All Downloads are FREE. Search and download functionalities are using the official Maven repository.

jakarta.faces.webapp.FacesServlet Maven / Gradle / Ivy

/*
 * Copyright (c) 1997, 2020 Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2021 Contributors to Eclipse Foundation.
 *
 * This program and the accompanying materials are made available under the
 * terms of the Eclipse Public License v. 2.0, which is available at
 * http://www.eclipse.org/legal/epl-2.0.
 *
 * This Source Code may also be made available under the following Secondary
 * Licenses when the conditions for such availability set forth in the
 * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
 * version 2 with the GNU Classpath Exception, which is available at
 * https://www.gnu.org/software/classpath/license.html.
 *
 * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
 */

package jakarta.faces.webapp;

import static jakarta.faces.FactoryFinder.FACES_CONTEXT_FACTORY;
import static jakarta.faces.FactoryFinder.LIFECYCLE_FACTORY;
import static jakarta.faces.lifecycle.LifecycleFactory.DEFAULT_LIFECYCLE;
import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
import static jakarta.servlet.http.HttpServletResponse.SC_NOT_FOUND;
import static java.util.Collections.emptySet;
import static java.util.EnumSet.allOf;
import static java.util.EnumSet.range;
import static java.util.logging.Level.FINE;
import static java.util.logging.Level.FINER;
import static java.util.logging.Level.SEVERE;
import static java.util.logging.Level.WARNING;

import java.io.IOException;
import java.util.ArrayList;
import java.util.EnumSet;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.logging.Logger;

import jakarta.faces.FacesException;
import jakarta.faces.FactoryFinder;
import jakarta.faces.application.ResourceHandler;
import jakarta.faces.context.FacesContext;
import jakarta.faces.context.FacesContextFactory;
import jakarta.faces.lifecycle.Lifecycle;
import jakarta.faces.lifecycle.LifecycleFactory;
import jakarta.servlet.Servlet;
import jakarta.servlet.ServletConfig;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.UnavailableException;
import jakarta.servlet.annotation.MultipartConfig;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

/**
 * 

* FacesServlet is a Jakarta Servlet servlet that manages the request processing * lifecycle for web applications that are utilizing Jakarta Faces to construct the user interface. *

* *
* *

* If the application is running in a Jakarta Servlet 3.0 (and beyond) container, the runtime must provide an * implementation of the {@link jakarta.servlet.ServletContainerInitializer} interface that declares the following * classes in its {@link jakarta.servlet.annotation.HandlesTypes} annotation. *

* *
    * *
  • {@link jakarta.faces.annotation.FacesConfig}
  • * *
  • {@link jakarta.faces.application.ResourceDependencies}
  • * *
  • {@link jakarta.faces.application.ResourceDependency}
  • * *
  • jakarta.faces.bean.ManagedBean
  • * *
  • {@link jakarta.faces.component.FacesComponent}
  • * *
  • {@link jakarta.faces.component.UIComponent}
  • * *
  • {@link jakarta.faces.convert.Converter}
  • * *
  • {@link jakarta.faces.convert.FacesConverter}
  • * *
  • {@link jakarta.faces.event.ListenerFor}
  • * *
  • {@link jakarta.faces.event.ListenersFor}
  • * *
  • {@link jakarta.faces.render.FacesBehaviorRenderer}
  • * *
  • {@link jakarta.faces.render.Renderer}
  • * *
  • {@link jakarta.faces.validator.FacesValidator}
  • * *
  • {@link jakarta.faces.validator.Validator}
  • * *
* *

* This Jakarta Servlet servlet must automatically be mapped if it is not explicitly mapped in * web.xml or web-fragment.xml and one or more of the following conditions are true. *

* *
    * *
  • *

    * A faces-config.xml file is found in WEB-INF *

    *
  • * *
  • *

    * A faces-config.xml file is found in the META-INF directory of a jar in the application's * classpath. *

    *
  • * *
  • *

    * A filename ending in .faces-config.xml is found in the META-INF directory of a jar in the * application's classpath. *

    *
  • * *
  • *

    * The jakarta.faces.CONFIG_FILES context param is declared in web.xml or * web-fragment.xml. *

    *
  • * *
  • *

    * The Set of classes passed to the onStartup() method of the * ServletContainerInitializer implementation is not empty. *

