[TOBAGO-2121] AuthorizationHelper fails which composite component attribute as method parameter

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.0.0
• Fix Version/s: 5.1.0
• Component/s: Core
• Assignee: Udo Schnurpfeil
• Reporter: Carsten Dimmek
• Created: 24/Mar/22 17:09
• Updated: 06/Jul/22 11:50
• Resolved: 22/Jun/22 09:55

Description

I have a custom component which uses  cc.attrs.value as method argument

 

 

<cc:interface>
<cc:attribute name="value" type="String"/>
</cc:interface>

<cc:implementation>
<tc:link action="#{someController.viewDetails(cc.attrs.value, facesContext)}" />
...

 

 

The AuthorizationHelper fails with an StringIndexOutOfBoundsException

 

java.lang.StringIndexOutOfBoundsException: begin 39, end 38, length 60
    at java.base/java.lang.String.checkBoundsBeginEnd(Unknown Source) ~[na:na]
    at java.base/java.lang.String.substring(Unknown Source) ~[na:na]
    at org.apache.myfaces.tobago.internal.util.AuthorizationHelper.getSecurityAnnotation(AuthorizationHelper.java:166) ~[tobago-core-5.0.0.jar!/:5.0.0]
    at org.apache.myfaces.tobago.internal.util.AuthorizationHelper.isAuthorized(AuthorizationHelper.java:81) ~[tobago-core-5.0.0.jar!/:5.0.0]
    at org.apache.myfaces.tobago.internal.component.AbstractUICommandBase.isAllowed(AbstractUICommandBase.java:128) ~[tobago-core-5.0.0.jar!/:5.0.0]
    at org.apache.myfaces.tobago.internal.component.AbstractUICommandBase.isDisabled(AbstractUICommandBase.java:120) ~[tobago-core-5.0.0.jar!/:5.0.0]
    at org.apache.myfaces.tobago.internal.renderkit.renderer.CommandRendererBase.encodeBeginInternal(CommandRendererBase.java:67) ~[tobago-core-5.0.0.jar!/:5.0.0]
    at org.apache.myfaces.tobago.internal.renderkit.renderer.CommandRendererBase.encodeBeginInternal(CommandRendererBase.java:59) ~[tobago-core-5.0.0.jar!/:5.0.0]
    at org.apache.myfaces.tobago.renderkit.RendererBase.encodeBegin(RendererBase.java:87) ~[tobago-core-5.0.0.jar!/:5.0.0]
    at javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:597) ~[myfaces-api-2.3.9.jar!/:2.3.9]
    at javax.faces.component.UIComponentBase.encodeAll(UIComponentBase.java:527) ~[myfaces-api-2.3.9.jar!/:2.3.9]
    at javax.faces.component.UIComponentBase.encodeAll(UIComponentBase.java:551) ~[myfaces-api-2.3.9.jar!/:2.3.9]