Repository navigation
JSPWIKI-673 Do not loop when a page filter asks for the permissions of the page it filters - #556
Open
arturobernalg wants to merge 4 commits into
Open
arturobernalg wants to merge 4 commits into
arturobernalg wants to merge 4 commits into
Conversation
…f the page it filters Reading the ACL of a page renders it, and rendering runs the page filters. A filter that asked for the permissions of that same page in preTranslate made DefaultAclManager.getPermissions render the page again, until the stack overflowed. getPermissions now remembers the pages whose ACL the thread is reading and returns an empty ACL when it is asked again for one of them.
arturobernalg
force-pushed
the
bug/JSPWIKI-673
branch
from
October 31, 2026 18:03
b350fd7 to
f17e93e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://issues.apache.org/jira/browse/JSPWIKI-673
Reading the ACL of a page renders the page, and rendering runs the page filters. A page filter that asks for the permissions of the page it is filtering, for example with AuthorizationManager.checkPermission in preTranslate, made DefaultAclManager.getPermissions render the page again, because the ACL of a page is only stored after the rendering ends. The result was a StackOverflowError: in a test with such a filter it came after 786 calls of the filter.
getPermissions now remembers, per thread, the pages whose ACL it is reading, and returns an empty ACL when it is asked again for one of them. The outer call still reads and stores the real ACL. The difference is that a filter that runs during that reading sees an empty ACL for its page at that moment.
DefaultAclManagerTest has a new test with a filter of that kind. It fails with a StackOverflowError without the change and passes with it. The whole jspwiki-main suite passes, 935 tests. I did not test the case of a filter that needs the real ACL of its own page during the first reading.