(); Object o = parameters.get(paramName); if(o instanceof String[]){ String[] paramValues = (String[])o; this.addParameter(paramName, paramValues); } else{ //log . . . } } . . .

The bad thing was I also had to modify other classes which referenced the original SavedRequest object.

Do you think you can fix this issue in the next release?

spring-projects-issues commented 17 years ago

["Ben Alex":https://jira.spring.io/secure/ViewProfile.jspa?name=balex] said:

http://java.sun.com/j2ee/1.4/docs/api/javax/servlet/ServletRequest.html#getParameterMap() states expressly:

"an immutable java.util.Map containing parameter names as keys and parameter values as map values. The keys in the parameter map are of type String. The values in the parameter map are of type String array."

So I am uncertain why WebSphere apparently behaves otherwise.

spring-projects-issues commented 17 years ago

["Ben Alex":https://jira.spring.io/secure/ViewProfile.jspa?name=balex] said:

Added conditional as suggested by reporter, logging if non-array returned.

Checked into SVN, tests pass.

spring-projects-issues commented 17 years ago

["Tomo Izumi":https://jira.spring.io/secure/ViewProfile.jspa?name=chanta] said:

Ben,

It was jsf-ibm.jar that was causing this problem, not the WebSphere container itself. If you use Rational Web Development Platform v6.0.1 and its JSF implementation, you will run into this problem. Hopefully it will be fixed in v6.0.1.1.

Tomo