HttpServletRequestWrapper with Jakarta 10 - WildFly 29

[Joe Prokop]

I have an existing application that uses a HttpServletRequestWrapper to add an additional Map to our HttpServletRequest objects.  This worked fine up to and including WildFly 26.1.3 using EE8.  We are now upgrading to Jakarta 10 and the behavior is different.  I didn't find anything in the specs that indicate this should be different.  I'm wondering if this is a bug in WildFly or some known spec change that I missed.

Specifically the Map defined in our Wrapper never gets populated.  The code adds a value to the Map in a ServletFilter and passes the new Wrapper on in the chain but then in the servlet this value is missing.

Below is the debugger view in Jakarta 10.  My Map (params) is empty and strangely there are nested request objects.  In EE8 with the same code there is no nested request object.  

[Paul Ferraro]

Can you attach your HttpServletRequestWrapper and ServetFilter classes?

--
You received this message because you are subscribed to the Google Groups "WildFly" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wildfly+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wildfly/f70c8efb-46d3-461a-bfa7-b3d021e0e7acn%40googlegroups.com.

[Joe Prokop]

So I worked around the issue but I'm not sure if this is a bug in WildFly or an issue in our code.  I'll post this to possibly help someone else with this issue or identify if it is a WildFly issue.

Background:  In the application I'm maintaining someone decided a long time ago to add a wrapper on the request to sanitize the parameters coming in based on several rules which are not important to the issue.  This wrapper just takes the parameters and dumps them in a HashMap so they can be modified by the santization methods.  A standard HttpRequest object cannot modify parameters.  This way servlets get sanitized values without any code changes in them.

This code works fine for a basic request to a servlet with a single jsp response in EE10 however it is not working when we have a JSP that nests and includes other JSP's.  Inside the included JSP, the Request object has a no values for the "params" variable that we added in our wrapper.  In WildFly 26 with EE8, the params variable persisted into the included JSP request object.

My modification allows the application to function however it requires that I sanitize the parameters again at every nested level of the jsp includes.  If you look into my modified code you'll see that I get the parameter from the parent request if it is not in the "params" variable.  The filter logic which is not shown then has to run again and santize the values which populates the "params" Map with the corrected values again.

The jsp include looks like this where we add a parameter to identify the portlet which has its state objects in a session.  In the calling JSP everything is fine, in the portlet.jsp the "params" variable in the wrapper is blank with the original code.

<jsp:include page="portlet.jsp">

<jsp:param value="<%= i %>" name="portletIndex"/>

</jsp:include>

[Martin Choma]

Hello Joe. That seems suspicious. Could you put some simple reproducer project together so we can give a try?