lukaszlenart opened a new pull request, #1693: URL: https://github.com/apache/struts/pull/1693
## Summary Backports the [#1690](https://github.com/apache/struts/pull/1690) fix to the 6.x line. The WW-5535 fix in #1593 made `DefaultActionProxy.resolveMethod()` report `isMethodSpecified()=true` for wildcard-resolved methods. That interacts with `HttpMethodInterceptor`'s `if/else-if` so the class-level annotation branch becomes unreachable when the resolved method carries no method-level annotation: \`\`\`java if (invocation.getProxy().isMethodSpecified()) { Method method = action.getClass().getMethod(invocation.getProxy().getMethod()); if (AnnotationUtils.isAnnotatedBy(method, HTTP_METHOD_ANNOTATIONS)) { return doIntercept(invocation, method); } // unannotated method falls through silently } else if (AnnotationUtils.isAnnotatedBy(action.getClass(), HTTP_METHOD_ANNOTATIONS)) { return doIntercept(invocation, action.getClass()); // never reached } return invocation.invoke(); \`\`\` **Affected scenario:** \`\`\`java @HttpPost // intends to restrict the whole action to POST public class OrderAction extends ActionSupport { public String create() { ... } // no method-level annotation } \`\`\` \`\`\`xml <action name=\"order-*\" class=\"com.example.OrderAction\" method=\"{1}\"> \`\`\` `GET /order-create` resolves \`create()\` via wildcard, \`isMethodSpecified()=true\`, method has no annotation, the \`else-if\` never evaluates, and the class-level \`@HttpPost\` is ignored. ## Fix Convert \`else if\` to a standalone \`if\` so the class-level annotation check is always evaluated as a fallback when the method carries no annotation. Method-level annotations still take precedence (checked first, with early return). One-line structural change. ## Tests added Three new tests in `HttpMethodInterceptorTest`: - `testWildcardResolvedUnannotatedMethodRespectsClassLevelAnnotation` — GET rejected on a class annotated with `@AllowedHttpMethod(POST)` when the resolved method is unannotated. - `testWildcardResolvedUnannotatedMethodAllowsPostWithClassLevelAnnotation` — POST allowed on the same configuration. - `testWildcardResolvedExecuteRejectsGetThroughRealProxy` — integration coverage via a real `DefaultActionProxy` against `<action name=\"Wild-*\" method=\"{1}\">`, resolving to `ActionSupport.execute()`. ## Related - Original issue: [WW-5535](https://issues.apache.org/jira/browse/WW-5535) - 6.x line `DefaultActionProxy` change: #1593 (shipped in 6.9.0) - Same fix already merged to `main`: #1690 and follow-up integration test #1692 ## Test plan - [x] \`./mvnw -pl core test -Dtest=HttpMethodInterceptorTest -DskipAssembly\` — 16/16 pass (13 pre-existing + 3 new) - [ ] CI green -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
