myfaces-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Paul Nicolucci (JIRA)" <...@myfaces.apache.org>
Subject [jira] [Comment Edited] (MYFACES-4180) ResourceVisitOption.TOP_LEVEL_VIEWS_ONLY behavior different between MyFaces and Mojarra
Date Fri, 05 Jan 2018 13:23:00 GMT

    [ https://issues.apache.org/jira/browse/MYFACES-4180?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16313064#comment-16313064
] 

Paul Nicolucci edited comment on MYFACES-4180 at 1/5/18 1:22 PM:
-----------------------------------------------------------------

There are three methods for getting views:

1) ResourceHandler.getViewResources(...) -> This uses the ResourceVisitOptions and we can
determine to return meta-inf/web-inf depending on the value.

2) ViewHandler.getViews(...) -> This just calls through to ViewDeclarationLanguage.getViews(...):


{code:java}
Override
    public Stream<String> getViews(FacesContext facesContext, String path, int maxDepth,
ViewVisitOption... options)
    {
        Stream concatenatedStream = null;
        for (ViewDeclarationLanguage vdl : _vdlFactory.getAllViewDeclarationLanguages())
        {
            Stream stream = vdl.getViews(facesContext, path, maxDepth, options);
            if (concatenatedStream == null)
            {
                concatenatedStream = stream;
            }
            else
            {
                concatenatedStream = Stream.concat(concatenatedStream, stream);
            }
        }
        return concatenatedStream == null ? Stream.empty() : concatenatedStream;
{code}


3) ViewDeclarationLanguage.getViews(...) -> This calls through to the ResourceHandler.getViewResources(...)
and passes TOP_LEVEL_VIEWS_ONLY which with our  fix will prevent views within meta-inf/web-inf
from being returned.

API:
{code:java}
 /**
     * 
     * @since 2.3
     * @param facesContext
     * @param path
     * @param maxDepth
     * @param options
     * @return 
     */
    public Stream<java.lang.String> getViews(FacesContext facesContext, String path,

            int maxDepth, ViewVisitOption... options)
    {
        // Here by default we follow what spec javadoc says
        // "...This method works as if invoking it were equivalent to evaluating the expression:
        //     getViewResources(facesContext, start, Integer.MAX_VALUE, options) ..."
        // The problem here is ViewVisitOption != ResourceVisitOption. But whatever return
        // getViews must always have TOP_LEVEL_VIEWS_ONLY, because otherwise it will return

        // everything (css, js, ...). There is ViewVisitOption.RETURN_AS_MINIMAL_IMPLICIT_OUTCOME,
        // but this is a filter on top of the stream.
        
        return facesContext.getApplication().getResourceHandler().getViewResources(
                facesContext, path, maxDepth, ResourceVisitOption.TOP_LEVEL_VIEWS_ONLY);
{code}

An example of the implementation in FaceletViewDeclarationLanguage:


{code:java}
 @Override
    public Stream<String> getViews(FacesContext facesContext, String path, int maxDepth,
ViewVisitOption... options)
    {
        Stream<String> stream = super.getViews(facesContext, path, maxDepth, options);
        RuntimeConfig runtimeConfig = RuntimeConfig.getCurrentInstance(facesContext.getExternalContext());
            stream = stream.filter(f -> (_strategy.handles(f) && 
                    !FaceletsTemplateMappingUtils.matchTemplate(runtimeConfig, f) ) );
        if (options != null &&
            Arrays.binarySearch(options, ViewVisitOption.RETURN_AS_MINIMAL_IMPLICIT_OUTCOME)
>= 0)
        {
            stream = stream.map(f -> _strategy.getMinimalImplicitOutcome(f));
        }
        return stream;
    }
{code}


So in summary I think we are ok here. We can only get to web-inf/meta-inf if we call ResourceHandler.getViewResources
and don't pass in the TOP_LEVEL_VIEWS_ONLY parameter. This as far as I can tell is the same
behavior that is on Mojarra.





was (Author: paul.nicolucci):
There are three methods for getting views:

1) ResourceHandler.getViewResources(...) -> This uses the ResourceVisitOptions and we can
determine to return meta-inf/web-inf depending on the value.

2) ViewHandler.getViews(...) -> This just calls through to ViewDeclarationLanguage.getViews(...):


{code:java}
Override
    public Stream<String> getViews(FacesContext facesContext, String path, int maxDepth,
ViewVisitOption... options)
    {
        Stream concatenatedStream = null;
        for (ViewDeclarationLanguage vdl : _vdlFactory.getAllViewDeclarationLanguages())
        {
            Stream stream = vdl.getViews(facesContext, path, maxDepth, options);
            if (concatenatedStream == null)
            {
                concatenatedStream = stream;
            }
            else
            {
                concatenatedStream = Stream.concat(concatenatedStream, stream);
            }
        }
        return concatenatedStream == null ? Stream.empty() : concatenatedStream;
{code}


3) ViewDeclarationLanguage.getViews(...) -> This calls through to the ResourceHandler.getViewResources(...)
and passes TOP_LEVEL_VIEWS_ONLY which with our  fix will prevent views within meta-inf/web-inf
from being returned.


{code:java}
 /**
     * 
     * @since 2.3
     * @param facesContext
     * @param path
     * @param maxDepth
     * @param options
     * @return 
     */
    public Stream<java.lang.String> getViews(FacesContext facesContext, String path,

            int maxDepth, ViewVisitOption... options)
    {
        // Here by default we follow what spec javadoc says
        // "...This method works as if invoking it were equivalent to evaluating the expression:
        //     getViewResources(facesContext, start, Integer.MAX_VALUE, options) ..."
        // The problem here is ViewVisitOption != ResourceVisitOption. But whatever return
        // getViews must always have TOP_LEVEL_VIEWS_ONLY, because otherwise it will return

        // everything (css, js, ...). There is ViewVisitOption.RETURN_AS_MINIMAL_IMPLICIT_OUTCOME,
        // but this is a filter on top of the stream.
        
        return facesContext.getApplication().getResourceHandler().getViewResources(
                facesContext, path, maxDepth, ResourceVisitOption.TOP_LEVEL_VIEWS_ONLY);
{code}

So in summary I think we are ok here. We can only get to web-inf/meta-inf if we call ResourceHandler.getViewResources
and don't pass in the TOP_LEVEL_VIEWS_ONLY parameter. This as far as I can tell is the same
behavior that is on Mojarra.




> ResourceVisitOption.TOP_LEVEL_VIEWS_ONLY behavior different between MyFaces and Mojarra
> ---------------------------------------------------------------------------------------
>
>                 Key: MYFACES-4180
>                 URL: https://issues.apache.org/jira/browse/MYFACES-4180
>             Project: MyFaces Core
>          Issue Type: Bug
>          Components: JSR-372
>    Affects Versions: 2.3.0-beta
>            Reporter: Paul Nicolucci
>            Assignee: Paul Nicolucci
>             Fix For: 2.3.0
>
>         Attachments: MYFACES-4180.patch
>
>
> See the following dev discussion: http://mail-archives.apache.org/mod_mbox/myfaces-dev/201711.mbox/%3cOF507AE5DC.A54B3314-ON002581DB.006603E5-852581DB.0068095D@notes.na.collabserv.com%3e
> We need to determine what updates we want to make here and how best to make them.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message