You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Tobias Bocanegra (Created) (JIRA)" <ji...@apache.org> on 2012/01/10 20:18:39 UTC
[jira] [Created] (SLING-2353) Prevent to include itself
Prevent <sling:include resource="<%= null %>" /> to include itself
------------------------------------------------------------------
Key: SLING-2353
URL: https://issues.apache.org/jira/browse/SLING-2353
Project: Sling
Issue Type: Bug
Reporter: Tobias Bocanegra
Priority: Minor
If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
then it will cause the page to keep including itself recursively making the
server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Tobias Bocanegra (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13184716#comment-13184716 ]
Tobias Bocanegra commented on SLING-2353:
-----------------------------------------
was this really intended or is this just a side effect? if you really want to include "this" resource, you can omit the resource attribute or specify resource="<%= resource %>". I'd say that when the setResource() is called with 'null', nothing should be included.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186302#comment-13186302 ]
Felix Meschberger commented on SLING-2353:
------------------------------------------
I agree: We should check at the point of problem: I would assume that providing null as the value of the resource attribute is not generally the intended use by the JSP programmer. As such we should flag setting this attribute.
Then we can leave the rest unmodified -- and it is also the simplest possible check.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186780#comment-13186780 ]
Carsten Ziegeler commented on SLING-2353:
-----------------------------------------
D'oh right, so far I didn't consider the difference between setting resource to null and not specifying resource at all. We shouldn't allow the first one but the second one is fine
Ok, I'll change that
However, the question is if we keep the current check or rely on recursion detection. currently a <sling:include/> would not be allowed
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Reopened] (SLING-2353) Prevent to include itself
Posted by "Tobias Bocanegra (Reopened) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tobias Bocanegra reopened SLING-2353:
-------------------------------------
I don't think that this is the right approach. If I want to include the same resource, and handle recursion detection myself, i.e. through a request attribute, I can't do this.
This bug is really about protecting agains passing a NULL attribute. If you don't agree, I'd rather WONTFIX.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13184100#comment-13184100 ]
Felix Meschberger commented on SLING-2353:
------------------------------------------
I think null is a valid use case and has always been supported. The idea is to include "this" resource with some different selector and/or extension.
We could prevent endless loops, if we would throw in this case where the target resource is this resource and no selector/extension overwrite is taking place.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Carsten Ziegeler resolved SLING-2353.
-------------------------------------
Resolution: Fixed
I've fixed this in revision 1230926
As we allowed null explicitly in the past, i kept this.
But I added an additional check: if the resource is the same as the current and no
other attribute has been specified to alter the include, it throws an exception
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Carsten Ziegeler resolved SLING-2353.
-------------------------------------
Resolution: Fixed
I've reverted the previous commit and introduced to throw a NPE if
setResource is called with a null resource
Revision 1232327
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.6
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13184095#comment-13184095 ]
Carsten Ziegeler commented on SLING-2353:
-----------------------------------------
The question is if we want to allow null or throw an NPE?
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13184927#comment-13184927 ]
Carsten Ziegeler commented on SLING-2353:
-----------------------------------------
So, you agree that null is not a valid use case, right?
But in addition, we need to check for the inclusion of the same resource without new extension or selector, otherwise an include of just resource="<%= resource %> would end up in the same situation.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (SLING-2353) Prevent to include itself
Posted by "Tobias Bocanegra (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tobias Bocanegra updated SLING-2353:
------------------------------------
Component/s: Scripting
Affects Version/s: Scripting JSP-Taglib 2.1.2
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Assigned] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Assigned) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Carsten Ziegeler reassigned SLING-2353:
---------------------------------------
Assignee: Carsten Ziegeler
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186352#comment-13186352 ]
Felix Meschberger commented on SLING-2353:
------------------------------------------
> <sling:include> with a null resource (whether specified as null or defaulted to null) doesn't appear to have any value other than backwards compatibility.
> It's certainly not an elegant way to include self, nor does it appear to be the only way.
That's not entirely correct: it has been designed to also support the case of including "itself" with a different request method, selector and/or extension. For example: Consider a POST request to resource r. The POST handling script does its job and forwards to itself switching the method to GET to actually call the regular rendering scripts of resource r.
