Bug 57290

Summary:	PermittedTaglibsTLV does not reject unspecified tags in JSP Documents
Product:	Taglibs	Reporter:	Jeremy Boynes <jboynes>
Component:	Standard Taglib	Assignee:	Tomcat Developers Mailing List <dev>
Status:	RESOLVED WONTFIX
Severity:	normal
Priority:	P2
Version:	1.2.1
Target Milestone:	---
Hardware:	All
OS:	All

Description Jeremy Boynes 2014-12-01 02:28:28 UTC

PermittedTaglibsTLV checks the XML view of a page to determine which tag libraries are permitted to be used. It does this by examining the xmlns declarations on the <jsp:root> element. This work for pages using standard JSP format because all taglib directives are translated to declarations on that root element. However, for JSP documents (.jspx XML files), the declarations are left as xmlns declarations on nested elements and so are not detected.

Comment 1 Jeremy Boynes 2014-12-01 02:45:24 UTC

A simple JSP Document produces the following XML View:

<?xml version="1.0" encoding="UTF-8" ?>
<jsp:root version="2.0" xmlns:jsp="http://java.sun.com/JSP/Page" jsp:id="0">
<jsp:directive.page jsp:id="1" pageEncoding="UTF-8" contentType="text/xml;charset=UTF-8"/>
<o:doc xmlns:d="urn:dump" xmlns:o="urn:out" jsp:id="2">
  <x:hello xmlns:x="urn:jsptagdir:/WEB-INF/tags/test" jsp:id="3"/>
</o:doc>
</jsp:root>

In this view, the 'd' and 'x' prefixes refer to tag libraries but the 'o' prefix is part of the output text. Without access TagLibraryInfo I do not see a way determine that 'urn:dump' refers to a taglib but that 'urn:out' does not.

Comment 2 Jeremy Boynes 2014-12-02 05:14:20 UTC

Test case added in http://svn.apache.org/r1642801
Documented that this TLV does not detect tags in JSP2.0 Documents.

Closing as WONTFIX