lukaszlenart opened a new pull request, #1765: URL: https://github.com/apache/struts/pull/1765
Fixes [WW-5640](https://issues.apache.org/jira/browse/WW-5640) ## What Adds first-class **WebJars** support to Struts core: client-side libraries packaged as WebJars (`org.webjars:*`, shipped under `META-INF/resources/webjars/<name>/<version>/…`) can be referenced by a **version-less logical path** and are resolved + served through Struts' existing static-content pipeline. Example: a template references `bootstrap/css/bootstrap.min.css` → Struts serves `META-INF/resources/webjars/bootstrap/5.3.8/css/bootstrap.min.css` at `<ctx>/static/webjars/bootstrap/5.3.8/css/bootstrap.min.css`. ## Why Plugins/apps currently vendor client-side assets on the classpath and re-commit them each release (the struts2-bootstrap plugin commits ~2000 files by hand). WebJars replace this with a dependency bump (auto-updatable via Renovate/Dependabot). First intended consumer: the struts2-bootstrap plugin (separate work). ## Changes - **Dependency:** `org.webjars:webjars-locator-lite:1.1.3` (MIT; single Apache-2.0 transitive dep `jspecify`; no Jackson/classpath-scanner — the variant Spring Framework 6.2 adopted). - **`WebJarUrlProvider`** (container bean, the public seam for plugins) + `DefaultWebJarUrlProvider` wrapping a singleton `WebJarVersionLocator`. - **Serving:** a `/webjars/**` branch in `DefaultStaticContentLoader` reusing existing caching; content-type map extended for fonts/svg/source-maps/json/ico. - **`<s:webjar>` tag + `<@s.webjar>` macro** emitting the resolved URL string (composes with `<s:script>`/`<s:link>`; supports `var`). - **Config:** `struts.webjars.enabled` (default `true`), `struts.webjars.allowlist` (comma-separated; empty = all). ## Security Resolution is hard-constrained to the `META-INF/resources/webjars/` root: per-segment `..`/`.` rejection and backslash rejection before the locator is called, a containment re-check on the resolved path, locator-backed resolution only (unknown webjar → null), plus the optional allowlist. Unresolved / disabled / traversal / allowlist-blocked all **fail closed** (404 when serving, empty output when building URLs). This is hardening for the new endpoint, not a fix to existing shipped behavior. ## Testing - Unit: resolution (known → versioned path/URL; unknown → empty), traversal rejection (both `resolveResourcePath` and `resolveUrl`), allowlist, disabled; content-type mappings. - Serving: 200 + content-type for a known asset, 404 for unknown, 404 when disabled (servlet-mocked). - Tag/macro: renders the resolved URL; `var` storage; empty on unresolved. - Full `core` suite: **2985 tests, 0 failures**. No regression to existing static-content serving. Backward compatible: `enabled=true` only activates the new `<staticContentPath>/webjars/**` namespace; existing `/static/**` serving is untouched. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
