You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@myfaces.apache.org by "Rene O (Created) (JIRA)" <de...@myfaces.apache.org> on 2012/01/27 09:51:45 UTC
[jira] [Created] (MYFACES-3454) composite component is not rendered
anymore with 2.1.6-SNAPSHOT
composite component is not rendered anymore with 2.1.6-SNAPSHOT
---------------------------------------------------------------
Key: MYFACES-3454
URL: https://issues.apache.org/jira/browse/MYFACES-3454
Project: MyFaces Core
Issue Type: Bug
Affects Versions: 2.1.6-SNAPSHOT
Reporter: Rene O
Priority: Blocker
If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
A testcase to reproduce this issue is attached.
http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Issue Comment Edited] (MYFACES-3454) composite component is
not rendered anymore with 2.1.6-SNAPSHOT
Posted by "Werner Punz (Issue Comment Edited) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13196381#comment-13196381 ]
Werner Punz edited comment on MYFACES-3454 at 1/30/12 8:22 PM:
---------------------------------------------------------------
It makes more sense to keep a config param to enable this behavior upon the users request.
So I reopen this issue again.
was (Author: werpu):
This needed to be fixed due to a security issue, but it makes more sense to keep a config param to enable this behavior upon the users request.
So I reopen this issue again.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3454) composite component is not
rendered anymore with 2.1.6-SNAPSHOT
Posted by "Rene O (Commented) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13194806#comment-13194806 ]
Rene O commented on MYFACES-3454:
---------------------------------
Now the question is, how can i keep my tidy project folder structure?
I have in my webapp folders like this: resources -> components -> mycomp -> mycomponent.xhtml which leads to the usage of the incorrect namespace:
xmlns:mycomp="http://java.sun.com/jsf/composite/components/mycomp"
Is there a workaround for this or am i forced by the spec to use a folder structure like this: resources -> mycomponents -> mycomponent.xhtml ?
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3454) composite component is not
rendered anymore with 2.1.6-SNAPSHOT
Posted by "Leonardo Uribe (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13294239#comment-13294239 ]
Leonardo Uribe commented on MYFACES-3454:
-----------------------------------------
Enable the param does not cause any problem. Instead, the param was added because the spec says in an explicit way that "/" is not allowed in libraryName.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Fix For: 2.0.12, 2.1.6
>
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (MYFACES-3454) composite component is not
rendered anymore with 2.1.6-SNAPSHOT
Posted by "Leonardo Uribe (Resolved) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leonardo Uribe resolved MYFACES-3454.
-------------------------------------
Resolution: Fixed
Fix Version/s: 2.1.6
2.0.12
Added this web config param.
/**
* Allow slash in the library name of a Resource.
*/
@JSFWebConfigParam(since="2.1.6, 2.0.12", defaultValue="false", expectedValues="true, false", group="resources")
public static final String INIT_PARAM_STRICT_JSF_2_ALLOW_SLASH_LIBRARY_NAME = "org.apache.myfaces.STRICT_JSF_2_ALLOW_SLASH_LIBRARY_NAME";
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Fix For: 2.0.12, 2.1.6
>
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Reopened] (MYFACES-3454) composite component is not
rendered anymore with 2.1.6-SNAPSHOT
Posted by "Werner Punz (Reopened) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Werner Punz reopened MYFACES-3454:
----------------------------------
The reason for this issue is that composite components should not have / in their namespaces additionally to the root namespace. This needed to be fixed due to a security issue, but it makes more sense to keep a config param to enable this behavior upon the users request.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3454) composite component is not
rendered anymore with 2.1.6-SNAPSHOT
Posted by "Rene O (Commented) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13194849#comment-13194849 ]
Rene O commented on MYFACES-3454:
---------------------------------
Thank you for the information.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Issue Comment Edited] (MYFACES-3454) composite component is
not rendered anymore with 2.1.6-SNAPSHOT
Posted by "Leonardo Uribe (Issue Comment Edited) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13194788#comment-13194788 ]
Leonardo Uribe edited comment on MYFACES-3454 at 1/27/12 2:29 PM:
------------------------------------------------------------------
JSF 2.0 spec section 2.6.1.3 Resource Identifiers says this about libraryName :
"... The run-time must enforce the following rules to consider a <resourceIdentifier>s valid. A <resourceIdentifier> that does not follow these rules must not be considered valid and must be ignored silently.
- The set of characters that are valid for use in the localePrefix, libraryName, and resourceVersion segments of the resource identifier is specififed as XML NameChar excluding the path separator and ‘:’ characters. The specification for XML NameChar may be seen at http://www.w3.org/TR/REC-xml/#NT-NameChar."
