Re: [7.0.0-M1] Actions not setting parameters with Multi-part forms

Comments below...
I had no issues with the jakarta-stream parser in 6.x
Unless you think otherwise, a ticket should probably be registered for 
jakarta-stream parser as it does not set action field values correctly 
from the request stream in Struts 7 as it does in Struts 6
FWIW, I have now changed all my actions to use jakarta instead, and 
everything seems to work fine

In both Struts 6 & 7, the struts.multipart.maxFiles seems to operate the 
same
Using jakarta parser: maxFiles includes form fields.  This is confusing 
to me, but there it is. I just set the maxFiles to a larger value.
Using jakarta-stream parser: maxFiles seems to be ignored. I couldn't 
get it to cause an error regardless of the the number of files. This 
might be a bug?

Happy to register a ticket for file extension consistency
Thanks!

------ Original Message ------
From "Lukasz Lenart" <[email protected]>
To "Struts Developers List" <[email protected]>
Date 1/23/2024 10:32:19 AM
Subject Re: [7.0.0-M1] Actions not setting parameters with Multi-part 
forms

>wt., 23 sty 2024 o 15:23 Burton Rhodes <[email protected]> napisał(a):
>>
>>  A bit more testing reveals a few clues/issues:
>>  If I switch the parser to "jakarta" (instead of "jakarta-stream")
>>  everything works as expected.
>>  The jakarta-stream parser is obviously not converting the stream for
>>  each action field variable to a String properly
>>  When debugging the ParametersInterceptor (and using jakarta-stream), all
>>  the fields names exist in the parameters map, and their values are of
>>  type String, but the String value is:
>>  "org.apache.commons.fileupload2.core.MultipartInput$ItemInputStream@47453950"
>
>Does it work well with Struts 6.x?
>
>>  When using the jakarta parser, I am finding that the
>>  "struts.multipart.maxFiles" setting is compared against the number of
>>  form fields in the request, not the number of files in the request.
>>  For example, if I have a form with 10 text fields and 1 file field and
>>  maxFiles=10, I will get a "Request exceeded allowed number of files"
>>  error.
>>  FYI: The maxFiles check is only made if a file exists in the request. If
>>  no file exists, then the multi-part form is successfully submitted
>>  regardless of the number of form fields
>
>There were some doubts about how to implement this properly when using
>jakarta-stream. And does it work with Struts 6.x?
>
>>  I am noticing an inconsistency in the way each parser stores the
>>  uploaded files in the temp dir. The jakarta parser stores the files with
>>  a "[uuid].tmp" extension and the "jakarta-stream" stores the uploaded
>>  file with the original file extension (e.g. [uuid].pdf).
>>  I feel like they should be the same especially if you want to swap out
>>  parsers at a later time.  FWIW, the *.tmp extension breaks functionality
>>  in my application (although it's fairly trivial to fix on my end) so my
>>  vote would be to keep the original file extension - but perhaps this is
>>  a security issue?
>
>This shouldn't be a security issue, feel free to register a ticket.
>
>Did you consider migration to the new upload mechanism?
>https://struts.apache.org/core-developers/action-file-upload-interceptor
>
>
>Cheers
>Łukasz
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: [email protected]
>For additional commands, e-mail: [email protected]
>