Re: [7.0.0-M1] Actions not setting parameters with Multi-part forms

wt., 23 sty 2024 o 15:23 Burton Rhodes <[email protected]> napisał(a):
>
> A bit more testing reveals a few clues/issues:
> If I switch the parser to "jakarta" (instead of "jakarta-stream")
> everything works as expected.
> The jakarta-stream parser is obviously not converting the stream for
> each action field variable to a String properly
> When debugging the ParametersInterceptor (and using jakarta-stream), all
> the fields names exist in the parameters map, and their values are of
> type String, but the String value is:
> "org.apache.commons.fileupload2.core.MultipartInput$ItemInputStream@47453950"

Does it work well with Struts 6.x?

> When using the jakarta parser, I am finding that the
> "struts.multipart.maxFiles" setting is compared against the number of
> form fields in the request, not the number of files in the request.
> For example, if I have a form with 10 text fields and 1 file field and
> maxFiles=10, I will get a "Request exceeded allowed number of files"
> error.
> FYI: The maxFiles check is only made if a file exists in the request. If
> no file exists, then the multi-part form is successfully submitted
> regardless of the number of form fields

There were some doubts about how to implement this properly when using
jakarta-stream. And does it work with Struts 6.x?

> I am noticing an inconsistency in the way each parser stores the
> uploaded files in the temp dir. The jakarta parser stores the files with
> a "[uuid].tmp" extension and the "jakarta-stream" stores the uploaded
> file with the original file extension (e.g. [uuid].pdf).
> I feel like they should be the same especially if you want to swap out
> parsers at a later time.  FWIW, the *.tmp extension breaks functionality
> in my application (although it's fairly trivial to fix on my end) so my
> vote would be to keep the original file extension - but perhaps this is
> a security issue?

This shouldn't be a security issue, feel free to register a ticket.

Did you consider migration to the new upload mechanism?
https://struts.apache.org/core-developers/action-file-upload-interceptor


Cheers
Łukasz