[jira] [Created] (WW-5718) Plugin-provided default interceptor stacks omit the resource-isolation interceptors

["Lukasz Lenart (Jira)" <ji...@apache.org>]

Lukasz Lenart created WW-5718:
---------------------------------

             Summary: Plugin-provided default interceptor stacks omit the resource-isolation interceptors
                 Key: WW-5718
                 URL: https://issues.apache.org/jira/browse/WW-5718
             Project: Struts 2
          Issue Type: Improvement
            Reporter: Lukasz Lenart
             Fix For: 7.4.0, 6.12.0


{{WW-5083}} added the Fetch Metadata resource-isolation interceptor to core's {{defaultStack}} in 6.0.0, alongside {{coop}} and {{coep}}. All three are declared enabled in {{core/src/main/resources/struts-default.xml}}:

{code}<interceptor-ref name="coep">
    <param name="disabled">false</param>
    ...
<interceptor-ref name="coop">
    <param name="disabled">false</param>
    ...
<interceptor-ref name="fetchMetadata">
    <param name="disabled">false</param>
</interceptor-ref>
{code}

Two bundled plugins replace {{defaultStack}} wholesale with their own stack and set it as the package default. Both stacks were forked from {{defaultStack}} before {{WW-5083}} and were never updated, so neither carries any of the three interceptors:
* {{plugins/rest/src/main/resources/struts-plugin.xml}} — {{restDefaultStack}}, installed via {{<default-interceptor-ref name="restDefaultStack"/>}}
* {{plugins/bean-validation/src/main/resources/struts-plugin.xml}} — {{beanValidationDefaultStack}}, installed via {{<default-interceptor-ref name="beanValidationDefaultStack"/>}}

The result is that an action package extending {{rest-default}} or {{bean-validation-default}} silently loses the cross-origin request filtering and the COOP/COEP response headers that an otherwise identical {{struts-default}} package gets by default. Nothing in the configuration signals the difference, and the omission is not the outcome of a decision recorded anywhere — the interceptors simply post-date the forks.

{{config-browser}}'s {{configBrowserDefault}} delegates to {{validationWorkflowStack}}, which derives from {{defaultStack}}, so it is unaffected.

h3. Proposed change

Add {{coep}}, {{coop}} and {{fetchMetadata}} to {{restDefaultStack}} and {{beanValidationDefaultStack}}, with the same parameters {{defaultStack}} uses, positioned as they are in {{defaultStack}}.

h3. Notes
* Affects 6.x and 7.x alike: {{WW-5083}} shipped in 6.0.0, and both plugin stacks lack the interceptors on {{main}} and on {{support/struts-6-x-x}}.
* This is a behaviour change for existing REST and Bean Validation deployments: {{fetchMetadata}} rejects requests whose {{Sec-Fetch-Site}} marks them cross-site, so a REST API deliberately serving cross-origin browser clients will start seeing 403s unless it configures {{exemptedPaths}} or disables the interceptor. It should be called out in the migration notes.
* The wider point is structural: a plugin that replaces {{defaultStack}} inherits nothing from it afterwards, so every future addition to {{defaultStack}} has to be mirrored by hand into each fork. Worth considering whether these stacks can extend the core stack rather than restate it.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)