Bug 57290

Summary: PermittedTaglibsTLV does not reject unspecified tags in JSP Documents
Product: Taglibs Reporter: Jeremy Boynes <jboynes>
Component: Standard TaglibAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED WONTFIX    
Severity: normal    
Priority: P2    
Version: 1.2.1   
Target Milestone: ---   
Hardware: All   
OS: All   

Description Jeremy Boynes 2014-12-01 02:28:28 UTC
PermittedTaglibsTLV checks the XML view of a page to determine which tag libraries are permitted to be used. It does this by examining the xmlns declarations on the <jsp:root> element. This work for pages using standard JSP format because all taglib directives are translated to declarations on that root element. However, for JSP documents (.jspx XML files), the declarations are left as xmlns declarations on nested elements and so are not detected.
Comment 1 Jeremy Boynes 2014-12-01 02:45:24 UTC
A simple JSP Document produces the following XML View:

<?xml version="1.0" encoding="UTF-8" ?>
<jsp:root version="2.0" xmlns:jsp="http://java.sun.com/JSP/Page" jsp:id="0">
<jsp:directive.page jsp:id="1" pageEncoding="UTF-8" contentType="text/xml;charset=UTF-8"/>
<o:doc xmlns:d="urn:dump" xmlns:o="urn:out" jsp:id="2">
  <x:hello xmlns:x="urn:jsptagdir:/WEB-INF/tags/test" jsp:id="3"/>
</o:doc>
</jsp:root>

In this view, the 'd' and 'x' prefixes refer to tag libraries but the 'o' prefix is part of the output text. Without access TagLibraryInfo I do not see a way determine that 'urn:dump' refers to a taglib but that 'urn:out' does not.
Comment 2 Jeremy Boynes 2014-12-02 05:14:20 UTC
Test case added in http://svn.apache.org/r1642801
Documented that this TLV does not detect tags in JSP2.0 Documents.

Closing as WONTFIX