    *
  • * *
* *

* If the runtime determines that the servlet must be automatically mapped, it must be mapped to the following * <url-pattern> entries. *

* *
    *
  • /faces/*
  • *
  • *.jsf
  • *
  • *.faces
  • *
  • *.xhtml
  • *
* *
* *

* Note that the automatic mapping to {@code *.xhtml} can be disabled with the context param * {@link #DISABLE_FACESSERVLET_TO_XHTML_PARAM_NAME}. *

* *
* *

* This class must be annotated with {@code jakarta.servlet.annotation.MultipartConfig}. This causes the Jakarta Servlet * container in which the Jakarta Faces implementation is running to correctly handle multipart form data. *

* *

* Some security considerations relating to this class *

* *

* The topic of web application security is a cross-cutting concern and every aspect of the specification address it. * However, as with any framework, the application developer needs to pay careful attention to security. Please consider * these topics among the rest of the security concerns for the application. This is by no means a complete list of * security concerns, and is no substitute for a thorough application level security review. *

* *
* *

* Prefix mappings and the FacesServlet *

* *

* If the FacesServlet is mapped using a prefix <url-pattern>, such as * <url-pattern>/faces/*</url-pattern>, something must be done to prevent access to the view * source without its first being processed by the FacesServlet. One common approach is to apply a * <security-constraint> to all facelet files and flow definition files. Please see the Deployment * Descriptor chapter of the Jakarta Servlet Specification for more information the use of * <security-constraint>. *

* *

* Allowable HTTP Methods *

* *

* The Jakarta Faces Specification only requires the use of the GET and POST http methods. If your web * application does not require any other http methods, such as PUT and DELETE, please consider restricting the * allowable http methods using the <http-method> and <http-method-omission> elements. Please see the * Security sections of the Jakarta Servlet Specification for more information about the use of these * elements. *

* * *
* *
*/ @MultipartConfig public final class FacesServlet implements Servlet { /** *

* Context initialization parameter name for a comma delimited list of context-relative resource paths (in addition to * /WEB-INF/faces-config.xml which is loaded automatically if it exists) containing Jakarta Faces * configuration information. *

*/ public static final String CONFIG_FILES_ATTR = "jakarta.faces.CONFIG_FILES"; /** *

* Context initialization parameter name for the lifecycle identifier of the {@link Lifecycle} instance to be utilized. *

*/ public static final String LIFECYCLE_ID_ATTR = "jakarta.faces.LIFECYCLE_ID"; /** *

* The ServletContext init parameter consulted by the runtime to tell if the automatic mapping of the * {@code FacesServlet} to the extension {@code *.xhtml} should be disabled. The implementation must disable this * automatic mapping if and only if the value of this parameter is equal, ignoring case, to {@code true}. *

* *

* If this parameter is not specified, this automatic mapping is enabled as specified above. *

*/ public static final String DISABLE_FACESSERVLET_TO_XHTML_PARAM_NAME = "jakarta.faces.DISABLE_FACESSERVLET_TO_XHTML"; /** *

* The ServletContext init parameter consulted by the runtime to tell if the automatic mapping of the * {@code FacesServlet} to the extensionless variant (without {@code *.xhtml}) should be enabled. The implementation * must enable this automatic mapping if and only if the value of this parameter is equal, ignoring case, to {@code true}. *

* *

* If this parameter is not specified, this automatic mapping is not enabled. *

*/ public static final String AUTOMATIC_EXTENSIONLESS_MAPPING_PARAM_NAME = "jakarta.faces.AUTOMATIC_EXTENSIONLESS_MAPPING"; /** * The Logger for this class. */ private static final Logger LOGGER = Logger.getLogger("jakarta.faces.webapp", "jakarta.faces.LogStrings"); /** * A white space separated list of case sensitive HTTP method names that are allowed to be processed by this servlet. * * means allow all */ private static final String ALLOWED_HTTP_METHODS_ATTR = "com.sun.faces.allowedHttpMethods"; // Http method names must be upper case. http://www.w3.org/Protocols/HTTP/NoteMethodCS.html // List of valid methods in Http 1.1 http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9 private enum HttpMethod { OPTIONS("OPTIONS"), GET("GET"), HEAD("HEAD"), POST("POST"), PUT("PUT"), DELETE("DELETE"), TRACE("TRACE"), CONNECT("CONNECT"); private String name; HttpMethod(String name) { this.name = name; } @Override public String toString() { return name; } } private final Set defaultAllowedHttpMethods = range(HttpMethod.OPTIONS, HttpMethod.CONNECT); private Set allowedUnknownHttpMethods; private Set allowedKnownHttpMethods; private Set allHttpMethods; private boolean allowAllMethods; /** *

* Factory for {@link FacesContext} instances. *

*/ private FacesContextFactory facesContextFactory; /** *

* The {@link Lifecycle} instance to use for request processing. *

*/ private Lifecycle lifecycle; /** *

* The ServletConfig instance for this servlet. *

*/ private ServletConfig servletConfig; /** * From GLASSFISH-15632. If true, the FacesContext instance left over from startup time has been released. */ private boolean initFacesContextReleased; /** *

* Acquire the factory instances we will require. *

* * @throws ServletException if, for any reason, the startup of this Faces application failed. This includes errors in * the config file that is parsed before or during the processing of this init() method. */ @Override public void init(ServletConfig servletConfig) throws ServletException { // Save our ServletConfig instance this.servletConfig = servletConfig; // Acquire our FacesContextFactory instance facesContextFactory = acquireFacesContextFactory(); // Acquire our Lifecycle instance lifecycle = acquireLifecycle(); initHttpMethodValidityVerificationWithCatch(); } /** *

* Process an incoming request, and create the corresponding response * according to the following specification. *

* *
* *

* If the request and response arguments to this method are not instances of * HttpServletRequest and HttpServletResponse, respectively, the results of invoking this * method are undefined. *

* *

* This method must respond to requests that contain the following strings by * invoking the sendError method on the response argument (cast to HttpServletResponse), * passing the code HttpServletResponse.SC_NOT_FOUND as the argument. *

* *
     * 
     * /WEB-INF/
     * /WEB-INF
     * /META-INF/
     * /META-INF
     * 
     * 
* *

* If none of the cases described above in the specification for this method apply to the servicing of this request, the * following action must be taken to service the request. *

* *

* Acquire a {@link FacesContext} instance for this request. *

* *

* Acquire the ResourceHandler for this request by calling * {@link jakarta.faces.application.Application#getResourceHandler}. Call * {@link jakarta.faces.application.ResourceHandler#isResourceRequest}. * * If this returns true call {@link jakarta.faces.application.ResourceHandler#handleResourceRequest}. * * If this returns false, call * {@link jakarta.faces.lifecycle.Lifecycle#attachWindow} followed by * {@link jakarta.faces.lifecycle.Lifecycle#execute} followed by {@link jakarta.faces.lifecycle.Lifecycle#render}. * * If a {@link jakarta.faces.FacesException} is thrown in either case, extract the cause from the * FacesException. * * If the cause is null extract the message from the FacesException, put it inside of a new * ServletException instance, and pass the FacesException instance as the root cause, then * rethrow the ServletException instance. If the cause is an instance of ServletException, * rethrow the cause. If the cause is an instance of IOException, rethrow the cause. * * Otherwise, create a new ServletException instance, passing the message from the cause, as the first * argument, and the cause itself as the second argument. *

* *

* The implementation must make it so {@link jakarta.faces.context.FacesContext#release} is called within a finally * block as late as possible in the processing for the Jakarta Faces related portion of this request. *

* *
* * @param req The Jakarta Servlet request we are processing * @param resp The Jakarta Servlet response we are creating * * @throws IOException if an input/output error occurs during processing * @throws ServletException if a Jakarta Servlet error occurs during processing * */ @Override public void service(ServletRequest req, ServletResponse resp) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) resp; if (!isHttpMethodValid(request)) { response.sendError(SC_BAD_REQUEST); return; } logIfThreadInterruped(); // If prefix mapped, then ensure requests for /WEB-INF are not processed. if (notProcessWebInfIfPrefixMapped(request, response)) { return; } releaseFacesInitContextIfNeeded(); // Acquire the FacesContext instance for this request FacesContext context = acquireFacesContext(request, response); // Execute the request processing lifecycle for this request try { executeLifecyle(context); } finally { // Release the FacesContext instance for this request context.release(); } } /** *

