lukaszlenart opened a new pull request, #1935: URL: https://github.com/apache/struts/pull/1935
Part of [WW-5702](https://issues.apache.org/jira/browse/WW-5702) — items 2, 5, 6, 8, 9, 10 and 11 (provider hygiene). Follows #1934 (scope gaps); the six html5 templates (item 12) come last. Docs: apache/struts-site PR linked below. ## What changed - **Item 2 — `data-msg-*` only on controls that submit a value.** `s:label` and unrecognised `type=` values (`HtmlControlType.UNSUPPORTED`) get no message. Select, checkbox and hidden keep the documented script hook — the ticket's literal rule ("supports at least one constraint") would have dropped it there too, contradicting the docs. - **Item 5 — `max` gets the same finiteness guard as `min`.** A `date` range on a control the developer declared numeric no longer renders `Date.toString()`; a NaN/infinite double bound is omitted. - **Item 6 — integrality decided on the decimal representation** (`BigDecimal(toString()).stripTrailingZeros().scale() <= 0`), which is also what gets rendered. `1.0000000000000000001` no longer passes as integral and shifts the step base. - **Item 8 — a provider's `type` is discarded** before rendering (case-insensitively), and the `HtmlConstraintProvider` Javadoc no longer advertises the `type="email"` override that produced a duplicate attribute. - **Item 9 — dynamic *and* declared attribute names compared case-insensitively**, as HTML does: a developer's `MAXLENGTH` wins over the derived `maxlength`; a provider's `Maxlength` yields to a declared `maxlength`. - **Item 10 — validator type must be a plain attribute name** (`[A-Za-z0-9_.-]+`) to become part of `data-msg-*`; the name is outside FreeMarker's escaping. Dots stay legal (`acme.required`), colons don't (XML namespace prefix). - **Item 11 — `EcmaScriptSafeRegex` aligned with the mode browsers actually compile `pattern` in.** HTML uses the `v` (unicode sets) flag, which is stricter than the `u` flag the class assumed: inside a class `( ) { } / |` must be escaped, a hyphen is only a range operator between two plain literals, doubled punctuators are reserved, `[^` is the class opening not a literal; outside a class `\-` is illegal and a lone `]`/`}` or a stacked quantifier (`a{2}{3}`) is an error. All of these are literals or legal in Java, so patterns like the everyday `[a-z0-9._%+-]+@` passed the allowlist and were silently dropped by the browser. Verified against node 24 and a differential corpus (every accepted pattern compiles in both engines). `HtmlControlType.OTHER` is renamed `UNSUPPORTED` — the enum is unreleased, and the constant is now load-bearing (no constraint, no message); `OTHER` conflated unknown `type` values with non-submitting components. ## Correction to the ticket Item 2 says no assertion in `StrutsHtmlConstraintProviderTest` exercises the message path. One did (`messageIsEmittedEvenForAValidatorThatContributesNoConstraint`, mock validator + real action). The constraint helper passes a null action on purpose: concrete validators need an injected `ValueStack` for `getMessage`, which a plain unit test has no container for — so message-path tests use mocks, and the new ones follow that pattern. ## Tests `mvn test -DskipAssembly -pl core`: 3358 tests, 0 failures. Every production change went red first; the two `UIBean` halves of item 9 were each re-run against the old code to confirm they fail. Three review passes (security, `/code-review high` twice — the second on the regex rewrite) landed as the second and third commits. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
