lukaszlenart opened a new pull request, #1938: URL: https://github.com/apache/struts/pull/1938
Fixes [WW-5703](https://issues.apache.org/jira/browse/WW-5703) ## Problem `RegexFieldValidator.validateFieldValue` returns before it consults its `trim` param whenever the value trims to empty, so a whitespace-only value passes the server in *every* configuration — including the only one (`trim=false`, case-sensitive, portable regex) in which `StrutsHtmlConstraintProvider` emits a `pattern`. The browser skips `pattern` only for the empty string, so a single space was blocked client-side and accepted server-side: a false reject, which the feature's governing rule forbids. ## Fix Two cases, decided by a pre-scan of the field's validators (so the order in `validation.xml` does not matter): - The field also carries a **trimming `requiredstring`** (its default) — that rejects blank input server-side, so the bare regex is emitted as before. - Otherwise the pattern becomes **`(?:<regex>)|[\x00-\x20]*`**: the regex, or a value made only of the characters `String.trim()` strips. `requiredstring` with `trim=false` counts `" "` as non-empty and falls through to the regex's skip, so it stays in this case. The ticket's other suggestion — refuse to emit when the regex cannot match a whitespace-only string — is undecidable in general (`^\s$` matches `" "` but not `" "`), so it was dropped. `addConstraints` / `addPattern` gain a `boolean rejectsBlank` parameter; the class is unreleased (`@since 7.4.0`), so no deprecation. ## Verification - Composed pattern compiled with node 24.2.0 under the `v` flag, as browsers do: `""`, `" "`, `"\t"`, `" \t "`, `" "` pass; NBSP-only, `"ABC1"`, `" ABC12"`, `"abc"` (against `^[A-Z]{3}\d{2}$`) fail; `"ABC12"` passes — identical to the server. - `Html5ConstraintRenderingTest.testRendersPatternOnATextField` now pins the suffix end to end, proving FreeMarker's attribute escaping leaves it intact. - `RegexFieldValidatorTest.testBlankValueIsSkippedEvenWithoutTrim` pins the server-side skip the mirror depends on (the ticket's asked-for test). - `mvn test -DskipAssembly -pl core`: 3380 tests, 0 failures. - Security review and `/code-review high` both ran clean. Docs: apache/struts-site PR adds a paragraph to `client-side-validation.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