The problem here really is, that the resource is explicitly set to null, which probably is a programming error and should be flagged by throwing -- as I said -- in the resource setter and not in the endTag method dispatching the request.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Carsten Ziegeler updated SLING-2353:
------------------------------------
Fix Version/s: Scripting JSP-Taglib 2.1.4
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186782#comment-13186782 ]
Felix Meschberger commented on SLING-2353:
------------------------------------------
> However, the question is if we keep the current check or rely on recursion detection. currently a <sling:include/> would not be allowed
I'd remove the check and rely on recursion detection (see also Tobias' comment above)
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Tobias Bocanegra (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13185066#comment-13185066 ]
Tobias Bocanegra commented on SLING-2353:
-----------------------------------------
including the same resource with same selectors, extensions is a valid but agreeable ugly use case. the JSP logic might abort the recursion based on other conditions, e.g. an object in the request attributes.
i'm ok with throwing IllegalArgumentException.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186736#comment-13186736 ]
Carsten Ziegeler commented on SLING-2353:
-----------------------------------------
Ok, I think we have several things to consider here:
- null has been allowed and is explicitely handled inside the jsp tag - I guess at the time this was implemented this was seen as convenience. So I really think we should continue to support this as users might rely on this behaviour (I personally would consider this a programming error but then I wouldn't have allowed null in the first place)
- What is the value of incluing "self" without changing anything like resource type, selector or extension? If we really see a value here (I don't), then I agree WONTFIX is right
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13184111#comment-13184111 ]
Carsten Ziegeler commented on SLING-2353:
-----------------------------------------
Makes sense: +1
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186755#comment-13186755 ]
Felix Meschberger commented on SLING-2353:
------------------------------------------
> I personally would consider this a programming error but then I wouldn't have allowed null in the first place
That's not correct ;-) It has always been considered a valid use case to redirect to self by *not* specifying either the resource or the path attribute. This is fine, I hold this has been designed like this and works perfectly.
What I really consider a programming error is explicitly state resource=null as in the original issue comment. So, not specifying resource at all and explicitly setting it to null is not the same: The former is supported by design the latter really is a programming error IMHO.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Closed] (SLING-2353) Prevent to include itself
Posted by "Carsten Ziegeler (Closed) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Carsten Ziegeler closed SLING-2353.
-----------------------------------
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.6
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13184979#comment-13184979 ]
Felix Meschberger commented on SLING-2353:
------------------------------------------
I agree that resource="<%= null %>" is probably not a valid use case, yes
But not setting the resource at all, which today basically is the same, is a perfectly valid and must still be possible.
But yes, it must be checked that before finally including the resource, that it is either a different resource or some different extensions/selectors.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Felix Meschberger (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13184862#comment-13184862 ]
Felix Meschberger commented on SLING-2353:
------------------------------------------
What we could do is throw an IllegalStateException (or NullPointerException) if setResource is called with null.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Priority: Minor
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SLING-2353) Prevent to include itself
Posted by "Jeff Young (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SLING-2353?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13186296#comment-13186296 ]
Jeff Young commented on SLING-2353:
-----------------------------------
<sling:include> with a null resource (whether specified as null or defaulted to null) doesn't appear to have any value other than backwards compatibility. It's certainly not an elegant way to include self, nor does it appear to be the only way.
Being able to include self (with other selectors/extensions) certainly does have value, but as stated, we don't need "include null" to accomplish that.
So, if we need backward compatibility, then I'd favour WONTFIX. Otherwise, I'd favour throwing an IllegalArgumentException.
> Prevent <sling:include resource="<%= null %>" /> to include itself
> ------------------------------------------------------------------
>
> Key: SLING-2353
> URL: https://issues.apache.org/jira/browse/SLING-2353
> Project: Sling
> Issue Type: Bug
> Components: Scripting
> Affects Versions: Scripting JSP-Taglib 2.1.2
> Reporter: Tobias Bocanegra
> Assignee: Carsten Ziegeler
> Priority: Minor
> Fix For: Scripting JSP-Taglib 2.1.4
>
>
> If you add this sling:include to a JSP <sling:include resource="<%= null %>" />
> then it will cause the page to keep including itself recursively making the
> server slow. there is a recursion limitation though to prevent endless loops.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira