[WW-5297] Decorator not working after invalidating session

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.1.2
• Fix Version/s: 6.6.1
• Component/s: Core Tags, Plugin - SiteMesh
• Assignee: Lukasz Lenart
• Reporter: nikos dimitrakas
• Created: 27/Mar/23 14:20
• Updated: 17/Nov/24 16:05
• Resolved: 01/Oct/24 04:45

Description

When trying to upgrade from 2.5 to 6.1.2 I get a strange behaviour when decorating a jsp.

I have an action that is used to log out a user. The action is basically only invalidating the session and then goes to the jsp. One of the interceptors is using sitemesh and applies the specified decorator.

With Struts 2.5 this worked fine. But with Struts 6.1.2 (probably all the 6.x) I get an error "Session already invalidated" when getAttribute is called from org.apache.struts2.dispatcher.SessionMap. Here is the relevant part of the stacktrace:

Caused by: java.lang.IllegalStateException: getAttribute: Session already invalidated
    at org.apache.catalina.session.StandardSession.getAttribute(StandardSession.java:1148)
    at org.apache.catalina.session.StandardSessionFacade.getAttribute(StandardSessionFacade.java:102)
    at org.apache.struts2.dispatcher.SessionMap.get(SessionMap.java:157)
    at org.apache.struts2.components.UIBean.evaluateParams(UIBean.java:879)
    at org.apache.struts2.components.Head.evaluateParams(Head.java:71)
    at org.apache.struts2.components.UIBean.end(UIBean.java:550)
    at org.apache.struts2.views.jsp.ComponentTagSupport.doEndTag(ComponentTagSupport.java:40)

There is nothing about this changed behaviour in the migration guide from Struts 2.5 to 6. Is this a bug introduced in 6.x? Or is this by design? 

From what I can see, the error occurs when an s:head inside the decorator is evaluated.

 

Issue Links

• is caused by: WW-5084 Content Security Policy support
• links to: GitHub Pull Request #1060