rootvector2 commented on PR #3670: URL: https://github.com/apache/cxf/pull/3670#issuecomment-6630036012
Pushed 8b5911bf. 1. All eight filters now return when `getEntityStream()` is null, before anything reaches `IOUtils`. That covers a GET with no stream on the server and a client response with no entity, where `ClientResponseContextImpl.getEntityStream()` returns null too. 2. I've kept the default at false. The old list returned by `super` is exactly the DELETE/GET skip this PR removes, so I don't see a way to keep it for `super` callers without the default filter skipping those bodies again. A subclass doing `super.isMethodWithNoContent(m) || "PATCH".equals(m)` still returns early on bodyless GET/HEAD/OPTIONS/DELETE (missing or empty stream); the only difference it sees is that a body sent with those methods now gets verified. The Javadoc now spells out the old lists, so an override that wants them skipped entirely can list them itself. 3. Fixed rather than just tested. The filters already read the stream and return on empty content, so the `isCheckEmptyStream() && !hasEntity()` shortcut only ever added trust in `Content-Length`. It's gone; `setCheckEmptyStream` stays for config compatibility and is documented as having no effect. `testCheckEmptyStreamDoesNotTrustZeroContentLength` covers a wrongly signed body with `Content-Length: 0` on both the server and client filter. 4. Each of the eight filters has a missing-stream test now (`testGetWithoutEntityStreamIsAccepted` / `testResponseWithoutEntityIsAccepted`). All 10 new tests fail on the previous commit. The module's 34 tests pass with checkstyle and PMD, and the 118 JOSE systests in `systests/rs-security` still pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
