[jira] [Commented] (OFBIZ-13639) Do not evaluate the computed expand/collapse link of tree widgets as an expression

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-13639?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123045#comment-18123045 ] 

ASF subversion and git services commented on OFBIZ-13639:
---------------------------------------------------------

Commit 19ae2dd2a5db7d17910cd8d4e231ea4d68365ce9 in ofbiz-framework's branch refs/heads/trunk from Mridul Pathak
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=19ae2dd2a5 ]

Fixed: Do not evaluate the expand/collapse link of tree widgets as an expression (OFBIZ-13639)

When a tree widget has no expand-collapse-request, ModelTree.getExpandCollapseRequest builds the link target from the request URI, and the tree renderers hand it to the ModelTree.ModelNode.Link constructor, which parsed it again as a FlexibleStringExpander, so that request data was evaluated as an expression. The trail parameter that MacroTreeRenderer adds to the link, which also comes from the request, was parsed the same way.

FlexibleStringExpander.getLiteral returns an instance that never parses its text. The Link constructors that take plain strings, used only by the tree renderers, now use it for the style, target and text, and the new CommonWidgetModels.Parameter.literal does the same for the trail parameter. The Link constructor that reads the XML element still evaluates expressions.


> Do not evaluate the computed expand/collapse link of tree widgets as an expression
> ----------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13639
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13639
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework/widget
>    Affects Versions: Upcoming Branch, 24.09.07
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>
> When a tree widget has no expand-collapse-request, ModelTree.getExpandCollapseRequest builds the link target from the request URI, and the tree renderers pass it to the ModelTree.ModelNode.Link constructor, which parses it again as a FlexibleStringExpander. Request data is therefore evaluated as an expression. The links built by the renderers are computed values, not widget expressions, so they should be taken literally.
> h3. Plan
> * Add a method to FlexibleStringExpander that returns an instance for a string that is never parsed.
> * Use it for the target, text and style of the Link constructors that take plain strings (used only by the tree renderers); the constructor that reads the XML element keeps evaluating expressions.
> * Add a unit test, and backport to release24.09.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)