- A further restriction applies to libraryName. A libraryName must not be an underscore separated sequence of non-negative integers or a locale string. More rigorously, a libraryName must not match either of the following regular expressions:
■ [0-9]+(_[0-9]+)*
■ [A-Za-z]{2}(_[A-Za-z]{2}(_[A-Za-z]+)*)?
..."
so any libraryName that contain slashes like in the example (components/mycomp) is considered invalid.
was (Author: lu4242):
JSF 2.0 spec section 2.1.6.3 says this about libraryName :
"... The run-time must enforce the following rules to consider a <resourceIdentifier>s valid. A <resourceIdentifier> that does not follow these rules must not be considered valid and must be ignored silently.
- The set of characters that are valid for use in the localePrefix, libraryName, and resourceVersion segments of the resource identifier is specififed as XML NameChar excluding the path separator and ‘:’ characters. The specification for XML NameChar may be seen at http://www.w3.org/TR/REC-xml/#NT-NameChar."
- A further restriction applies to libraryName. A libraryName must not be an underscore separated sequence of non-negative integers or a locale string. More rigorously, a libraryName must not match either of the following regular expressions:
■ [0-9]+(_[0-9]+)*
■ [A-Za-z]{2}(_[A-Za-z]{2}(_[A-Za-z]+)*)?
..."
so any libraryName that contain slashes like in the example (components/mycomp) is considered invalid.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3454) composite component is not
rendered anymore with 2.1.6-SNAPSHOT
Posted by "Mike Kienenberger (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13293896#comment-13293896 ]
Mike Kienenberger commented on MYFACES-3454:
--------------------------------------------
Note that enabling "org.apache.myfaces.STRICT_JSF_2_ALLOW_SLASH_LIBRARY_NAME" may expose you to a security hole:
http://mail-archives.apache.org/mod_mbox/www-announce/201202.mbox/%3C4F33ED1F.4070007@apache.org%3E
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Fix For: 2.0.12, 2.1.6
>
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Issue Comment Edited] (MYFACES-3454) composite component is
not rendered anymore with 2.1.6-SNAPSHOT
Posted by "Werner Punz (Issue Comment Edited) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13196381#comment-13196381 ]
Werner Punz edited comment on MYFACES-3454 at 1/30/12 8:12 PM:
---------------------------------------------------------------
The reason for this issue is that composite components should not have / in their namespaces additionally to the root namespace. This needed to be fixed due to a security issue, but it makes more sense to keep a config param to enable this behavior upon the users request.
So I reopen this issue again.
was (Author: werpu):
The reason for this issue is that composite components should not have / in their namespaces additionally to the root namespace. This needed to be fixed due to a security issue, but it makes more sense to keep a config param to enable this behavior upon the users request.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3454) composite component is not
rendered anymore with 2.1.6-SNAPSHOT
Posted by "Leonardo Uribe (Commented) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13194846#comment-13194846 ]
Leonardo Uribe commented on MYFACES-3454:
-----------------------------------------
You can add a file under your WEB-INF folder ending with .taglib.xml (for example mycomp.taglib.xml) with this content:
<facelet-taglib xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facelettaglibrary_2_0.xsd"
version="2.0">
<namespace>http://java.sun.com/jsf/composite/components/mycomp</namespace>
<composite-library-name>components.mycomp</composite-library-name>
</facelet-taglib>
and create a folder called components.mycomp and add your files there.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Issue Comment Edited] (MYFACES-3454) composite component is
not rendered anymore with 2.1.6-SNAPSHOT
Posted by "Werner Punz (Issue Comment Edited) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3454?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13196381#comment-13196381 ]
Werner Punz edited comment on MYFACES-3454 at 1/30/12 8:12 PM:
---------------------------------------------------------------
This needed to be fixed due to a security issue, but it makes more sense to keep a config param to enable this behavior upon the users request.
So I reopen this issue again.
was (Author: werpu):
The reason for this issue is that composite components should not have / in their namespaces additionally to the root namespace. This needed to be fixed due to a security issue, but it makes more sense to keep a config param to enable this behavior upon the users request.
So I reopen this issue again.
> composite component is not rendered anymore with 2.1.6-SNAPSHOT
> ---------------------------------------------------------------
>
> Key: MYFACES-3454
> URL: https://issues.apache.org/jira/browse/MYFACES-3454
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.6-SNAPSHOT
> Reporter: Rene O
> Assignee: Leonardo Uribe
> Priority: Blocker
> Attachments: jsftest.war
>
>
> If you use myfaces 2.1.6-SNAPSHOT, a composite component is not rendered correctly anymore. With myfaces-2.1.5 everything is ok.
> A testcase to reproduce this issue is attached.
> http://localhost:8080/jsftest/componenttest.jsf
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira