[STR-2742] Validation always skipped with Globals.CANCEL_KEY

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2.8
• Fix Version/s: 1.2.9
• Component/s: Core
• Environment: Operating System: other; Platform: Other
• Bugzilla Id: 38374
• Assignee: Unassigned
• Reporter: Paul Benedict
• Created: 25/Jan/06 11:36
• Updated: 26/Apr/06 01:46
• Resolved: 26/Apr/06 01:46

Description

• Issue: addition of a 'org.apache.struts.taglib.html.Constants.CANCEL'
  parameter to any request will cause validation to be skipped, but the rest of
  the request processing / action invocation cycle to proceed normally

• Consequence: any action which proceeds assuming that validation has completed
  successfully and which doesn't explicitly check isCanceled() is proceeding on a
  broken assumption.

The discussion of this issue began in the struts-user list:
http://mail-archives.apache.org/mod_mbox/struts-user/200601.mbox/[e-mail]%3e

The thread continued in struts-dev list:
http://mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%3cdr169r$623$[e-mail]%3e

Most people have agreed that this is a security-related issue.