Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Developers List" <dev@struts.apache.org>
In-Reply-To: 
 <CAMopvkMYmVAUYf2NWfx7bGvQcfHG3mCcUSk_8F+1ZovPqi=1rA@mail.gmail.com>
References: 
 <CAMopvkMYmVAUYf2NWfx7bGvQcfHG3mCcUSk_8F+1ZovPqi=1rA@mail.gmail.com>
To: "Struts Developers List" <dev@struts.apache.org>
MIME-Version: 1.0
Subject: Re: Secure parameters
Message-ID: 
 <OF67ED784E.E59E725E-ONC1257ED8.004984B2-C1257ED8.004A46F1@lex-com.net>
From: Christoph Nenning <Christoph.Nenning@lex-com.net>
Date: Thu, 8 Oct 2015 15:30:28 +0200
Content-Type: multipart/alternative;
 boundary="=_alternative 004A46EFC1257ED8_="

--=_alternative 004A46EFC1257ED8_=
Content-Type: text/plain; charset="US-ASCII"

> From: Lukasz Lenart <lukaszlenart@apache.org>
> To: Struts Developers List <dev@struts.apache.org>, 
> Date: 06.10.2015 08:28
> Subject: Secure parameters
> 
> Hi,
> 
> I have started on introducing typed parameters instead of a Map of
> objects as we have right now [1]. Basically I am trying to introduce a
> dedicated class which will represent HTTP parameters [2]. This isn't
> finished yet as I need to figure out how to handle pushing objects
> onto parameters (ie. FileuploadInterceptor is pushing files [3]) - the
> problem is that HTTP params are arrays of strings but we have used it
> internally to "transport" other objects.
> 
> Any insights welcome :)
> 
> [1] https://github.com/apache/struts/pull/53
> [2] https://github.com/apache/struts/pull/53/files#diff-12
> [3] https://github.com/apache/struts/pull/53/files#diff-18
> 
> 


Basically I love the idea to have some more meta data about each 
parameter.

I would expect new 'Parameter' interface would provide a method like 
'isExternal()' or 'isUserProvided()' but maybe this is yet to come ;)


> as I need to figure out how to handle pushing objects
> onto parameters

One way could be to add methods like these to 'Parameter':

Object getValueNonString()
Object[] getValuesNonString()
boolean hasValueNonString()


Most places dealing with parameters just need Strings. They can use 
methods 'getValue()' and 'getMultipleValue()' and don't need to cast. 
Those few places that need other types than Strings can use 'NonString' 
methods and have to cast on their own.


Regards,
Christoph

This Email was scanned by Sophos Anti Virus

--=_alternative 004A46EFC1257ED8_=--