Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@struts.apache.org
Date: Thu, 18 Aug 2016 02:56:22 +0000 (UTC)
From: "Zoran Avtarovski (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12997773.1471396928000.339682.1471488982308@Atlassian.JIRA>
In-Reply-To: <JIRA.12997773.1471396928000@Atlassian.JIRA>
References: <JIRA.12997773.1471396928000@Atlassian.JIRA> <JIRA.12997773.1471396928097@arcas>
Subject: [jira] [Commented] (WW-4677) I18N Interceptor Automatically
 validates locales
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 18 Aug 2016 02:56:24 -0000


    [ https://issues.apache.org/jira/browse/WW-4677?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15425837#comment-15425837 ] 

Zoran Avtarovski commented on WW-4677:
--------------------------------------

Thanks Lukasz,

I see the issue nut in reality, it's only an issue if you display the locale. Which can be accommodated by setting the default behaviour to validate.

We could add some simple validation to ensure no special characters are included in the request. All I did was run a simple regex to remove potentially dangerous characters :

{code:java}
String result = localeParameter.replaceAll("[%{}+.^:,]","");
{code}

I'll leave it up to you guys. Just let me know if you'd like me to submit a patch. 

I looked at it a little further and I think using a struts constant is the least intrusive way.

Z.

> I18N Interceptor Automatically validates locales
> ------------------------------------------------
>
>                 Key: WW-4677
>                 URL: https://issues.apache.org/jira/browse/WW-4677
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: Core Interceptors
>    Affects Versions: 2.5
>         Environment: 2.5.1 running on Java 8, RHEL Linux 6/7 
>            Reporter: Zoran Avtarovski
>             Fix For: 2.5.3
>
>
> There is an annoying issue with the I18N Interceptor, which now validates locales against the list of default available locales in this bit of code:
> {code:java}
> if (locale != null && Arrays.asList(Locale.getAvailableLocales()).contains(locale)) {
>     locale = Locale.getDefault();
> }
> {code}
> The problem is I have a web app for refugees and not all the languages are in the available locales array. This must be relatively new as it worked in the old version 2.x ish.
> Ideally it would be great if we could add a parameter (or constant) to bi-pass the validation.
> For example a tag in the struts.xml file:
> {code:xml}
> <interceptor-ref name="I18nInterceptor">
>   <param name="validation">
>      false
>   </param>
> </interceptor-ref>
> {code}
> and then access it in the interceptor to override default behaviour.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)