* Release all resources acquired at startup time. *

*/ @Override public void destroy() { facesContextFactory = null; lifecycle = null; servletConfig = null; uninitHttpMethodValidityVerification(); } /** *

* Return the ServletConfig instance for this servlet. *

*/ @Override public ServletConfig getServletConfig() { return servletConfig; } /** *

* Return information about this Servlet. *

*/ @Override public String getServletInfo() { return getClass().getName(); } // --------------------------------------------------------- Private Methods private FacesContextFactory acquireFacesContextFactory() throws UnavailableException { try { return (FacesContextFactory) FactoryFinder.getFactory(FACES_CONTEXT_FACTORY); } catch (FacesException e) { String msg = LOGGER.getResourceBundle().getString("severe.webapp.facesservlet.init_failed"); LOGGER.log(SEVERE, msg, e.getCause() != null ? e.getCause() : e); throw new UnavailableException(msg); } } private Lifecycle acquireLifecycle() throws ServletException { try { LifecycleFactory lifecycleFactory = (LifecycleFactory) FactoryFinder.getFactory(LIFECYCLE_FACTORY); // First look in the Jakarta Servlet init-param set String lifecycleId = servletConfig.getInitParameter(LIFECYCLE_ID_ATTR); if (lifecycleId == null) { // If not found, look in the context-param set lifecycleId = servletConfig.getServletContext().getInitParameter(LIFECYCLE_ID_ATTR); } if (lifecycleId == null) { // If still not found, use the default lifecycleId = DEFAULT_LIFECYCLE; } return lifecycleFactory.getLifecycle(lifecycleId); } catch (FacesException e) { Throwable rootCause = e.getCause(); if (rootCause == null) { throw e; } throw new ServletException(e.getMessage(), rootCause); } } private FacesContext acquireFacesContext(HttpServletRequest request, HttpServletResponse response) { return facesContextFactory.getFacesContext(servletConfig.getServletContext(), request, response, lifecycle); } private void initHttpMethodValidityVerificationWithCatch() throws ServletException { try { initHttpMethodValidityVerification(); } catch (FacesException e) { Throwable rootCause = e.getCause(); if (rootCause == null) { throw e; } else { throw new ServletException(e.getMessage(), rootCause); } } } private void initHttpMethodValidityVerification() { allHttpMethods = allOf(HttpMethod.class); // Configure our permitted HTTP methods allowedUnknownHttpMethods = emptySet(); allowedKnownHttpMethods = defaultAllowedHttpMethods; String allowedHttpMethodsString = servletConfig.getServletContext().getInitParameter(ALLOWED_HTTP_METHODS_ATTR); if (allowedHttpMethodsString != null) { String[] methods = allowedHttpMethodsString.split("\\s+"); allowedUnknownHttpMethods = new HashSet<>(methods.length); List allowedKnownHttpMethodsStringList = new ArrayList<>(); // Validate input against allHttpMethods data structure for (String httpMethod : methods) { if (httpMethod.equals("*")) { allowAllMethods = true; allowedUnknownHttpMethods = emptySet(); return; } if (!isKnownHttpMethod(httpMethod)) { logUnknownHttpMethod(httpMethod); // prevent duplicates if (!allowedUnknownHttpMethods.contains(httpMethod)) { allowedUnknownHttpMethods.add(httpMethod); } } else { // prevent duplicates if (!allowedKnownHttpMethodsStringList.contains(httpMethod)) { allowedKnownHttpMethodsStringList.add(httpMethod); } } } // Optimally initialize allowedKnownHttpMethods initializeAllowedKnownHttpMethods(allowedKnownHttpMethodsStringList); } } private void initializeAllowedKnownHttpMethods(List allowedKnownHttpMethodsStringList) { if (5 == allowedKnownHttpMethodsStringList.size()) { allowedKnownHttpMethods = EnumSet.of(HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(0)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(1)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(2)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(3)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(4))); } else if (4 == allowedKnownHttpMethodsStringList.size()) { allowedKnownHttpMethods = EnumSet.of(HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(0)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(1)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(2)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(3))); } else if (3 == allowedKnownHttpMethodsStringList.size()) { allowedKnownHttpMethods = EnumSet.of(HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(0)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(1)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(2))); } else if (2 == allowedKnownHttpMethodsStringList.size()) { allowedKnownHttpMethods = EnumSet.of(HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(0)), HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(1))); } else if (1 == allowedKnownHttpMethodsStringList.size()) { allowedKnownHttpMethods = EnumSet.of(HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(0))); } else { List restList = new ArrayList<>(allowedKnownHttpMethodsStringList.size() - 1); for (int i = 1; i < allowedKnownHttpMethodsStringList.size() - 1; i++) { restList.add(HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(i))); } HttpMethod first = HttpMethod.valueOf(allowedKnownHttpMethodsStringList.get(0)); HttpMethod[] rest = new HttpMethod[restList.size()]; restList.toArray(rest); allowedKnownHttpMethods = EnumSet.of(first, rest); } } private void logIfThreadInterruped() { if (Thread.currentThread().isInterrupted()) { if (LOGGER.isLoggable(FINER)) { LOGGER.log(FINE, "Thread {0} given to FacesServlet.service() in interrupted state", Thread.currentThread().getName()); } } } private void logUnknownHttpMethod(String httpMethod) { if (LOGGER.isLoggable(WARNING)) { HttpMethod[] values = HttpMethod.values(); Object[] arg = new Object[values.length + 1]; arg[0] = httpMethod; System.arraycopy(values, HttpMethod.OPTIONS.ordinal(), arg, 1, values.length); LOGGER.log(WARNING, "warning.webapp.facesservlet.init_invalid_http_method", arg); } } private boolean isKnownHttpMethod(String httpMethod) { try { HttpMethod.valueOf(httpMethod); return true; } catch (IllegalArgumentException e) { return false; } } private void releaseFacesInitContextIfNeeded() { if (!initFacesContextReleased) { FacesContext initFacesContext = FacesContext.getCurrentInstance(); if (initFacesContext != null) { initFacesContext.release(); } // Bug 20458755: ensure the special factory is removed, so as not // to incur an additional performance penalty at request processing // time. FactoryFinder.getFactory("com.sun.faces.ServletContextFacesContextFactory_Removal"); initFacesContextReleased = true; } } private boolean notProcessWebInfIfPrefixMapped(HttpServletRequest request, HttpServletResponse response) throws IOException { String pathInfo = request.getPathInfo(); if (pathInfo != null) { pathInfo = pathInfo.toUpperCase(); if (pathInfo.contains("/WEB-INF/") || pathInfo.contains("/WEB-INF") || pathInfo.contains("/META-INF/") || pathInfo.contains("/META-INF")) { response.sendError(SC_NOT_FOUND); return true; } } return false; } private void executeLifecyle(FacesContext context) throws IOException, ServletException { try { ResourceHandler handler = context.getApplication().getResourceHandler(); if (handler.isResourceRequest(context)) { handler.handleResourceRequest(context); } else { lifecycle.attachWindow(context); lifecycle.execute(context); lifecycle.render(context); } } catch (FacesException e) { Throwable t = e.getCause(); if (t == null) { throw new ServletException(e.getMessage(), e); } if (t instanceof ServletException) { throw (ServletException) t; } if (t instanceof IOException) { throw (IOException) t; } throw new ServletException(t.getMessage(), t); } } private void uninitHttpMethodValidityVerification() { assert null != allowedUnknownHttpMethods; assert null != defaultAllowedHttpMethods; assert null != allHttpMethods; allowedUnknownHttpMethods.clear(); allowedUnknownHttpMethods = null; allowedKnownHttpMethods.clear(); allowedKnownHttpMethods = null; allHttpMethods.clear(); allHttpMethods = null; } private boolean isHttpMethodValid(HttpServletRequest request) { boolean result = false; if (allowAllMethods) { result = true; } else { String requestMethodString = request.getMethod(); HttpMethod requestMethod = null; boolean isKnownHttpMethod; try { requestMethod = HttpMethod.valueOf(requestMethodString); isKnownHttpMethod = true; } catch (IllegalArgumentException e) { isKnownHttpMethod = false; } if (isKnownHttpMethod) { result = allowedKnownHttpMethods.contains(requestMethod); } else { result = allowedUnknownHttpMethods.contains(requestMethodString); } } return result; } }




© 2015 - 2024 Weber Informatics LLC | Privacy Policy